Legal documents for a website or app: privacy policy, terms of use, accessibility statement and store terms

Internet Law · October 21, 2026

The short answer

A website or app addressed to the public in Israel is subject to four enactments, and each dictates a document of its own. The Protection of Privacy Law, 5741-1981, after Amendment 13 (in force since 14 August 2025), requires a five-item notice at every point where personal data is collected (section 11 of the Law); the Standard Contracts Law, 5743-1982, determines which terms of use are presumed unfair; the Consumer Protection Law, 5741-1981, dictates to anyone selling online the disclosures, the right of cancellation and the cancellation link on the home page (sections 14C, 14I and 17D of the Law); and regulation 35E of the Equal Rights for Persons with Disabilities Regulations (Service Accessibility Adjustments), 5773-2013, requires an accessibility statement in a prominent place. The firm drafts the four documents from knowledge of the specific product, and updates them when the law or the product changes.

1. What the service includes

Stage	What is done	Legal basis
1. Mapping	Which data is collected, for what purpose, who receives it, and whether special-sensitivity data is collected.	Section 3 of the Protection of Privacy Law (definitions of “personal data” and “special-sensitivity data”); regulation 2 of the Protection of Privacy Regulations (Data Security), 5777-2017
2. Privacy policy	The full policy and the short privacy notices at the collection points, including the cookie chapter and the rights of access and correction.	Sections 11, 13 and 14 of the Protection of Privacy Law; the Privacy Protection Authority’s opinion on consent (25 February 2026)
3. Terms of use	Website terms or an app licence agreement, accepted by an affirmative act, without terms presumed unfair.	Sections 3–5 of the Standard Contracts Law; LCA 6992/22 Agoda v. Tzvia (27 May 2024)
4. Store terms	The disclosures, the 14-day right of cancellation and the cancellation fee, the cancellation link on the home page, and the total price in shekels.	Sections 14C, 14E, 14I and 17D of the Consumer Protection Law
5. Accessibility statement	A statement following the guidance of Israeli Standard 5568 part 1 (2023): the adjustments made, the accessibility coordinator’s details where one must be appointed, and contact channels for reporting a defect.	Regulation 35E of the Service Accessibility Regulations; section 19MB of the Equal Rights for Persons with Disabilities Law, 5758-1998
6. Mailing and marketing	The consent wording for the mailing list, the unsubscribe mechanism and the “advertisement” label; an assessment of whether the mailing is “direct mailing” within the meaning of the Law.	Section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982; sections 3 and 17F of the Protection of Privacy Law
7. Officer and vendors	Assessment of the duty to appoint an officer; data-processing agreements with external vendors.	Sections 17B1–17B3 of the Protection of Privacy Law; regulation 15 of the Protection of Privacy Regulations (Data Security)

2. Why a template from the internet is not enough

Section 11 of the Protection of Privacy Law provides that a request to a person for personal data “shall be accompanied by a notice” stating five items: legal duty or free will “and what the consequence of refusal is”; the purpose; the name of the controller of the database and how to contact it; to whom the data will be transferred and for what purpose; and the existence of the right of access under section 13 of the Law and the right of correction under section 14 of the Law. Two items – paragraphs (2A) and (4) – were added by Amendment 13 and a third was expanded by the words “and what the consequence of refusal is”, so a template written before August 2025 almost inevitably lacks them; the Authority’s opinion on consent adds that compliance with section 11 is a minimum only. What a privacy policy must contain, and what the Authority says about cookies.

On the consumer side, whoever sells online must disclose before the transaction the items listed in section 14C(a) of the Consumer Protection Law; section 14I(b) of the Law requires a dedicated cancellation link on the home page, and section 17D of the Law prohibits quoting any price other than the total price, in Israeli currency. A template written for another store does not know which of the exceptions to the right of cancellation in section 14C(d) of the Law apply to you. On online sales, cancellation and the anti-spam law. Terms of use are a “standard contract” as defined in section 2 of the Standard Contracts Law, and section 4 of the Law lists terms presumed to be unfair – among them a blanket exclusion of liability, an exclusive forum clause and an “I have read and agree” declaration – of which many templates are built. What binds the user, and what a court will strike out. And on accessibility, regulation 35E of the Service Accessibility Regulations requires a statement describing the adjustments actually made on this site, not a generic text. On website and app accessibility under regulation 35.

3. What changed in 2025–2026

• Amendment 13 to the Protection of Privacy Law – in force since 14 August 2025. “Personal data” (section 3 of the Law) now expressly includes an “online identifier” and “location data”; the registration duty was narrowed (section 8A of the Law); a duty to appoint a privacy protection officer was added (section 17B1 of the Law); and the Authority was empowered to impose financial sanctions (Chapter D3 of the Law).
• Opinion on consent (25 February 2026) – implied consent through browsing; separate active consent for profiling and direct-mailing services.
• Opinion on appointing a privacy protection officer (14 July 2026) – the interpretation of section 17B1(a)(3) of the Law, set out below.
• Financial sanctions – failing to give the section 11 notice through a website costs ILS 2 per person whose data is in the database (ILS 4 for special-sensitivity data), and no less than ILS 20,000 (section 23כו of the Law); in the example in the Authority’s guide – 500,000 persons and sensitive data – the sanction reaches ILS 2,000,000.

4. Who must appoint a privacy protection officer

Of the four groups in section 17B1(a) of the Protection of Privacy Law, the one relevant to websites and apps is paragraph (3): those whose principal activities require “regular and systematic monitoring of persons … on a significant scale”; health and finance apps may also fall under paragraph (4) – processing special-sensitivity data on a significant scale. The Authority’s opinion of 14 July 2026 holds that paragraph (3) expressly includes websites and apps that track user activity to build profiles (paragraphs 9.4–9.6); “significant scale” is assessed on the criteria in section 17B1(b) of the Law, with no numeric threshold, and any one of them may suffice (paragraph 9.10); and appointing an officer in a body that is obliged to do so may earn it a 10 per cent reduction of a financial sanction imposed for other breaches, under item 2(4) of the Fifth Schedule to the Law (paragraph 9.14). The officer may be external (section 17B3(b) of the Law).

5. Elements of the site that the law regulates directly

Beyond the documents, the law dictates elements in the interface itself:

• A dedicated cancellation link on the home page, “prominently and clearly” (section 14I(b) of the Consumer Protection Law).
• The total price only, in Israeli currency only (section 17D of the Consumer Protection Law).
• The word “advertisement” at the start of every marketing message or in the e-mail subject line, the advertiser’s details, and a simple way to refuse (section 30A(e) of the Communications Law).
• An accessibility statement in a prominent place on the site and in the app (regulation 35E of the Service Accessibility Regulations).
• A short privacy notice at every collection point, not only a link in the footer (section 11 of the Protection of Privacy Law).

6. After the documents: keeping them current

Regulation 2(b) of the Protection of Privacy Regulations (Data Security) requires an annual review of the database-definitions document, and the opinion on consent holds that a material change in the terms requires renewed consent. The firm keeps versions of every document and updates it when a new use of data is added, when a vendor changes, or when the Authority publishes a new position. The firm’s own privacy policy and accessibility statement are built on the same principles and serve as live examples. For a new company – company formation at the firm; for a site that also serves users in Europe – an Israeli company and the GDPR. The fee is given in a written proposal after the introductory conversation.

Frequently asked questions

Does the law require a cookie banner?

Israeli law contains no provision requiring a cookie banner as such. Section 11 of the Protection of Privacy Law requires a notice when personal data is collected, and under the Privacy Protection Authority’s opinion on consent (25 February 2026) continued browsing after an adequate notice will usually count as implied consent, where there is a reasonable link between the collection and the service. Profiling unrelated to the service and direct-mailing services require a separate active opt-in. Many businesses choose, as a conservative position, active consent for both kinds.

Do I need to register the website’s database?

In most cases, no. Since 14 August 2025 a database must be registered under section 8A of the Protection of Privacy Law only if its main purpose is transferring data to others and it holds data on more than 10,000 persons, or if its controller is a public body. A database holding special-sensitivity data on more than 100,000 persons requires a notification to the Authority, not registration.

Must a small business’s app appoint a privacy protection officer?

The duty depends on the activity, not on the size of the business. Section 17B1(a)(3) of the Protection of Privacy Law requires an appointment where the activities require “regular and systematic monitoring of persons … on a significant scale”, and under the Authority’s opinion of 14 July 2026 this includes apps that track user activity to build profiles, with no numeric threshold.

Is a website legally required to have terms of use?

No statute requires a document called “terms”. Whoever sells to consumers online must provide certain content: the disclosures under section 14C(a) of the Consumer Protection Law, disclosure of the cancellation channels under section 14I(d) of the Law, and the privacy notice under section 11 of the Protection of Privacy Law.

Our site also serves users in Europe. Are documents under Israeli law enough?

No. Users in the European Union bring the GDPR with them. The firm prepares one policy drafted for both regimes, or two versions. On an Israeli company and the GDPR.

How long does it take, and what does it cost?

The work begins with an introductory conversation and a mapping of the data flow. The time depends on the number of documents and the complexity of the product. The firm’s fee is not fixed by law and is given in a written proposal after the introductory conversation, before work begins.

The above is general information on Israeli law only, current as of the date of publication, and does not constitute legal advice or a substitute for advice on your specific circumstances. Sanction and damages figures are those set in the legislation and in the authorities’ publications at the date of publication and are updated from time to time. Consult a lawyer before acting.

← All internet-law articles