Terms of service vs privacy policy: what's the difference, and do I need both?

They usually sit next to each other in your footer, but they do different jobs. One is a contract you rely on. The other is a disclosure the law expects you to make.

How do they compare?

	Terms of service	Privacy policy
What it is	A contract between your company and its users	A notice explaining how you handle personal information
Required by Canadian law?	No general requirement	PIPEDA requires your privacy practices to be readily available; Quebec requires a published policy if you collect personal information through technological means
Who it mainly protects	Your company: rules for users, limits on liability	Users’ understanding, and your compliance with privacy law
Does the user have to accept it?	Yes, to be binding; a clickwrap step gives the clearest record	No; it informs, and consent is obtained separately
What it covers	Accounts, acceptable use, payment, ownership of content, disclaimers, liability, governing law	What you collect, why, who receives it, where it’s stored, how long you keep it, how to access it, who to contact
Who reads it closely	Users and courts, when there’s a dispute	Users, privacy regulators, app stores and business customers in security reviews
When it goes wrong	You may be unable to rely on a term	It can misdescribe your data practices to users and regulators

Does the law require each one?

For terms of service, not as a general rule; your risk position does. See do I need terms of service.

For privacy, effectively yes, if you collect personal information in the course of commercial activity under section 4 of PIPEDA. Principle 4.8 in Schedule 1 requires an organization to make specific information about its personal information policies and practices readily available, in a form that’s generally understandable. A published privacy policy is the normal way to do that. Quebec is explicit: section 8.2 of its private sector privacy act requires anyone collecting personal information through technological means to publish a confidentiality policy in clear and simple language on its website, and to give notice of changes to it. See does my app need a privacy policy.

Can I put the privacy policy inside the terms?

You can link them, but keep them separate. The terms are a contract users accept; the privacy policy has to be easy to find and understand on its own. Burying privacy practices in a long contract works against the openness principle, and the Privacy Commissioner’s consent guidelines ask you to highlight the key points rather than rely on one long document.

Is agreeing to the privacy policy the same as consent?

No. The policy explains your practices; consent is what the user agrees to, and PIPEDA generally requires it to be meaningful. For sensitive information or uses people wouldn’t reasonably expect, such as training AI models on their content, get express consent with a short notice at the right moment, not a line in the terms. See terms for AI products.

How do I make the terms binding?

Have users take an active step, such as ticking a box or clicking a button next to a clear statement that they agree, and keep a record of each acceptance. Section 19 of Ontario’s Electronic Commerce Act, 2000 recognizes acceptance by clicking an icon on a screen. See are clickwrap agreements enforceable in Canada.

Do they need to match?

Yes. If your terms say you can use uploaded content to improve the product and your privacy policy says you never use personal information for anything but providing the service, one of them is wrong. Map your data flows once and write both documents from the same map.

When to use which

• Terms of service: any product with accounts, payments, user content or AI features. Business customers buying on an invoice usually expect a SaaS agreement instead.
• A privacy policy: any product or website that collects personal information, including through analytics or ad pixels.
• Both: almost every app or platform at launch, with a privacy contact named in the policy. See the contracts a software startup needs.

What to do next

We draft terms of service and privacy policies written for how your product works, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your launch documents, book a free 15-minute consult.