Website terms and a privacy policy are different documents

“Website terms and conditions australia” has no measurable Google volume in Australia at a keyword difficulty of 33, with one AI-assistant prompt a month (research/national-volume-au.json, research/ai-vol-keywords.json). “Privacy policy requirements australia website” returns nothing. Difficulty 33 against no measurable demand describes a question nobody searches and several template vendors compete over.

What follows is general information so that you know what to ask about. It is not legal advice: whether privacy law applies to your business, and what your documents should say, depends on facts this page cannot see. The privacy regulator is the Office of the Australian Information Commissioner, and consumer law sits with the ACCC.

Two legal documents doing two different jobs

A privacy policy is a statement to the world about how a business handles personal information. Where it is required, it is required by privacy law and its contents are largely specified. Website terms of use set the conditions on which people use the site: contractual in nature, drafted by the business for its own protection, and not obligatory.

Merging them into one footer page called “Terms and Privacy” helps nobody: the privacy statement gets buried in clauses no customer reads, and the terms get treated as a legal requirement.

When a privacy policy is required

Under the Privacy Act 1988 (Cth), Australian Privacy Principle 1 requires an APP entity to have a clearly expressed and up-to-date policy about its management of personal information, available free of charge.

Whether a small business is an APP entity depends on the small business exemption, which turns on annual turnover and on a set of carve-outs. This page states neither the turnover figure nor the full list, because a stale figure is worse than none and the OAIC publishes both. The carve-outs are wide: health service providers are covered regardless of size, as are businesses that trade in personal information, so plenty of small operators are covered while believing they are not.

The exemption is also under active reform. The Government agreed in principle, in its response to the Privacy Act Review, to remove it. As at 3 August 2026 no Bill has been introduced and no commencement date is legislated; a first tranche of amendments passed in 2024 did not remove it. Dates circulating in commentary are not law. Check the position with the OAIC.

What APP 1 expects a policy to cover

In general terms: the kinds of personal information collected and held, how it is collected and held, the purposes it is used for, how a person can access and correct their information, how to complain and how the complaint will be handled, and whether information is likely to go to overseas recipients — and where practicable, which countries.

A copied policy is a statement about a business that is not yours

A policy lifted from another site describes collection that does not happen and omits collection that does. It mentions a mailing list nobody runs and says nothing about the booking form, the chat widget, the analytics tags or the servers overseas.

That is not a technicality. The policy is a representation to your customers about what you do with their information, and a representation that is not true can be misleading conduct under the Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010 (Cth), quite apart from any privacy consequence.

The fix is unglamorous. List every point at which data enters the business — each form, chat, booking or payment tool, analytics, email platform, CRM, and where each stores its data — then write the policy from that list.

What website terms and conditions realistically do, and cannot do

Terms can set out permitted use of the site, ownership of its content, the licence granted to a visitor to use it, rules for accounts and user submissions, disclaimers about the accuracy of general information, and which law applies. Their contractual force depends on presentation: a footer link nobody clicked is weaker ground than a tick box at checkout.

What they cannot do is displace the consumer guarantees in the Australian Consumer Law. A term purporting to exclude, restrict or modify those guarantees does not work as written, and including one can create its own problem. Limiting liability is a separate question with its own rules, and the unfair contract terms provisions apply to standard-form consumer and small business contracts. Where the line falls needs advice; the supplier-side version is in web design contracts in Australia.

Cookies, analytics and the consent question

Australia has no direct equivalent of the European cookie consent rule. The Privacy Act applies where what is collected is personal information, and whether identifiers such as cookie IDs and device data are personal information is contested here, and is one of the live reform questions. Stating it either way claims a settled position that does not exist.

Two points hold regardless. Disclose what analytics and advertising tools run on the site and what they collect — the terms of the major platforms require that of the operator contractually, whatever privacy law requires. And do not paste in a European consent banner without deciding what it controls: a banner announcing consent while the tags fire anyway is worse than none, because it is a statement that is not true.

When these documents need drafting by a lawyer rather than templating

• Health, biometric or other sensitive information, or anything involving children
• User accounts, memberships or user-submitted content
• Ecommerce, stored payment data or subscriptions
• Data disclosed to third parties or hosted overseas
• Any business in a category the small business exemption does not reach

The practical minimum for a legally sound website agreement

• The legal entity name and business registration, not just the trading name
• A contact point for privacy enquiries
• What is collected, through which forms and tools, and why
• Who it is disclosed to, including processors overseas
• How to access, correct or complain, and that a complaint can go to the OAIC
• A last-updated date, and a footer link on every page
• A policy matching the forms actually on the site today

What to do next

Open your current policy alongside your site and list every form and tracking tool on it. Anything on the site that is not in the policy, and anything in the policy that is not on the site, needs rewriting — and a long list is the point at which a template stops being enough.

Check the current small business position with the OAIC rather than any summary, including this one. Marketing to the addresses those forms collect is covered in the Spam Act and email capture.

Both documents are deliverables somebody has to produce, and a quote that does not name who produces them has left a gap you will find at launch. The exclusions worth confirming line by line are on how a website quote is built up.