Terms & Conditions Generator USA
No federal privacy statute - a growing patchwork of state laws, plus FTC Section 5 and the wiretapping class-action risk.
US terms of service carry more weight than their European equivalents because US courts will generally enforce arbitration clauses, class-action waivers and liability caps - but only if formation was clean. Browsewrap fails; clickwrap with a visible link succeeds.
The United States has no general federal privacy law. What it has instead is a widening set of comprehensive state statutes - California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland among them - layered over sectoral rules for health, finance, education and children.
Above all of them sits Section 5 of the FTC Act. The FTC does not need a privacy statute to act: if your policy says one thing and your product does another, that is a deceptive practice, and the resulting consent orders run for twenty years. A US privacy policy is therefore best understood as a promise you will be held to literally.
The most expensive US privacy risk for a small business is not usually a regulator. It is private litigation under old wiretapping statutes - California’s CIPA in particular - repurposed against session replay, chat widgets and advertising pixels. That risk turns on consent and disclosure, which is exactly what the policy and banner control.
What a terms and conditions in the United States has to cover
Clickwrap acceptance with an affirmative action and a visible link to the terms
An arbitration clause and class-action waiver, with an opt-out window if you want it to survive scrutiny
Limitation of liability and disclaimer of warranties in conspicuous form, which several states read literally
DMCA agent designation and takedown process where users can upload content
Choice of law and venue, with the consumer-protection carve-outs some states impose
How the United States actually moves personal data
Advertising pixels and conversion APIs
Meta, Google and TikTok pixels plus server-side conversion APIs move identifiable data to ad platforms. Under most state laws this is "sharing for targeted advertising" and needs an opt-out; under CIPA theories it is the basis of the complaint.
Session replay and chat tooling
Tools that record keystrokes, mouse movement or chat content are the highest-frequency source of US privacy class actions. Disclosure before the recording starts is the defence.
Data broker and enrichment inflows
Buying enrichment data makes you a recipient of third-party personal information, which several state laws require you to disclose - and California’s Delete Act may make you a registered data broker.
Health-adjacent data outside HIPAA
Wellness, fitness and symptom data usually falls outside HIPAA but inside Washington’s My Health My Data Act, which carries a private right of action.
Children and teens
COPPA applies under 13; several state laws add duties for teens, and age-appropriate design codes impose obligations that go well past a checkbox.
Third parties the draft will ask you about
Stripe · Shopify Payments · Google Analytics 4 · Meta Pixel · Klaviyo · HubSpot · Twilio and SendGrid · AWS us-east-1 · Intercom · Segment
The rules that apply
State comprehensive privacy laws
Seventeen-plus states with rights of access, deletion, correction, portability and opt-out of targeted advertising and sale, with thresholds that catch mid-sized businesses.
FTC Act Section 5
Unfair or deceptive acts and practices. Your published statements are enforceable commitments regardless of any privacy statute.
Sectoral statutes
HIPAA for covered entities, GLBA for financial institutions, FERPA for education records, COPPA for under-13s, and the VPPA for video viewing histories.
Wiretapping and pen-register claims
CIPA in California and analogous state statutes drive class actions over session replay, chat transcription and pixel-based tracking.
Global Privacy Control
California, Colorado, Connecticut and others require honouring an opt-out preference signal from the browser, not just a link on the site.
What the generated terms and conditions contains
Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.
Building a US-facing policy
Work out which state laws you actually meet the threshold for
Most turn on residents processed per year plus revenue, and several drop the threshold where you derive revenue from selling data.
Inventory every tag before you write the disclosure
The list of tags is the list of disclosures. Anything you cannot see, you cannot describe accurately.
Implement opt-out end to end
The link, the preference signal, and the downstream propagation to ad platforms through their limited-data-use or restricted-processing settings.
Reconcile the policy against the product line by line
This is what an FTC investigation does, so do it first.
Set an annual review date and record it
Some state laws require it, and it is the cheapest possible evidence of a compliance programme.
Where this usually goes wrong
Promising more than the product does
A line like "we never share your data with third parties" alongside a live Meta pixel is a Section 5 case with no privacy statute required.
A "Do Not Sell" link that does nothing
Several state attorneys general have opened enforcement on exactly this: a link that renders a form which never reaches the ad platforms.
Ignoring browser opt-out signals
Global Privacy Control has to be honoured where state law requires it. A site with a compliant link and no GPC handling is only half done.
Treating one state law as covering all of them
Thresholds, definitions of sale, cure periods and universal opt-out obligations differ. A Virginia-shaped notice will not satisfy California.
Session replay with no pre-collection notice
Notice after the fact does not help. The consent has to be obtainable before the recording tool loads.
Frequently asked questions
Is there a federal US privacy law?
No general one. There are sectoral laws - HIPAA, GLBA, FERPA, COPPA, the VPPA - and Section 5 of the FTC Act, which reaches any business whose privacy statements are misleading.
Do I need to comply with every state law?
Only the ones whose thresholds you meet, but the practical answer for most growing businesses is to build to the strictest applicable standard - usually California - and treat the rest as variations.
What is the Global Privacy Control?
A browser-level signal that communicates an opt-out of sale and targeted advertising. California, Colorado and Connecticut among others require businesses to honour it as a valid request.
Why are companies being sued over website chat and analytics?
Plaintiffs use decades-old wiretapping and pen-register statutes, especially California’s CIPA, arguing that third-party tools intercept communications without consent. Clear pre-collection disclosure and consent are the practical defence.
Are terms and conditions legally binding?
They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.
What is the difference between terms of service and terms and conditions?
Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.
Can I limit my liability to zero?
No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.
Do I need terms if I sell nothing?
If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.
Terms & Conditions Generator USA
Answer a short questionnaire and get a draft written for the United States. Free to start, no card required.
Generate your terms and conditionsOther documents for the United States
Each one is written for the same context, not a generic template.
The same document, by country
Go deeper
PolicifyAI is a technology provider, not a law firm, and this page is not legal advice. Generated documents are a structured starting point that a qualified adviser should review before you publish or rely on them.