You've launched your online store, or you're about to. A supplier has sent you a set of website terms and conditions to review, or your developer has handed you a boilerplate document and asked you to sign off. You open it, scan a wall of legal text, and wonder which parts actually matter and which are filler.
Website terms of use are the document that governs every interaction a visitor has with your e-commerce site. They bind users to the rules of engagement before they browse, add to cart, or check out. They are not the same as your purchase terms or your returns policy — those deal with the transaction itself. Your terms of use sit above and around that transaction: they control how users behave on the site, what rights they have over your content, what data you collect, and how far your liability extends if something goes wrong. Getting the key clauses right means the document can actually be enforced; getting them wrong means you may be exposed to liability you thought you had limited, or locked into obligations you did not intend to accept.
How users accept your terms
Browse-wrap versus click-wrap
Before a user is bound by anything, they have to accept it. E-commerce sites use two main mechanisms.
A browse-wrap arrangement displays a notice — typically in a footer or banner — stating that by using the site, the user agrees to the terms. No active step is required. Courts have looked at these sceptically when a business tries to enforce a clause the user clearly never saw.
A click-wrap arrangement requires the user to take a positive step: ticking a box, clicking "I agree", or scrolling past the full terms before proceeding. This creates a cleaner record of consent.
For an e-commerce site where you are transacting with consumers — not merely displaying information — click-wrap at the point of account creation or checkout gives you the strongest footing. Traps to watch for:
- Pre-ticked boxes ("opt-out" consent) are unlikely to constitute genuine acceptance.
- A link buried in a page footer, with no prompt drawing attention to it, may not bind a user who never saw it.
- If you update your terms, you need a mechanism that brings returning users back to acceptance — a new mandatory tick-box on login is the clearest approach.
Right to vary
Your terms should state that you may update them from time to time and describe how you will notify users of material changes (email to the registered address is common). Without this clause, any variation could be argued to require fresh agreement from every existing user.
User conduct rules
This clause sets the boundaries of acceptable use. At minimum, it should prohibit:
- Conduct that is unlawful under any applicable Australian law.
- Uploading or transmitting malicious code, scripts, or content that disrupts the site's operation.
- Using automated tools (scrapers, bots) to extract content or data at scale without permission.
- Impersonating another person or misrepresenting an affiliation with your business.
- Posting or transmitting content that defames, harasses, or vilifies another person.
- Framing or mirroring the site in a way that creates a false impression of affiliation or partnership.
The drafting choice that matters most here is pairing each prohibition with a consequence: a clear right for you to suspend or terminate the user's account, remove the offending content, and seek compensation for any loss you suffer. Without that, the prohibited conduct list is a statement of aspiration rather than a contractual mechanism.
Intellectual property ownership
Your website contains a collection of assets that are protected under the Copyright Act 1968 (Cth): written content, product photography, graphic design, audio, and video. Brand names and logos are also protected under trade mark law. This clause needs to do several things clearly.
What you own. State that all content on the site is either owned by you or used under licence, and that no intellectual property rights are transferred to a user by virtue of their accessing or purchasing from the site.
What users may not do. Prohibit reproduction, modification, on-sale, or redistribution of your content without prior written consent. This is the clause that matters if a competitor lifts your product descriptions or a user repurposes your photography.
What users may do. If you want to encourage social sharing, set out the permitted scope precisely: which content, on which platforms, and subject to what attribution requirements. An open-ended permission to "share" creates ambiguity about commercial use.
User-generated content. If your site allows product reviews, forums, or image uploads, this sub-clause becomes critical. You need:
- A licence from the user to you to display their content on the site.
- A representation from the user that they own or have the right to submit it.
- A right to remove it if it breaches your conduct rules or a third party's rights.
- A statement about whether you intend to use it for marketing purposes — and if so, a separate consent mechanism that complies with your privacy obligations.
Privacy and data collection
Under the Privacy Act 1988 (Cth), organisations with an annual turnover above $3 million are required to comply with the Australian Privacy Principles (APPs). Some smaller businesses are also covered — including those that operate health services, deal in personal information as part of their primary business activity, or have opted in voluntarily. An e-commerce site collecting customer names, email addresses, delivery addresses, and payment data will almost certainly be an APP entity.
APP 1 requires you to have a clearly expressed and up-to-date privacy policy and to make it available free of charge. Your terms of use should not attempt to replicate that policy — instead, this clause should:
- Acknowledge that you collect personal information through the site.
- State that the site operates in conjunction with your privacy policy.
- Link directly to that policy.
- Note the user's right to access and correct their information, and how to contact you to do so.
If you send marketing emails or SMS, the Spam Act 2003 (Cth), administered by the Australian Communications and Media Authority (ACMA), requires that you hold the recipient's express or inferred consent, identify yourself as the sender, and include a functional unsubscribe mechanism in every message. The collection of marketing consent should happen at the point of sign-up or checkout — not buried in terms of use — but your terms should cross-reference your marketing consent process.
Third-party links and content
Most e-commerce sites link to third-party platforms — payment processors, social media channels, review platforms, affiliate partners. Each of those sites operates under its own terms and privacy policy, which you do not control.
This clause should:
- Confirm that links to third-party sites do not constitute endorsement of or responsibility for their content.
- Exclude your liability for anything a user encounters on a linked site, including data breaches or misleading content.
- Note that the third party's own terms and privacy policy apply once the user leaves your site.
Even where you have a commercial relationship with a third party — a referral arrangement or a display advertising partnership — your disclaimer applies. You can control what appears on your pages; you cannot control what happens on theirs.
Limitation of liability
This is where businesses most often misfire. A blanket "we accept no liability whatsoever" clause will not hold up where the Australian Consumer Law (ACL) applies — and for most e-commerce businesses selling goods or services to consumers, it will.
The ACL imposes statutory consumer guarantees that cannot be excluded, restricted, or modified by contract. You cannot disclaim liability for a product that is not fit for purpose, not of acceptable quality, or not as described — those guarantees apply regardless of what your terms say.
What your limitation clause can legitimately do:
- Where goods or services are supplied to a consumer, limit your liability to the remedies the ACL provides (repair, replacement, or refund), rather than leaving open-ended consequential loss claims.
- Where goods or services are supplied to a business purchaser (not acquired for personal, domestic, or household use), limit your liability to replacement, repair, or the cost of re-supply, as permitted under the ACL.
- Exclude liability for matters outside your control: third-party site failures, user error, or force majeure events.
- Limit liability for the accuracy of general information on the site where that information is not the product or service being purchased.
Separately, from 9 November 2023, changes to the unfair contract terms regime under the ACL now impose penalties on businesses that include, propose, or rely on unfair terms in standard form contracts. An e-commerce terms of use is a standard form contract — the customer takes it or leaves it, with no opportunity to negotiate. Any term that creates a significant imbalance in rights and obligations, is not reasonably necessary to protect your legitimate interests, and would cause detriment to the user is now not only void but can expose you to a financial penalty.
Optional and situational clauses
Depending on your business model, the following clauses may be worth including:
- Subscription and auto-renewal terms. If you offer a subscription tier (for example, a loyalty programme or premium access), set out the billing cycle, the renewal mechanism, and the cancellation process — including how far in advance a user must cancel to avoid the next charge.
- User accounts and security. If users create accounts, address their responsibility for maintaining password security and for activity conducted under their login, and your right to suspend an account that shows signs of compromise.
- Dispute resolution. Specifying that disputes will be resolved through a nominated process — negotiation, then mediation, before litigation — can reduce the cost of low-value disputes without affecting either party's right to urgent injunctive relief.
- Governing law and jurisdiction. Nominate the Australian state or territory whose law governs the agreement and the courts in which disputes will be heard. Without this, a customer in a different jurisdiction may attempt to litigate on different terms.
- Product availability and pricing. An e-commerce site is a live environment. A clause addressing pricing errors, out-of-stock items, and the point at which a contract of sale is formed (typically, dispatch confirmation rather than placement of order) protects you from situations where you have inadvertently contracted to supply goods at an incorrect price.
How Artificer Legal can help you get this right
A set of e-commerce website terms that have been assembled from a generic template — or, worse, copied from a competitor's site — will typically have one or more of these problems: the liability clause either overclaims exclusions that the ACL voids, or it fails to limit your exposure where limitation is permitted; the IP clause is drafted for a business that does not take user-generated content and provides no practical mechanism for you to act if someone posts infringing material; or the privacy clause references a policy that does not exist or does not cover the data you are actually collecting.
An Artificer Legal practitioner reviewing your terms would work through the document in document sequence, checking first that your consent mechanism is adequate for the type of business you operate and the risk profile of the site. We would then focus on the liability clause and the IP clause — these are where commercially significant exposure tends to sit — before turning to the privacy cross-reference and the conduct rules. For businesses that have recently grown past the $3 million turnover threshold, or that have expanded from B2B to B2C sales, we would flag where existing terms no longer reflect your legal obligations. Where a clause needs to be redrafted rather than amended, we would provide you with a marked version and explain the commercial reason for each change.
If you are receiving a set of terms from a platform or marketplace you are joining, we can review those for the clauses that create ongoing obligations — automatic renewal, data-sharing arrangements, and broad indemnities from you to the platform owner — that are easy to overlook on a first read.
The acceptance mechanism decides when the terms apply
If a dispute reaches a court or tribunal, the liability clause is usually the one that matters. But the clause that most often prevents a dispute reaching that point — or hands one party a clear win if it does — is the acceptance mechanism. A business that cannot show that a user accepted the terms, on the version in force at the time of the relevant event, has no contractual relationship to enforce. Without a reliable record of acceptance, every other clause in the document is theoretical.
E-commerce terms of use serve a purpose that goes beyond risk management: they define the relationship between your business and every person who interacts with your site. A well-drafted set of terms tells users what they can expect from you, what you expect from them, and what happens when things do not go to plan. Getting the essential clauses right — consent, conduct, intellectual property, privacy, liability — gives your business a document that functions when it needs to, rather than one that looks complete until the moment it is tested.