How to Review Website / App Terms of Service (India)

Most people skim terms of service twice: once when they write a first draft by copying a template, and once when something has already gone wrong. Both times are too late to catch the mistakes that matter. A website or app's terms of service is a real contract, formed the moment someone clicks "I agree" or, on many sites, simply by using the service, and Indian law treats acceptance, unfair terms, and a platform's compliance duties differently from what a US-style template assumes.

Adira, which publishes this guide, makes contract review and CLM software, so we have a commercial interest in you taking your terms seriously. The analysis below stands on its own regardless. If you want to mark up a set of terms by hand today, free, Weave, Adira's browser-based contract tool, lets you do that without an account, whether you publish the terms or are a user trying to understand what you are agreeing to.

Who this guide is for, and the one question everything else depends on

This page works for two readers. If you run a website or app, it tells you what your terms need to actually hold up. If you are a user, it tells you what to check before you click "I agree."

Both readers need the same threshold answer first: how did you (or your user) actually accept these terms? Indian courts and the Information Technology Act treat this as the hinge the rest of the analysis turns on. A term buried in text nobody had to read is legally weaker than the same term placed in front of an explicit "I agree" click, and the gap between the two is bigger in India than most drafters assume.

Clause by clause

Acceptance mechanics. Covered below; decides whether everything else is even enforceable.

User obligations and prohibited use. State what a user must not do, plainly, not just "use the Service lawfully." Indian intermediary rules require specific prohibited-content categories here; see the IT Rules 2021 section below.

IP and user-content licence. Two questions get conflated constantly: who owns content a user uploads (usually the user), and what licence the platform needs to display and distribute it (usually a broad, non-exclusive, royalty-free licence scoped to running the service, not an unlimited grant to do anything with it forever).

Disclaimers and limitation of liability. Caps what the platform owes, and excludes categories of loss like indirect damages. See our limitation of liability explainer for what actually holds up under Indian law.

Unilateral amendment. Nearly every terms page reserves the right to change at any time. Whether a user is bound by a change they never saw depends on notice mechanics, covered in our variation clause guide.

Termination and suspension. Should state the grounds, whether notice is given, and what happens to a user's data and paid-for access on exit. Silence here is the clause users complain about most after the fact.

Governing law and jurisdiction. Straightforward for an Indian business serving Indian users; contested when the platform is foreign-incorporated. See our jurisdiction clause guide for how courts read an exclusive-jurisdiction clause.

The Indian position: is a click actually a signature?

Start with the statute, not the assumption. Section 10A of the Information Technology Act, 2000 (inserted by the 2008 amendment) says:

"Where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, as the case may be, are expressed in electronic form or by means of an electronic records, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used for that purpose." Source: Section 10A, Information Technology Act, 2000 (Indian Kanoon)

That single line is the statutory basis for enforcing a clickwrap agreement in India: an electronic acceptance is not automatically unenforceable just because it was electronic. It does not say every click is enforceable regardless of how it was obtained. The rest of contract law, offer, acceptance, and genuine assent under the Indian Contract Act, 1872, still applies on top of it.

This is where clickwrap and browsewrap diverge sharply in practice, though Indian courts have not yet drawn the line as precisely as US courts have:

• Clickwrap: the user takes an affirmative action, ticking a box or clicking "I Agree," after the terms were shown or made reasonably accessible. Courts view this as closer to a signed acceptance.
• Browsewrap: the terms sit behind a footer link, and continued use is treated as acceptance, with no explicit action required. If a user never had to see the terms, arguing genuine assent to a specific clause, a forum-selection or arbitration clause say, is a much harder case.

The Supreme Court's approach in Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., (2010) 3 SCC 1, though not a clickwrap case on its facts, is the leading authority courts reach for on electronic contract formation. The Court held that a binding contract existed purely from an exchange of emails, once offer and unconditional acceptance were both clearly communicated electronically, without a single signed document. Read it on Indian Kanoon. The takeaway: Indian courts look at whether real, demonstrable assent happened, not at the medium. A clickwrap flow that logs a timestamped "I Agree" click against a specific version of the terms sits comfortably within this reasoning. A browsewrap flow, where nobody can show the user ever engaged with the terms, sits on much shakier ground.

There is a second, separate check even after acceptance is established: unconscionability. In LIC of India v. Consumer Education and Research Centre, (1995) 5 SCC 482, the Supreme Court held that a standard-form contract offered on a take-it-or-leave-it basis, where the parties lack equal bargaining power, must have its terms formulated reasonably, and a court can strike down a term that is unfair or unreasonable. Read it on Indian Kanoon. Terms of service are the textbook adhesion contract: nobody negotiates them clause by clause. A term buried deep, or wildly one-sided, an unlimited unilateral amendment right with no notice, say, is more exposed under this reasoning than a term that is plainly stated and reasonably scoped, even though both were "accepted" the same way.

IT Rules 2021: what your terms of service is legally required to contain

If you run a website or app that hosts user-generated content, comments, uploads, reviews, your terms of service is not just a contract, it is also a compliance document under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Rule 3(1)(a) requires you to:

"prominently publish on its website, mobile based application or both... the rules and regulations, privacy policy and user agreement... for access or usage of its computer resource by any person" Source: Rule 3, IT Rules 2021 (Indian Kanoon)

Rule 3(1)(b) then requires your terms to actually inform users that they must not host, display, upload, or share content across a specific list of categories, content belonging to another without a right to share it, content that is obscene, invasive of privacy, or promotes enmity between groups, content that infringes IP or violates any law in force, among others. A prohibited-use clause that just says "use the Service lawfully" does not satisfy this, though many templates still ship with exactly that.

Rule 3(2) requires a named Grievance Officer, published with contact details, who must acknowledge a complaint within 24 hours and resolve it within 15 days. If your terms of service does not name one, you are not compliant, independent of how good the rest of the document reads.

Why this matters beyond box-ticking: Section 79 of the IT Act gives intermediaries a safe harbour from liability for third-party content, but that protection is conditional on Section 79(2), which makes the exemption available only where the intermediary "observes due diligence while discharging his duties under this Act... and observes such other guidelines as the Central Government may prescribe," which is exactly what Rule 3 spells out. Source: Section 79, Information Technology Act, 2000 (Indian Kanoon). A terms page that skips Rule 3 is not just a weaker contract, it can put your safe harbour itself at risk in a dispute over user content.

Consumer Protection Act and DPDP: two more layers most templates miss

Where your users are consumers, the Consumer Protection Act, 2019 gives a second, independent line of attack on a one-sided clause. Section 2(46) defines an "unfair contract" as one that, between a consumer and a trader or service provider, causes significant change in the rights of the consumer, including terms that impose disproportionate penalties, deny the right to terminate, or permit unilateral change without valid reason. Source: Section 2, Consumer Protection Act, 2019 (Indian Kanoon). This sits alongside, not instead of, the older unconscionability route under Section 23 of the Indian Contract Act, so an unlimited, no-notice amendment clause, or a liability exclusion that tries to cover everything including gross negligence, has two separate grounds it can be challenged on.

Separately, a terms page and a privacy policy are not interchangeable, and Rule 3(1)(a) above requires both. Under the Digital Personal Data Protection Act, 2023, Section 5 requires that any request for consent be accompanied by a clear notice describing what data is collected, why, and how a user can exercise their rights or complain to the Data Protection Board. Source: Section 5, DPDP Act, 2023 (Indian Kanoon). "See our Privacy Policy" linking to a thin placeholder does not meet either requirement. See our companion guide, how to review a privacy policy under the DPDP Act.

Red flags

Normal	Red flag	Why it matters
Explicit "I Agree" click, tied to a timestamped, versioned copy of the terms	Terms only linked in a footer, no action required	Weaker evidence of assent under the Trimex reasoning
Prohibited-use list names specific categories	"Use the Service lawfully," nothing else	Does not meet Rule 3(1)(b); no real notice of what is banned
Named Grievance Officer with contact details and timelines	No grievance officer named anywhere	Non-compliant with Rule 3(2); weakens the Section 79 safe harbour
Amendment clause requires advance notice before changes take effect	"We may change these terms at any time, effective immediately"	Exposed under Section 2(46), Consumer Protection Act, and Section 23, Contract Act
User-content licence scoped to operating the service	"Perpetual, irrevocable, worldwide licence for any purpose"	Overreaches beyond what running the platform requires
Liability cap with specific carve-outs (fraud, IP infringement)	"We exclude all liability of any kind"	Blanket exclusions risk being struck as unconscionable
Privacy policy a real, separate document meeting Section 5, DPDP Act	"See our Privacy Policy" links to a placeholder	Fails the DPDP notice requirement regardless
Governing law and jurisdiction matched to where users actually are	Names a jurisdiction with no real connection	Courts can refuse to enforce it
Termination clause states what happens to data and paid access	Silent on termination consequences	This is the clause that gets tested when a dispute happens

Bad clause to better clause: the amendment clause

Bad: "The Company reserves the right to modify these Terms at any time, in its sole discretion, without prior notice. Continued use of the Service after any modification constitutes acceptance of the modified Terms."

What is wrong: no notice mechanism at all, and "continued use" as acceptance is a browsewrap-style construction, the weakest form of assent under the Section 10A and Trimex reasoning above. It is also a strong candidate for challenge as an unfair contract term under Section 2(46), since it permits unilateral change with no notice and no way to decline.

Better: "The Company may revise these Terms from time to time. Where a revision is material, the Company will provide at least 15 days' notice by email and by a prominent notice within the Service, before the revised Terms take effect, stating the effective date and a summary of the changes. Continued use after the effective date constitutes acceptance; a user who does not accept may terminate their account before that date without penalty, subject to Section [X] (Termination)."

What changed: a real notice period, a real channel, and an actual choice before the new terms bind the user, converting a one-sided browsewrap-style change into a fresh, demonstrable acceptance.

The review checklist

1. Clickwrap (affirmative "I Agree" tied to a version) or browsewrap (footer link, no action)?
2. Does prohibited-use name specific categories, not just "use lawfully"?
3. Is a Grievance Officer named, meeting the Rule 3(2) timelines?
4. Does the IP/user-content licence stay scoped to operating the service?
5. Does liability name specific carve-outs rather than excluding everything?
6. Does amendment require advance notice before it binds existing users?
7. Does termination state what happens to data and paid access?
8. Is there a real, DPDP Section 5-compliant privacy policy, not a placeholder?
9. Is governing law and jurisdiction genuinely connected to the business and users?
10. Would a reasonable user have had the chance to read this before "accepting" it?

US and global contrast

US courts have drawn the clickwrap/browsewrap line more sharply, over more litigation, than Indian courts have so far. In Specht v. Netscape Communications Corp. (2d Cir. 2002), a browsewrap clause was struck down because a user was never required to view it before downloading software. In Meyer v. Uber Technologies, Inc. (2d Cir. 2017), by contrast, a clickwrap-style flow, terms hyperlinked directly below a "Register" button, was upheld as reasonably conspicuous. India has no Supreme Court authority squarely on a consumer clickwrap dispute; Trimex and LIC of India are the closest available reasoning, applied by analogy rather than directly on point. That gap cuts both ways: less certainty for a platform on exactly how conspicuous a clickwrap flow needs to be, and a browsewrap clause a US court would strike down easily has not been tested as clearly here.

FAQ

Is clicking "I Agree" on a website's terms of service legally binding in India? Generally yes. Section 10A of the IT Act, 2000 removes the objection that an electronic acceptance is unenforceable simply because it was electronic. The strength still depends on whether the user had a genuine opportunity to see the terms first, which is why clickwrap is meaningfully stronger evidence than browsewrap.

Do I need a separate privacy policy if my terms already cover data use? Yes. Rule 3(1)(a) of the IT Rules, 2021 names "rules and regulations, privacy policy and user agreement" as separate documents an intermediary must publish, and Section 5 of the DPDP Act, 2023 requires consent-notice content a general terms clause usually does not provide.

Can a business change its terms of service whenever it wants? It can reserve the right to, but no notice and no way to decline is exposed on two fronts: as an unfair contract term under Section 2(46) of the Consumer Protection Act, 2019, and as a potentially unconscionable term under Section 23 of the Indian Contract Act, 1872.

What happens if a website has no named Grievance Officer? It falls short of Rule 3(2) of the IT Rules, 2021, and since Section 79 conditions the safe harbour on that due diligence, the absence can weigh against the platform if it is ever sued over user-generated content.

Is a limitation of liability clause in a terms of service always enforceable? Not automatically. It has to survive ordinary contract-law scrutiny (see our limitation of liability explainer) and, for a consumer, the unfair-contract-term test. A cap with genuine carve-outs holds up far better than a blanket "all liability" exclusion.

Do these rules apply to a small app with no in-house legal team? Yes. The IT Rules, 2021 apply to any intermediary regardless of size, though enforcement in practice tracks scale and risk. A short, accurate terms page beats a long template copied from a much larger platform.

This guide explains how a website or app's terms of service is typically structured and reviewed under Indian law, the acceptance mechanics that decide enforceability, and the IT Rules, Consumer Protection Act, and DPDP requirements most templates skip. It is not legal advice, and does not tell you whether your specific terms, acceptance flow, or grievance process would hold up in your actual dispute. For that, especially before launching a consumer-facing product, have a lawyer review the actual document.