The terms of service on most small business websites were copied from a competitor, the privacy policy describes data practices the company does not follow, and nobody has opened either file since the site launched. Those pages are not decoration. They are what a plaintiff’s lawyer reads first, and they decide whether a dispute goes to arbitration or to a jury. Braslow Legal reviews these pages often enough to know the problems cluster in the same places: how the terms are presented, what the privacy policy promises, and whether someone using a screen reader can get through checkout.
Are website terms of service legally binding?
Sometimes, and presentation decides it. Courts consistently enforce clickwrap agreements, meaning terms a user affirmatively accepts by checking a box or clicking a button next to conspicuous notice. They routinely refuse to enforce browsewrap, where the only notice is a link buried in the footer and acceptance is inferred from continued use.
The Ninth Circuit’s decision in Nguyen v. Barnes & Noble remains the standard illustration, holding that a footer link did not put a user on notice of terms containing an arbitration clause. The fix is mechanical. Put the notice immediately adjacent to the action button, make the hyperlink visually distinct rather than gray on white, and log the assent: user identifier, timestamp, IP address, and the version of the terms in effect that day. Without that log, you may win on the law and lose on proof.
What has to be in the terms to actually protect you?
The provisions that change outcomes are the ones about where a dispute is heard and how much it can cost.
- A governing law and venue clause naming a specific court, so you are not defending a claim in another state
- An arbitration provision with a class action waiver, which the Federal Arbitration Act generally makes enforceable, paired with batching language addressing mass arbitration filings
- A limitation of liability capping damages, often at fees paid in the preceding twelve months, and excluding consequential damages
- A conspicuous warranty disclaimer, which for goods must be conspicuous under UCC § 2-316
- A modification clause requiring notice and continued use or renewed assent, since terms a company can change silently may be treated as illusory
Add a designated agent registration under the DMCA if users post content, and an indemnity running from the user to you for content they upload.
Does a small business need a privacy policy?
Almost certainly yes, and the obligation no longer depends on being large. Around twenty states have enacted comprehensive consumer privacy laws, and their thresholds turn on how many people’s data you handle rather than your revenue.
The New Jersey Data Privacy Act took effect January 15, 2025 and reaches businesses processing the personal data of at least 100,000 consumers, or 25,000 where the business derives revenue from selling personal data. It has no revenue floor, requires opt-in consent before processing sensitive data, and obligates covered businesses to recognize universal opt-out signals sent by a browser. Florida’s Digital Bill of Rights, effective July 1, 2024, applies narrowly to very large companies, though Florida’s separate breach notification statute reaches businesses of any size and requires notice to affected individuals within 30 days.
Whatever your policy says has to be true. The FTC treats a privacy policy that misdescribes actual practices as a deceptive act, regardless of company size.
What about cookies, pixels, and session replay tools?
These generate more litigation right now than the privacy statutes do. Plaintiffs have brought thousands of claims under state wiretapping laws, including California’s Invasion of Privacy Act, arguing that advertising pixels and session replay scripts intercept communications without consent. Inventory what runs on your site through a tag audit, disclose it, and obtain consent before non-essential trackers fire. Health, financial, and video content deserve particular attention, since pixel sharing there has drawn both regulatory action and class claims.
Can my business be sued because our website is not accessible?
Yes, and these filings are among the most common ADA claims in the country, concentrated in New York and Florida federal courts. Title III of the Americans with Disabilities Act covers places of public accommodation, and courts disagree about whether a website standing alone qualifies or must connect to a physical location, which means your exposure depends partly on your circuit.
No federal regulation sets a web standard for private businesses. The practical benchmark is the Web Content Accessibility Guidelines, and WCAG 2.1 Level AA is what demand letters cite and what the Justice Department adopted in its April 2024 rule for state and local government websites. Common failures are unlabeled form fields, images without alternative text, insufficient color contrast, video without captions, and menus that cannot be operated by keyboard.
Skip the overlay widget. The FTC brought an enforcement action against accessiBe in January 2025 over claims its tool made websites WCAG compliant, and courts have not treated overlays as a defense. Remediate the code and keep the audit report.
What does Braslow Legal review on a client’s website?
Whether the terms are presented in a way that creates assent, whether the privacy policy matches the data the site actually collects, and whether marketing sign-up flows capture the consent the law requires.
That last item catches people. Marketing texts generally require prior express written consent under the Telephone Consumer Protection Act, with statutory damages of $500 per message and up to $1,500 for willful violations. Commercial email needs a working unsubscribe mechanism and a valid physical postal address under CAN-SPAM. A checkbox that is pre-ticked or bundled with unrelated terms will not do the job.
Website documents are cheap to fix before a demand letter arrives and expensive afterward. Review the terms and privacy policy annually, archive each version with its effective date, run an accessibility audit against WCAG 2.1 AA, and confirm your consent flows match your policy. If the pages on your site were inherited rather than drafted, Braslow Legal can review them against the laws that apply to your business. Get in touch through the firm’s website.
