By country

Terms & Conditions Generator EU

EU GDPR, the ePrivacy Directive as implemented locally, and the one-stop-shop - with the right lead authority named.

Generate your terms and conditions Read the terms and conditions guide

EU terms have to survive the Unfair Contract Terms Directive, which lets a court strike a clause out entirely rather than reading it down. Add the Omnibus Directive’s disclosure duties on ranking and reviews, and the Digital Services Act’s duties on moderation, and the document is doing three jobs at once.

EU compliance is not one regime but one regulation applied by twenty-seven authorities, plus national laws that fill the gaps GDPR deliberately left. The cookie rules in particular are national: the ePrivacy Directive is implemented by the TDDDG in Germany, by the Loi Informatique et Libertés and CNIL guidelines in France, by Article 22.2 LSSI in Spain and by the Telecommunicatiewet in the Netherlands.

If you are established in more than one member state, the one-stop-shop mechanism gives you a lead supervisory authority based on your main establishment. That authority is the one to name. If you are established nowhere in the EU but target EU users, there is no lead authority - every national regulator can act, and Article 27 requires you to appoint an EU representative.

The regulatory surface has widened well beyond GDPR. The Digital Services Act imposes notice-and-action and transparency duties on anyone hosting user content, the AI Act layers transparency obligations onto systems that interact with people, and the Data Act adds switching and access rights for connected products and cloud services.

What a terms and conditions in the EU has to cover

Fourteen-day withdrawal on distance contracts, with the model withdrawal form referenced
Ranking parameter disclosure and review-authenticity statements under the Omnibus Directive
Notice-and-action, statement of reasons and internal complaint handling where you host user content
A liability regime that does not attempt to exclude non-excludable heads
Governing law that preserves the consumer’s right to their home courts

How the EU actually moves personal data

Cross-border customer data inside the EEA

Intra-EEA movement is not a "transfer" and needs no Chapter V mechanism, but it does need the recipient categories disclosed and, where a group company is involved, a controller-to-controller or Article 26 joint-controller arrangement.

Transfers to the United States

Certified importers can be covered by the EU-US Data Privacy Framework; everyone else needs the 2021 SCCs plus a transfer impact assessment that engages with US surveillance law rather than asserting adequacy.

Consent signals under the TCF

If you sell programmatic advertising you are likely inside the IAB Transparency and Consent Framework, which brings its own vendor list, purpose taxonomy and string format that the policy has to reflect.

Special category data by accident

Health-adjacent apps, dietary preferences, trade union membership in payroll and political affiliation in CRM records all trigger Article 9 and need a condition from Article 9(2), not just a basis from Article 6.

Employee monitoring and works councils

In Germany, Austria and the Netherlands, monitoring tools frequently require works council agreement before deployment, independently of the GDPR basis.

Third parties the draft will ask you about

Stripe · Adyen · Mollie · Klarna · Google Analytics 4 · Matomo · Brevo · AWS eu-central-1 · OVHcloud · Hetzner

The rules that apply

GDPR (Regulation 2016/679)

Articles 13 and 14 for the notice, Article 6 for the basis, Article 30 for the internal record, and Chapter V for transfers out of the EEA.

ePrivacy Directive, as implemented nationally

Consent for storing or accessing information on a device. The rule is European, the implementation and the enforcement thresholds are national.

One-stop-shop and Article 27

A lead authority if you have an EU establishment; an appointed EU representative and exposure to every authority if you do not.

Consumer Rights Directive and the Omnibus Directive

Fourteen-day withdrawal on distance sales, plus disclosure duties on ranking, reviews and personalised pricing.

Digital Services Act

Published terms, a notice-and-action mechanism, statement-of-reasons for moderation decisions and an internal complaints route for anyone hosting third-party content.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Getting an EU-facing policy right

Establish whether you have a main establishment
It determines whether you get a lead authority or face all twenty-seven. Where central decisions about processing are actually taken is the test, not where the company is registered.
Appoint an Article 27 representative if you are outside the EU
Required for most non-EU businesses targeting EU users. The representative’s name and address go in the privacy policy.
Set the age of digital consent per market
It ranges from 13 to 16 across member states. If you serve minors, the age gate has to be country-aware.
Document transfer impact assessments
One per destination country and vendor, referencing the actual legal environment, kept on file for the regulator rather than summarised in the notice.
Map DSA duties if you host user content
Notice-and-action, statements of reasons and an internal complaint system are separate obligations from anything in GDPR.

Where this usually goes wrong

Naming "the EU supervisory authority" instead of a real one

There is no such body. Users must be told they can complain to their own national authority, and if you have a lead authority you should name it.

Assuming the Data Privacy Framework covers every US vendor

It covers only organisations that have actively self-certified and remain on the list. Most smaller US SaaS vendors have not, which leaves you on SCCs plus a transfer impact assessment.

A cookie banner that pre-ticks or infers consent

The Planet49 ruling settled this: pre-ticked boxes are not consent, and continued scrolling is not consent. Several national regulators treat it as an automatic finding.

Ignoring national add-ons

Germany requires an Impressum, France requires mentions légales, and several member states set their own age of digital consent between 13 and 16. A pure GDPR document misses all of it.

Legitimate interests for advertising without an assessment

The EDPB and the courts have narrowed this repeatedly. Behavioural advertising on legitimate interests, with no documented balancing test, is the pattern that produced the largest recent fines.

Frequently asked questions

Does GDPR apply to my business if I am not in the EU?

Yes, if you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) turns on where the person is. Accepting euros, shipping to EU addresses or running EU-targeted ads are the facts regulators look at.

Which supervisory authority do I name?

If you have an EU main establishment, your lead authority. If not, tell users they may complain to the authority in their own member state, and name your Article 27 representative.

Is one policy enough for all 27 member states?

For GDPR, generally yes. For cookies, marketing, minors and consumer terms it needs national variations, because those are governed by national implementations rather than the regulation itself.

Do I need an EU representative?

If you are established outside the EU and Article 3(2) catches you, yes - unless your processing is occasional, low-risk and excludes special category data. Most e-commerce and SaaS businesses do not fit that exemption.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.