Terms of service is the one document on a small company's site that is a contract rather than a disclosure. The privacy policy tells people what you do with their data; the terms set out what each side may do and what happens when something goes wrong. Most small sites publish a copied set and never think about the only part that decides whether any of it binds anybody: how it was agreed.
It is a contract, not a notice
A privacy notice is a statement of fact about your own processing, and it is true or it is not. Terms of service are an offer: you propose a set of rules, and the user accepts them. That difference drives everything else. A notice that is wrong is a disclosure problem. Terms that were never properly accepted are not a drafting problem, they are an absent contract, and the clauses you care about most (the liability cap, the arbitration clause, the license to user content) are exactly the ones a court will refuse to read into a deal nobody made.
How the terms are accepted, and why that is the whole game
The two patterns have names. Clickwrap puts the terms, or a link to them, next to a checkbox or a button whose label says what pressing it means, and the user presses it. Browsewrap puts a link in the footer and asserts that using the site is acceptance. Clickwrap is routinely upheld and browsewrap routinely is not, for one reason: the record. If you can show the version of the terms in force on the day, the wording of the button, and the timestamp of the press, you have a contract. If you can show a footer link, you have a hope. Federal law has recognized electronic records and signatures since 2000, so the question was never whether an online contract can exist; it is whether yours was formed.
What a small company's terms actually need
Six things carry their weight for almost every small site. Who you are, as a legal entity, because a contract with a brand name is a contract with nobody. What the service is and what you do not promise. The money: price, renewal, cancellation and refunds, stated in the same words your checkout uses. What the user may not do, which is your acceptable use policy and can live in the same document. Who owns what, covering both your material and anything a user uploads. And how the terms change, with notice and a version date, because a term you altered quietly is a term you altered for nobody.
What your terms cannot do
Terms are not a way around a statute. California is explicit about it: any provision purporting to waive or limit a consumer's rights under the state's privacy law is void and unenforceable as contrary to public policy. So a clause saying users agree you may sell their data however you like does not remove their right to opt out, and a clause disclaiming your obligation to answer an access request removes nothing at all. The same logic applies to consumer protection law generally. Write the terms for the commercial relationship and let the privacy notice, the opt-out and the request process do the privacy work.
Where the terms sit beside the privacy notice and the cookie document
A small company publishes three documents and they do three different jobs. The terms are a contract: they bind, they are versioned, and they should change rarely. The privacy notice is a statement of fact about your processing: it binds nobody and it has to change whenever a tool does. The cookie document is an inventory: it is a list, and it goes stale the moment somebody adds a tag. Confusing the three is what produces the common failure of a company that revises its terms annually and leaves a privacy notice describing an analytics tool it stopped using two years ago. Different documents, different review cycles, different owners.
Arbitration and class waivers: what they do, and what they cost
Consumer arbitration clauses with class action waivers are widely used and, drafted properly and presented clearly, widely enforced. What they cost is not obvious from the clause. Mass arbitration means a few thousand individual filings can leave you paying the arbitration provider's per-case fees for every one of them, which for a small company can be worse than a single lawsuit. The clause also makes the acceptance record load-bearing: a court asked to compel arbitration starts by asking whether the user agreed, which puts your checkout screenshot and your version history in evidence. If you use one, make the notice of it conspicuous at the point of acceptance, keep an opt-out window, and keep the record.
The maintenance nobody plans for
Terms drift out of true in three predictable ways. The entity changes, through incorporation, a name change or an acquisition, and the terms keep naming a company that no longer trades. The service changes, so the description covers a product you retired and omits the one that now earns the money. And the billing changes, usually a new plan or a different renewal cycle, while the terms still describe the old one. A twenty-minute review whenever one of those three happens keeps the document honest, and none of the three is discoverable from a calendar reminder, which is why the trigger should be the event and not the date.
Questions people ask about terms of service
Do I need separate terms and a privacy policy?
Yes, and they are different kinds of document. Combining them into one page is legal but makes both harder to keep true, because the privacy half has to change whenever a tool changes and the contract half should be stable and versioned.
Does a footer link count as acceptance?
Rarely, and never reliably. If the terms matter to you, put them at the point of sign-up or checkout with a labeled action and keep the record of it. If they do not matter enough to do that, they are decoration.
Can I just change the terms when I like?
Only if the terms say how, and only with notice. Publishing a new version silently means anybody who agreed to the old one is still on the old one, and you no longer know who is on which.
Does a template work?
A template is a starting shape, not a contract. The parts that make it yours are the entity name, the description of the service, the money terms and the acceptance step, and no template can supply any of those.
Do the terms need to name a governing law?
They should. Without it, which law applies is decided by rules neither side chose, and for a business selling in several states that is an argument you can avoid with one sentence. Name the state and the venue, and expect that a consumer may still carry local rights the clause cannot displace.
Can the acceptable use rules live in the terms?
Yes, and for most small companies they should, because a separate acceptable use policy is one more document to keep in sync. Split it out when the rules get long enough to need their own structure, or when a customer's procurement asks for it by name.