Almost every business website has a link to “Terms and Conditions” in the footer. Many of those documents were copied from a template, written for another country, or last updated years ago. They often promise protections that South African law will not give, and leave out information the law says must be there.
Your website terms are a contract with every visitor and customer. If they are clear and lawful, they help manage risk, reduce disputes and build trust. If they are not, they may be unenforceable when you need them most, and could expose your business to complaints to the National Consumer Commission or the Information Regulator.
This article sets out the main laws that apply, what your terms should say, and the clauses that commonly cause trouble.
The laws that shape your website terms
Three statutes do most of the work:
- The Electronic Communications and Transactions Act 25 of 2002 (ECTA) sets out information that suppliers selling online to consumers must make available, and gives consumers a cooling-off right for many online purchases.
- The Consumer Protection Act 68 of 2008 (CPA) controls unfair, unreasonable or unjust contract terms, requires plain language, and provides warranties and rights that cannot be contracted out of. It protects individuals and smaller juristic persons below the threshold set by the Minister.
- The Protection of Personal Information Act 4 of 2013 (POPIA) governs how you collect and use visitors’ personal information, including through forms, cookies and marketing lists.
Information ECTA requires
Section 43 of ECTA lists information a supplier selling goods or services online to consumers must provide on its website. In summary, this includes:
- your full name and legal status, registration number, physical address, telephone number, website and email address;
- an address where you will accept service of legal documents;
- membership of any self-regulatory or accreditation body, and any code of conduct you subscribe to;
- a description of the main characteristics of the goods or services, and the full price, including transport costs, taxes and other fees;
- the payment methods, the terms of the agreement (including guarantees), and the time within which goods will be dispatched or services provided;
- your return, exchange and refund policy;
- any alternative dispute resolution code you subscribe to;
- your security procedures and privacy policy for payment and personal information; and
- where relevant, the minimum duration of the agreement and the consumer’s cooling-off rights.
The consumer must also be given an opportunity to review the whole transaction, correct mistakes and withdraw before placing the order. If you do not comply, a consumer may cancel the transaction within 14 days of receiving the goods or services. Section 44 separately allows consumers to cancel many online purchases within seven days without reason, subject to listed exceptions. These consumer protections cannot be excluded by contract.
What the CPA does to your terms
The CPA has a direct effect on how your terms are written and what they may say.
Plain language. Section 22 requires consumer contracts to be in plain language, which means an ordinary consumer with average literacy skills and minimal experience should be able to understand them. Dense legal jargon is a compliance risk, not a safeguard.
Unfair terms. Section 48 prohibits terms that are unfair, unreasonable or unjust, and section 51 lists terms that are prohibited outright, such as terms that waive a consumer’s rights under the CPA. A clause that breaches these sections can be struck out or declared void.
Notice of risky terms. Under section 49, a term that limits your liability, makes the consumer assume risk, requires the consumer to indemnify you, or has the consumer acknowledge a fact, must be drawn to the consumer’s attention in a conspicuous way, and the consumer must have an adequate opportunity to understand it before agreeing. Burying a liability exclusion in clause 27 of a document nobody opens is unlikely to meet this standard.
Warranties and returns. The CPA gives consumers rights to safe, good-quality goods, including a six-month implied warranty on goods. Your terms can explain how returns work, but cannot take these rights away.
Getting customers to agree
A contract only binds a customer who has agreed to it. Terms that sit behind a footer link, which the visitor is never asked to accept, are much harder to enforce than terms the customer must actively accept, for example by ticking a box before checking out or creating an account. Keep a record of which version of the terms each customer accepted and when.
Privacy, cookies and marketing
Your privacy policy should be a separate, accessible document explaining what information you collect, why, who you share it with (including service providers abroad), how long you keep it, and how visitors can exercise their POPIA rights. Your terms should link to it.
Marketing is an area to review now. The CPA Amendment Regulations published on 15 April 2026 introduced a compulsory national opt-out registry administered by the National Consumer Commission. Direct marketers must register, renew annually and cleanse their databases against the registry every month. If your website collects details for marketing, your terms, privacy policy and processes should reflect both POPIA consent rules and these new requirements.
Clauses that often cause problems
- Foreign law and courts: clauses choosing foreign law do not remove the protection South African consumers have under ECTA and the CPA.
- Blanket liability exclusions: broad exclusions of all liability, including for gross negligence, are unlikely to survive against consumers.
- “No refunds” policies: these conflict with statutory return and cooling-off rights.
- Unilateral changes: a right to change terms at any time without notice may be unfair. Give notice of material changes, and apply them going forward.
- Copied templates: foreign templates often refer to laws that do not apply here and omit what South African law requires.
A checklist for your website terms
- Check that all ECTA section 43 information is easy to find on your site.
- Rewrite the terms in plain language, using short sentences and headings.
- Highlight liability limits, indemnities and risk assumptions in bold or a separate box, and ask customers to confirm them.
- Align your returns, refunds and cancellation terms with the CPA and ECTA.
- Use click-to-accept for purchases and account creation, and keep version records.
- Update your privacy and cookie notices, and review your marketing consent and opt-out processes.
- Review the terms at least once a year, and whenever you add new products, payment methods or features.
How O’Reilly Law can help
We draft and review website terms and conditions, privacy policies, cookie notices and online sales terms for South African businesses, from new online stores to established platforms. We check your terms against ECTA, the CPA and POPIA, and tailor them to how your business actually operates.
Contact us to have your website terms reviewed.
Related reading: Selling online: the legal requirements for South African online stores · Limitation of liability and indemnity clauses: what do they really protect?
This article is general information and not legal advice. Correct as at November 2026.