Purpose

This recipe produces jurisdiction-compliant Terms of Service and Privacy Policy documents for a startup, covering mandatory disclosures by regulation (GDPR, CCPA, PIPEDA), common mistakes that invalidate enforceability, and platform-specific requirements. The output is a deployable set of legal pages meeting disclosure requirements across all applicable jurisdictions.

Prerequisites

Privacy regulation matrix — from Data Privacy Decision Tree
Data inventory — data collected, processing purposes, third-party sharing
Business model details — revenue model, user types, payment processing
Entity details — legal name, registered address, contact info
Third-party service list — all vendors processing user data

Constraints

GDPR Articles 13/14 mandate specific disclosures. Omitting any element is a violation. [src1]
Privacy policies must be concise, transparent, intelligible, and easily accessible. [src2]
ToS enforceability depends on proper notice and acceptance. Buried links may not hold up in court. [src5]
CCPA requires separate "Do Not Sell or Share" link in addition to privacy policy. [src3]
Both documents must update when data practices change. Stale policies are compliance violations. [src4]

Tool Selection Decision

Path	Method	Cost	Quality	Turnaround
A: Generator	Termly/Iubenda	$10-$50/mo	Baseline	1-2 hours
B: Generator + Review	Generator + attorney	$500-$2K	Good	1-2 weeks
C: Attorney Draft	Privacy attorney	$2K-$10K	High	2-4 weeks
D: Specialized Firm	Privacy law firm	$10K+	Excellent	4-8 weeks

Execution Flow

Step 1: Draft Privacy Policy — Mandatory Disclosures

Duration: 1-2 hours. Universal: controller identity, data types, purposes, retention, sharing, rights, contact, update date. GDPR: DPO contact, legal basis per activity, legitimate interest details, international transfers, supervisory authority. CCPA: 12-month collection categories, sources, purposes, third parties, sale/share opt-out, retention per category, non-discrimination. PIPEDA: accountability officer, purpose identification, consent mechanism, challenge process.

Verify: All mandatory disclosures included. No placeholder text.

Step 2: Draft Terms of Service — Key Provisions

Duration: 1-2 hours. Essential: clickwrap acceptance, service scope, user obligations, IP ownership, payment terms, termination rights, warranty disclaimer, liability limitation, dispute resolution, modification clause. US: arbitration + class action waiver. EU: cannot disclaim statutory consumer rights. UK: Consumer Rights Act limits. SaaS additions: SLA, DPA reference, API limits.

Verify: All essential sections present. Clickwrap acceptance implemented.

Step 3: Create Cookie Policy (EU/UK)

Duration: 30-60 minutes. Scan site for all cookies and trackers. Categorize: strictly necessary, analytics, functional, advertising. Implement consent banner blocking non-essential cookies. List every cookie with name, provider, purpose, expiration. Consent must be withdrawable.

Verify: No non-essential cookies before consent. All cookies listed.

Step 4: Implement Placement and Notice

Duration: 30 minutes. Privacy policy link on every page footer and at data collection points. ToS at signup/checkout with clickwrap. Cookie banner for EU/UK visitors. "Do Not Sell" link in footer (CCPA). Mobile: privacy link in store listing and in-app settings.

Verify: Links work from every page. Clickwrap at signup. Mobile links in store listing.

Step 5: Review, Publish, Set Update Schedule

Duration: 30 minutes. Final check: all disclosures present, plain language, no contradictions, "last updated" date, version history. Set triggers: new data collection, new vendors, new jurisdictions, product changes, regulatory changes, minimum annual review.

Verify: Documents published. Links functional. Update schedule in calendar.

Quality Benchmarks

Quality Metric	Minimum	Good	Excellent
Disclosure completeness	All mandatory elements	Jurisdiction sections	Attorney-reviewed
Readability	Plain language	Flesch > 50	Flesch > 60
Acceptance mechanism	Sign-in-wrap	Clickwrap	Clickwrap + re-consent
Update currency	Within 6 months	Within 3 months	Every change
Cookie compliance	Banner exists	Blocks cookies	Preference center

Error Handling

Error	Cause	Recovery
Regulator notice	Missing disclosures	Update immediately, respond within deadline
ToS unenforceable	Browsewrap only	Implement clickwrap, require re-acceptance
Policy mismatch	Practices changed	Audit practices, update policy, remediate
Cookie banner broken	Technical error	Audit with browser tools, fix mechanism
App store rejection	Missing policy link	Add to listing and in-app

Cost Breakdown

Component	Generator	Generator + Review	Full Attorney
Privacy policy	$10-$50/mo	$10/mo + $500	$2K-$5K
Terms of service	$10-$50/mo	$10/mo + $500	$2K-$5K
Cookie policy	Free-$12/mo	Free + $300	$500-$1K
Annual updates	Included	$200-$500	$1K-$3K
Total Year 1	$120-$600	$700-$2,500	$5K-$14K

Anti-Patterns

Wrong: Copying another company's privacy policy

Every company's data practices differ. A copied policy doesn't match actual practices — which is itself a violation. [src5]

Correct: Draft from your actual data inventory

Start with what data you collect, why, and who you share with. Build the policy around reality, not templates.

Wrong: Using browsewrap-only acceptance

Courts regularly refuse to enforce terms when users had no actual notice. Footer links alone are often insufficient. [src7]

Correct: Implement clickwrap acceptance

Require active checkbox or "I agree" click before account creation. Creates strongest evidence of acceptance.

When This Matters

Use after completing the data privacy decision tree and before launching any product collecting personal data. Non-compliant policies are among the most easily detected violations.

Terms of Service & Privacy Policy Requirements