Two documents anchor the legal relationship between a website or app and its users: the terms of service (or terms of use) and the privacy policy, and they serve different purposes. The terms of service is a contract setting the rules of using the site, covering matters such as the license granted to users, acceptable use and prohibited conduct, intellectual property ownership, user-generated content and the license the user grants, disclaimers of warranty, limitation of liability, indemnity, termination, governing law, and dispute resolution. Its enforceability depends on presentation: terms presented in a clickwrap manner, where the user must affirmatively click I agree after being given the opportunity to review them, are generally more enforceable than browsewrap terms buried in a footer link that the user never actively accepts; and because such terms are contracts of adhesion, ambiguities are construed against the drafter, and unconscionable clauses may be struck down. Under the E-Commerce Act, electronic agreements and acceptances are legally recognized, which supports clickwrap enforceability. The privacy policy (more precisely a privacy notice) is not merely optional boilerplate; under the Data Privacy Act, a personal information controller must inform data subjects, before entry into its system, of specified matters, and must have a lawful basis for processing. A compliant privacy notice generally discloses: the identity and contact details of the personal information controller and its Data Protection Officer; the personal data collected and the purposes of processing; the lawful basis (consent, contract, legal obligation, and the others the law allows); the recipients or categories of recipients to whom the data may be disclosed, including any transfers abroad; the retention period; the security measures; and the data subject's rights (to be informed, to object, to access, to rectification, to erasure or blocking, to damages, and to data portability) and how to exercise them, including the right to complain to the National Privacy Commission. So a website needs clearly-accepted terms of service to bind users and a compliant privacy notice to lawfully collect personal data.
Two Different Documents
Terms of service is a contract setting the rules of using the site. A privacy policy/notice is a legal requirement when collecting personal data.
Making Terms Enforceable
Clickwrap terms (the user must click “I agree” after a chance to review) are generally more enforceable than browsewrap terms buried in a footer. As contracts of adhesion, ambiguities are construed against the drafter, and unconscionable clauses may be struck down. The E-Commerce Act recognizes electronic acceptance.
What a Privacy Notice Must Disclose
- The controller's identity and Data Protection Officer;
- The data collected, the purposes, and the lawful basis;
- Recipients and any transfers abroad;
- The retention period and security measures; and
- Data subject rights and how to exercise them, including complaining to the NPC.
Practical Takeaways
- Use clickwrap acceptance to make terms bind;
- A privacy notice is required, not optional;
- Disclose purpose, basis, recipients, retention, and rights.
Frequently Asked Questions
Are website terms of service enforceable? They can be. Clickwrap terms, where the user must affirmatively click to agree after an opportunity to review, are generally more enforceable than browsewrap terms merely linked in a footer, and the E-Commerce Act recognizes electronic acceptance.
Is a privacy policy legally required? Yes, when collecting personal data. Under the Data Privacy Act, a personal information controller must inform data subjects of specified matters before entry into its system and must have a lawful basis for processing.
What should a privacy notice contain? The controller's identity and Data Protection Officer, the data collected and purposes, the lawful basis, recipients and transfers abroad, the retention period, the security measures, and the data subject's rights and how to exercise them.
Can unfair clauses in terms of service be struck down? Yes. Because such terms are contracts of adhesion, ambiguities are construed against the drafter, and clauses that are unconscionable or contrary to law may be struck down by the courts.
This commentary is for general informational purposes only and does not constitute legal advice. For guidance specific to your situation, please consult a licensed attorney.
If you have questions about your rights or options under Philippine law, our firm is available to assist. You may reach us via Viber or WhatsApp, call us at 0995 433 5550, or send an email to vivasnobles@gmail.com. We look forward to hearing from you.