Website terms and conditions — the clauses Indian law will not enforce, however clearly you write them

First, what does your site actually do?

Before any drafting, one question decides the whole document, and it is not a legal question. What does the site do?

A page describing your services needs a short, accurate document. A shop that takes money needs a commercial contract. A platform that hosts what other people write needs something different again, because its terms are part of the protection the law gives it. Most of the bad terms we read are bad because they were written for one of these and pasted onto another.

Five broad shapes cover almost everything.

• A brochure site. Information about you and your services, with a contact form. What it needs: accurate disclaimers about the information, a statement of content ownership, the business’s identity and address, and a grievance route. What it does not need: order, payment, refund and account machinery for transactions it never performs.
• A shop. Products or services sold directly. Now you need the commercial terms in full — how an order is placed and accepted, price and taxes, payment, delivery, cancellation, returns and refunds — plus the disclosure and grievance requirements that apply to selling online.
• An account-based service. Users register and use something over time. Registration, eligibility, account security, acceptable use, suspension and termination, subscription and renewal, and what happens to data and content when the account ends.
• A marketplace. You connect buyers and sellers. The hardest of the five, because you are both an intermediary and a party to something, and the terms have to be clear about which obligations are yours and which are the seller’s.
• A platform hosting user content. Anything where people post. Here the user agreement is not a nicety; it is part of the due diligence on which your protection from liability for other people’s content depends.

We ask for a short description of the site and a walk through its actual flows before drafting anything, because a document that describes functions you do not have is as useless as one that omits the ones you do.

How terms become binding

There is no special law of website contracts in India. There is the ordinary law of contract, applied to a screen.

Section 10 of the Indian Contract Act, 1872 provides that all agreements are contracts if they are made by the free consent of parties competent to contract, for a lawful consideration and with a lawful object, and are not expressly declared to be void. Every one of those elements has a practical counterpart on a website. Free consent requires that the user knew what he was agreeing to. Competence excludes, among others, a minor — which is why an eligibility clause matters and why it interacts with the data protection rules on children.

Section 10A of the Information Technology Act, 2000 removes the only objection unique to the medium: where a contract is formed through electronic means, it shall not be deemed unenforceable solely on the ground that such electronic form or means was used for that purpose. We deal with the electronic contract provisions more fully in our non-disclosure agreement guide.

So the real question is never “are online terms valid?” It is “did this user agree to these terms, and can you show it?”

Clickwrap, browsewrap and proving acceptance

Two ways of presenting terms, and a large difference in how defensible they are.

Clickwrap puts the terms in front of the user and requires an affirmative act — an unticked box that the user ticks, or a button next to a clear statement that pressing it accepts the terms, with a working link to read them at that moment. The user does something, and you can record that he did it.

Browsewrap puts a link in the footer and asserts that continued use of the site signifies acceptance. Nobody does anything, so there is nothing to record. To enforce browsewrap terms you have to establish that the user had notice of them, and a small grey link at the bottom of a long page is a weak foundation for that argument.

The practical guidance we give is unglamorous and it works.

• Use clickwrap wherever money or commitment is involved — registration, checkout, subscription, or uploading content.
• Do not pre-tick the box. A pre-ticked box is not an affirmative act, and in the data protection context it is explicitly not valid consent.
• Keep the terms reachable at the moment of acceptance, not three clicks away.
• Separate the consents. Accepting the terms of service and consenting to the processing of personal data are different things and should not be bundled into one tick.
• Log it. The version identifier of the terms displayed, the timestamp, and the user identifier. Without this you cannot later say what the person agreed to.

That last point is the one that gets skipped, and it is the one that decides disputes. A business that has changed its terms six times and kept no history cannot prove which version bound a customer who signed up two years ago.

The unfair contract provisions

This is the most important development in this area of Indian law, and it is the reason a well-drafted Indian document differs from an imported one.

Read the six illustrations against a standard set of website terms and the overlap is uncomfortable.

Limb (ii) catches the cancellation fee that bears no relation to any loss, and the forfeiture of an entire advance on a late cancellation. Limb (iv) catches the clause permitting you to suspend or terminate an account “at any time, for any reason, without notice” — wording that appears in a large majority of the terms we are asked to review. Limb (v) catches the assignment clause that lets you transfer the contract to anybody while binding the customer. Limb (vi) is a residual category wide enough to capture most of what a careful reader would call unfair.

Note also the opening words. It is not necessary that a term be unconscionable; it is enough that the contract has terms causing significant change in the rights of the consumer. And the word “including” before the six illustrations means the list is not exhaustive.

The Commission can strike a term out

A definition without a remedy would be of limited interest. The Act supplies one.

The State Commission and the National Commission each have the power, in relation to matters before them, to declare any terms of a contract, which is unfair to any consumer, to be null and void. That is a direct power over the document itself, exercisable in a consumer proceeding.

Three consequences for drafting.

• Writing a term does not create a right. The clause you are relying on may simply cease to exist in the middle of the dispute you were relying on it for.
• An aggressive document is a liability, not an asset. A term struck down does not merely fail; it colours how the rest of the document and your conduct are viewed.
• Severability matters. The terms should be drafted so that the failure of one clause does not take the rest with it — and so that the clauses you actually need are the defensible ones.

The separate machinery for unfair trade practices sits alongside this. Misleading descriptions, false claims about a product or service, and the other practices the Act enumerates are dealt with under that head, and no clause in your terms answers a complaint about what your marketing said.

Section 28 — time limits and ousting the courts

Limb (b) is the one that quietly defeats a familiar imported clause. “Any claim must be brought within thirty days, failing which it shall be deemed waived” is exactly the kind of term the section addresses: it extinguishes a right on the expiry of a specified period. Such clauses appear in a great many Indian websites’ terms, copied from jurisdictions where they are effective.

What you can do instead is prescribe procedure rather than extinguish rights — require a complaint to be raised through a stated channel, within a reasonable period, as a step before escalation, without purporting to destroy the underlying claim. That is a real and useful clause; the thirty-day extinguishment is not.

Limb (a) is why a clause saying “no disputes shall be taken to any court” fails. The exceptions preserved in the section relate to arbitration, which is a different mechanism rather than an absolute bar.

Jurisdiction clauses, and the consumer exception

Between two businesses, the position is settled and sensible. Where two or more courts would ordinarily have jurisdiction over a dispute, an agreement confining it to one of them is valid, because the parties have chosen between available forums rather than ousted them all. What is not permitted is conferring jurisdiction on a court that has none, or excluding every court, which runs into Section 28.

Against a consumer, the analysis is different and most businesses have not caught up with it.

That is a statutory right of forum, conferred on the consumer by the legislature. A clause in your terms requiring him to come to the courts of your city does not take it away. A customer in a small town may complain in his own district, and the practical consequence for a business selling nationally is that it can be brought before a Commission anywhere.

That is not a reason to omit a jurisdiction clause — it remains useful for business customers and for non-consumer disputes. It is a reason not to build your risk planning on it.

Arbitration clauses, and why they do not stop a consumer

Almost every imported set of terms contains an arbitration clause, and businesses that adopt one usually believe it has done two things: kept disputes out of court, and kept them private. Against a business customer both may be true. Against a consumer, neither reliably is.

Start with why an arbitration clause is permitted at all. Section 28 voids agreements that restrain a party absolutely from enforcing his rights by the usual legal proceedings, but the section expressly saves contracts to refer disputes to arbitration. Arbitration is treated as a chosen mechanism for deciding disputes rather than a denial of the right to have them decided. That is why the clause survives where a bare “no disputes shall go to any court” clause would not.

The difficulty is what it does not survive.

The consumer remedy under the Consumer Protection Act is an additional remedy, not a substitute for other rights, and the Act creates a statutory forum for a class of person the legislature intended to protect. A consumer who has signed terms containing an arbitration clause can still approach a Consumer Commission, and the existence of the clause is not by itself an answer to the complaint. A business that has built its dispute strategy on the assumption that every customer is contractually routed into arbitration has built it on sand.

The commercial arithmetic points the same way, and it is worth setting out because it persuades businesses more effectively than the law does.

• Arbitration is expensive. There is an arbitrator to pay, a venue, and usually lawyers on both sides. For a dispute about a two thousand rupee order, the process costs many times the amount in issue — and the business, not the customer, generally ends up bearing most of it.
• A consumer complaint is cheap and accessible. The forum is designed to be used without a lawyer, filing can be done electronically, and the consumer can file where he lives. Given the choice, that is where a customer will go.
• A clause that looks oppressive helps the other side. Terms requiring a customer to arbitrate a small claim, at a seat far from where he lives, at shared cost, are precisely the kind of unreasonable condition putting a consumer at a disadvantage that Section 2(46) describes. Producing such a clause in a consumer proceeding rarely improves a business’s position.

So what should the terms say? Our usual structure has three tiers, and it is drafted to be used rather than to deter.

First, a real grievance step. A named officer, a channel, an acknowledgement within the time the framework requires, and a genuine attempt at resolution. Most disputes end here, and the businesses that handle this stage properly rarely see the later ones.

Second, an optional escalation — mediation or a structured negotiation between people with authority, with a short timetable. Framed as a step both sides may take, not as a precondition that bars the customer from going anywhere.

Third, arbitration where it is appropriate — which in practice means business customers and higher-value contracts. Where you include it, name the seat and the venue, the language, the number of arbitrators and how they are appointed, and how costs are borne. An arbitration clause that omits these produces a preliminary fight about the clause before anybody reaches the dispute.

For a consumer-facing site, the honest position is that the arbitration clause is doing far less work than it appears to, and the grievance mechanism is doing far more. Draft accordingly, and staff the part that actually matters.

Limiting liability without overreaching

The limitation of liability clause is where imported terms are at their most aggressive and Indian enforceability is at its weakest.

A clause excluding all liability, for everything, in all circumstances, is the clearest candidate for the unfair contract provisions: it is an unreasonable condition which puts the consumer at a disadvantage, and it is exactly the kind of term a Commission has power to declare void. Worse, it tends to fail as a whole rather than being read down, leaving you with no protection at all.

A proportionate clause is more likely to survive and more likely to be worth having:

• Exclude indirect and consequential loss — loss of profit, loss of business, loss of data — which is a normal commercial allocation.
• Cap direct liability at a stated figure with a rational basis, usually related to what the customer actually paid over a defined period.
• Carve out what cannot be excluded, including liability for fraud and for things the law does not permit you to exclude.
• Keep it mutual where it can be. A limitation clause running only one way invites the unfairness argument; one that constrains both sides is far easier to defend.
• Do not disclaim what you actively promise. Terms that exclude all warranties, sitting under a homepage that guarantees results, undermine both documents.

Note also Section 74 of the Contract Act, which limits a party claiming under a penalty clause to reasonable compensation not exceeding the amount named. A large stated figure is a ceiling, not an entitlement — we deal with that in the NDA guide.

Changing the terms later

Every set of terms needs a mechanism for change, because businesses change. The question is what mechanism.

The clause most commonly used — “we may modify these terms at any time; continued use constitutes acceptance” — is a unilateral variation clause. Against a consumer it engages the illustrations in Section 2(46) directly, and as a matter of contract it is doubtful whether continuing to use a service is assent to terms the user was never shown.

A defensible mechanism has four parts:

• Notice of the change, by a means the user will actually see, and not only a changed date at the top of a page.
• A date from which the change takes effect, with a reasonable interval.
• An exit — the user may stop using the service or terminate before the change takes effect, with a stated consequence for anything already paid.
• A record — the earlier version remains available, and you can show which version applied when.

For material changes affecting price or the scope of the service, fresh acceptance rather than deemed acceptance is the safer route.

If you sell online

Selling goods or services online brings a further layer, and it is prescriptive rather than advisory.

The e-commerce framework under the consumer law requires an entity to display prominently, among other things, its legal name, the addresses of its headquarters and branches, its website details, and contact information for customer care and for grievance redressal. It requires the appointment of a grievance officer, with his name, contact details and designation displayed, who must acknowledge a complaint within forty-eight hours and redress it within one month of receipt.

It also constrains commercial behaviour in ways that belong in the terms:

• No manipulation of price to gain unreasonable profit, and no unreasonable discrimination between consumers of the same class.
• No cancellation charge on a consumer cancelling after confirming a purchase, unless similar charges are also borne by the entity where it cancels unilaterally for any reason.
• Clear information before purchase, including the total price with a breakdown, and the return, refund, exchange, warranty and guarantee arrangements.
• No false representation of oneself as a consumer, and no posting of reviews about one’s own goods or misrepresenting the quality of goods or services.

The second item is worth pausing on because it is so often breached in drafting. A one-sided cancellation fee is not merely commercially unattractive; it is specifically addressed. If you charge the customer for cancelling, the framework contemplates that you bear a similar charge when you cancel on him.

Marketplaces carry additional obligations relating to seller information and to what the platform must disclose about the sellers on it, and a marketplace’s terms have to distinguish carefully between what the platform promises and what the seller does.

If users post content

The moment your site hosts what other people write or upload, the terms change character. They stop being merely a commercial document and become part of the compliance that protects you.

An intermediary is protected from liability for third-party information, data or communication links made available or hosted by it, provided it observes the prescribed due diligence and meets the other statutory conditions. That due diligence includes publishing the rules and regulations, privacy policy and user agreement for access or usage of the service, informing the user of those documents and of the changes to them at least once every year, and informing users of the categories of content they must not host, display, upload, publish, transmit or share.

Three things follow for the drafting.

• You need a user agreement, distinct from your commercial terms, setting out acceptable use and prohibited content in terms that track the prescribed categories rather than paraphrasing them loosely.
• You need the ability to act — a stated right to remove or disable access to content and to suspend accounts, with the grounds and the process set out. Without it, removing somebody’s content is a breach of your own contract.
• You need a grievance mechanism with a named officer and published timelines, and it has to be operated rather than merely described.

Businesses frequently discover this late, usually on the day they need to remove something. Our notice guide deals with the takedown framework from the complainant’s side, which is the mirror of the obligations described here.

The licence you need over user content

A related question, and one where most terms overreach.

The user who wrote the review, took the photograph or uploaded the video is the author, and the author is the first owner of the copyright. You do not acquire ownership by hosting it. What you need is a licence wide enough to operate your service: to host, store, reproduce, display, adapt for formatting and distribute the content for the purpose of providing and promoting the service.

What a great many terms claim instead is a perpetual, irrevocable, worldwide, transferable, sub-licensable assignment of all rights in everything the user posts. That is far wider than any normal service needs, it is the clause users object to most, and in a consumer context it is exposed to the unfairness argument as an unreasonable condition.

A defensible clause is specific about purpose, about whether it survives deletion of the content or the account, about whether the content may be used in advertising, and about moral rights. Our copyright guide and freelance agreement guide set out the assignment and licensing mechanics in detail.

Terms and privacy policy are different documents

They are routinely merged, and they should not be, because they are different kinds of instrument doing different jobs.

The terms are a contract. They govern the relationship, allocate risk, and are enforceable between you and the user.

The privacy policy is a notice with its own statutory requirements. Under the Digital Personal Data Protection Act, 2023 the notice has to state the personal data and the purpose, how the person may exercise her rights and how she may complain to the Board, and she must have the option to access it in English or a language of the Eighth Schedule to the Constitution. Consent has its own standard and has to be as easy to withdraw as to give.

Merging them produces a single document too long for anybody to read at a signup screen, in which the notice obligations are buried inside contractual language. Keep them separate, link both at the point of acceptance, and take the consents separately. Our DPDP privacy policy guide covers that side in full.

Your own content, and people copying it

Terms should state clearly what you own — the text, images, design, logos, code and databases on the site — and what a visitor may and may not do with it.

Two practical points, because this clause is often written as boilerplate and then relied on.

Check that you actually own it. A business that had its site built by an agency, its photographs taken by a freelancer and its logo designed by a contractor may hold none of those rights without a written assignment. The terms can say the content is yours; the Copyright Act decides whether it is. This is the commonest reason an enforcement attempt collapses at the first reply.

A terms clause is not itself the remedy. If somebody copies your site, the action lies in copyright, and possibly in trade mark, rather than in a clause the copier never accepted. Our copyright infringement notice guide sets out that route, including why registration is not a precondition.

What the terms should contain

A workable set of Indian website terms, for a site that sells, contains the following — and a brochure site needs only the first group.

Identity and scope. Who you are, in your legal name, with the address and contact details. What the site is and what these terms apply to. Eligibility, including age and capacity. Definitions, kept short.

Acceptance and changes. How the terms are accepted, that acceptance is recorded, and the variation mechanism with notice, effective date and exit.

The commercial terms. How an order is placed and when it is accepted; price, taxes and additional charges; payment methods and failures; delivery or performance; cancellation by the customer and by you; returns and refunds, with timelines; and subscriptions, renewals and how to stop them.

Accounts and conduct. Registration, accuracy of information, account security, acceptable use, prohibited conduct, and suspension or termination with grounds and process.

Content. Your intellectual property and what visitors may do with it; user content, the licence you take, and your right to remove; and third-party links and services.

Risk. Disclaimers about accuracy and availability; limitation of liability, drafted proportionately; indemnity, kept within what the user can reasonably bear; and force majeure.

Resolution. The grievance officer with name, designation, contact and timelines; the complaint procedure; governing law; and jurisdiction, with an honest understanding of its limits against consumers.

Housekeeping. Severability, so that one bad clause does not take the rest; assignment; entire agreement; notices; and the version and effective date.

Why imported templates fail here

It is worth being specific about this rather than simply advising against templates, because the failures are particular and predictable.

Versions, records and the engineering side

Half of enforceability is not drafting at all. It is record-keeping, and it has to be built rather than written.

What a business should be able to produce, if a dispute arises two years from now: the exact text of the terms that were live on the date the customer signed up; evidence of what he did to accept them; the date and manner in which any change was notified to him; and, where the change was material, evidence of fresh acceptance.

Very few Indian websites can produce any of that. The terms page is edited in place, the old text is gone, and the only evidence of acceptance is that the account exists.

The grievance register is worth the small effort for a separate reason: where a complaint escalates, a business that can show it acknowledged within the required time and acted is in a materially better position than one relying on memory.

Selling into India from outside

A foreign business selling to customers in India frequently assumes its home terms travel with it. They do not, entirely.

A governing law clause chooses the law of the contract between you and the customer. It does not determine the reach of Indian consumer legislation over a transaction with a consumer here, and it does not displace Indian data protection law, which extends to processing outside India where it is connected with offering goods or services to people in India.

The practical consequence is a short India-specific layer rather than a complete rewrite: the disclosures and grievance officer, an India-appropriate approach to cancellation and refunds, removal of the clauses listed in the table above, and a privacy notice that meets the Indian requirements. Our DPDP guide covers the second of those.

Where these go wrong

• Terms describing a business the site does not run. Shipping clauses on a consultancy site, or none at all on a shop.
• Browsewrap where money changes hands. A footer link is not acceptance of a payment contract.
• A pre-ticked acceptance box. Not an affirmative act, and not valid consent for data.
• No version history. You cannot prove what anybody agreed to.
• The aggressive clauses relied on. Blanket exclusion, thirty-day limitation, termination at will — the three most likely to fail.
• Terms and privacy policy merged. Too long to read and neither requirement properly met.
• A grievance officer named but not staffed. A published promise, unkept.
• Claiming ownership of content you never acquired. The Copyright Act decides, not your terms.
• Marketing that contradicts the terms. A homepage guarantee under a disclaimer of all warranties.
• Never reviewed after launch. The business changed; the document did not.

Time and cost

Drafting starts at ₹1,999 and ordinarily takes 1 – 3 days. We begin by looking at what the site actually does, because a document drafted to the wrong shape is the commonest failure in this area.

Where you also need a privacy policy, a refund policy and a disclaimer, the website legal pack covers the set and costs less than the documents separately. Where you license software, add an EULA; where you commit to service levels for business customers, an SLA; and the privacy side is our DPDP-compliant privacy policy.

If four or more of those go the wrong way, the document is not protecting you — it is a record of intentions that will not survive the first proper challenge. Send it across and we will tell you which clauses to keep, which to redraft and which to remove.