Design Privacy Policies and Terms of Use that are legally compliant, user-friendly, accessible, and trustworthy. Use when building any website to ensure proper legal protection, regulatory compliance (GDPR, CCPA, COPPA, PIPEDA, LGPD), and user trust through clear, plain-language documents. Covers design patterns, placement strategies, implementation examples, and jurisdiction-specific requirements. Every website needs both documents.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Design Privacy Policies and Terms of Use that are legally compliant, user-friendly, accessible, and trustworthy. Use when building any website to ensure proper legal protection, regulatory compliance (GDPR, CCPA, COPPA, PIPEDA, LGPD), and user trust through clear, plain-language documents. Covers design patterns, placement strategies, implementation examples, and jurisdiction-specific requirements. Every website needs both documents.
Policy Pages Skill
Design Privacy Policies and Terms of Use that build user trust while protecting your business legally.
Why Policies Matter
Two distinct purposes:
Legal Protection — Legally binding agreements and disclosures protecting your business
User Trust — Transparent communication showing respect for user data and rights
Generic, dense legal jargon kills trust. Modern policies must be: plain language, visually scannable, accessible, mobile-optimized, and contextual (information where users need it).
Privacy Policy vs Terms of Use
Document
Purpose
Legal Basis
Audience
Privacy Policy
What data you collect, how you use it, how you protect it, user rights
<label><inputtype="checkbox"name="privacy_consent"required>
I agree to the <ahref="/privacy">Privacy Policy</a></label>
For just-in-time consent (GDPR):
<divclass="consent-notice"><h3>We use cookies to improve your experience</h3><p>Our cookies help us analyze traffic and personalize content.</p><buttononclick="acceptCookies()">Accept</button><ahref="/privacy#cookies">Learn more</a></div>
Version Control:
Add "Last Updated: [DATE]" at top
Include changelog: "Updated November 2024: Added AI processing section"
Email notification of major changes (not required, best practice)
Terms of Use
What to Include
Every Terms of Use must address these 15+ essential elements:
Acceptance of terms — "By using this website, you agree to these terms"
Service description — What you're providing
User eligibility — Age requirement (13+, 18+, etc.), jurisdiction restrictions
User rights granted — "You may view and download content for personal use only"
Prohibited uses — No illegal activity, scraping, harassment, reverse engineering, etc.
Intellectual property — Copyright, trademarks; users retain content rights
Warranties disclaimer — "Services provided 'as is' without warranty"
Limitation of liability — Liability cap (often: not responsible for indirect/consequential damages)
Indemnification — "You agree to defend us against claims arising from your use"
Termination rights — "We may terminate your account at any time for any reason"
Privacy/data handling — Link to Privacy Policy
Third-party links — "We're not responsible for external sites"
Dispute resolution — Governing law, arbitration vs. courts, jurisdiction
Severability — "If one provision is invalid, the rest remains in effect"
Changes to terms — How you notify users of updates (email, website notice)
<divclass="notice"><strong>By uploading, you agree that:</strong><ul><li>The content doesn't violate anyone's rights</li><li>We can store and display it</li></ul><ahref="/terms#user-content">Full terms</a></div>
Version Control:
Maintain version numbers: "Terms of Use v3.2 (Updated November 2024)"
Keep archive of all versions (on /legal/archive or similar)
Notify existing users of material changes (best practice, sometimes required by law)
Email template: "We've updated our Terms. [Link to what changed]. If you don't agree, you can delete your account."
Accessibility Requirements
Use semantic HTML: <h2>, <h3>, proper heading hierarchy
Alt text on diagrams (e.g., "Flow chart showing data sharing with payment processor")
Don't rely on color alone (use text, icons, structure)
Font: minimum 16px body text, sans-serif preferred
Line height: minimum 1.5x font size
Use sufficient color contrast (4.5:1 for body text)
Keyboard navigable: all links clickable via Tab key
Screen reader compatible: proper ARIA labels on form inputs
Mobile Optimization
Single column layout on mobile (never horizontal scroll)
Responsive text: use relative units (rem, em, %)
Tap targets: buttons and links minimum 44×44px
Touch-friendly: don't require hover states
Progressive disclosure: collapse sections by default on mobile
Print-friendly: media queries for printing (users print policies often)
Common Mistakes to Avoid
❌ Mistake
✅ Correct Approach
Dense legal text with no formatting
Headings, bullet points, callout boxes, tables
Hiding privacy policy in footer only
Footer link PLUS prominent page at /privacy
Copying another company's policy
Customize to YOUR data practices (Google's policy isn't yours)
Outdated dates and version numbers
Update date whenever policy changes, even minor ones
Broken links to Privacy Policy in ToS
Test all internal links from terms to privacy
No way for users to opt-out
Provide opt-out/unsubscribe mechanisms for email/cookies/tracking
Policy says one thing, site does another
Audit: does your site match your policy? (e.g., if you say "no tracking," verify no trackers)
No acceptance mechanism for ToS
Require checkbox at signup with timestamp record
Using overly technical language
Explain technical terms: "Cookies are small files stored on your device..."
Not accounting for different jurisdictions
Add jurisdiction-specific sections (e.g., "California Residents" section for CCPA)
Audit Checklist
Before launching, verify:
Privacy Policy:
All data types you collect are listed
All third parties who access data are named
Legal basis for each processing purpose is stated
User rights (access, deletion, etc.) are listed with instructions for exercising them
Cookie types and opt-out mechanisms are explained
Jurisdiction-specific requirements met (GDPR/CCPA/etc.)
Contact info for privacy inquiries is included
Document is dated and versioned
All links work (to /cookies, /contact, etc.)
Mobile-friendly and accessible
Written in plain language (no legal jargon)
Terms of Use:
User eligibility stated (age, geography restrictions)
Permitted uses are clear
Prohibited uses are explicit (no illegal activity, no scraping)
Your IP rights stated
Users' content rights stated (do they retain ownership?)
Liability limitations included
Dispute resolution method specified
Governing law specified
Requires acceptance via checkbox at signup
Acceptance recorded (timestamp, IP, version)
Old versions archived
Mobile-friendly and accessible
Plain language (explain legal terms)
Maintenance & Updates
Regular Audit (Quarterly):
Do you collect new data types not listed?
Have you added new third-party integrations?
Have regulations changed in your jurisdictions?
Have users complained about unclear sections?
Update Triggers:
New data collection practice
New third-party vendor
Regulatory change
User complaint or legal inquiry
Major feature update
Notification:
Add "Updated [DATE]" at top
If major change: email existing users
Archive old version at /legal/archive/privacy-v2-2024-01.html
Change version number: v3.2 → v3.3
Reference Files
For detailed implementation guidance, see:
privacy-policy-detailed.md — 15 essential elements with examples, plain language guidelines, legal requirements by jurisdiction
terms-of-use-detailed.md — 15+ elements with implementation examples, jurisdiction-specific guidance, dispute resolution options
Read these when customizing your specific policy documents for your business model and jurisdictions.
Next Steps
Copy privacy-policy-detailed.md and terms-of-use-detailed.md → customize for your business
Write Privacy Policy using the 15 essential elements checklist
Write Terms of Use specifying your service, user rights, and liability limits
Run accessibility audit (Lighthouse, WAVE)
Test mobile rendering
Add links to both policies in footer + in signup forms
Record acceptance timestamps for both documents
Schedule quarterly review
REQUIRED: Every website must have both documents. These are legal minimums, not optional extras. Build trust through transparency.
