# Terms of Service and Privacy Policy pages exist and are linked from the footer
- **Pattern:** `ab-002621` (`project-snapshot.legal.terms-and-privacy-linked-from-footer`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-23
- **Canonical URL:** https://auditbuffet.com/patterns/ab-002621
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-002621)
## Why it matters
For an online Terms of Service to be enforceable against a user, US courts require that the link to the terms be reasonably conspicuous at the point of assent — Nguyen v Barnes & Noble, Inc. (9th Cir. 2014) threw out arbitration because a footer-only "Terms of Use" link with no direct prompt was held insufficient, and Meyer v Uber (2d Cir. 2017) spelled out the visibility and placement requirements that have been applied ever since. A missing Terms link means your liability caps, arbitration clause, and choice-of-law provisions are likely unenforceable in a dispute. Apple App Store, Google Play Store, Stripe activation, Google OAuth verification, and Meta login all additionally require a public-facing Privacy Policy URL — apps without one get rejected, de-listed, or blocked from going live. AI coding tools reliably scaffold `app/page.tsx` and a CTA button, then skip `app/terms/page.tsx` and `app/privacy/page.tsx` entirely, or leave the routes as 404 stubs that never got written.
## Severity rationale
Medium because the missing pages and links block real downstream gates (Stripe activation, store review, OAuth verification, clickwrap enforceability) but remediation is mechanical — two template pages plus two footer links.
## Remediation
Create both pages and link them from the footer. Templates live at `termly.io`, `gdpr.eu`, and GitHub's `docs/terms` repos.
```tsx
// components/Footer.tsx
```
Files: `app/privacy/page.tsx` and `app/terms/page.tsx` (or `pages/privacy.tsx` / `pages/terms.tsx` for pages router). Deeper coverage of policy-content completeness, version-change notification, and jurisdiction-specific clauses lives in the `legal-pages-compliance` Pro audit.
## Detection
- **ID:** `terms-and-privacy-linked-from-footer`
- **Severity:** `medium`
- **What to look for:** Two independent artifacts. (a) **File existence**: Privacy Policy at `app/privacy/page.tsx`, `app/privacy-policy/page.tsx`, `app/(marketing)/privacy/page.tsx`, `app/legal/privacy/page.tsx`, `pages/privacy.tsx`, `public/privacy.html` — or equivalent. Terms of Service at `app/terms/page.tsx`, `app/terms-of-service/page.tsx`, `app/tos/page.tsx`, `pages/terms.tsx`, `pages/tos.tsx`, `public/terms.html`. (b) **Footer linking**: inspect `app/layout.tsx`, `components/Footer.tsx`, `components/site-footer.tsx`, any component matching `/footer/i`. Look for `` / `` (and `/terms`). Link text can be "Privacy Policy", "Terms", "Legal" — the `href` must point at the actual route.
- **Pass criteria:** Both page files exist AND the footer links to both routes.
- **Fail criteria:** One or both files missing, OR both exist but one/both not linked from the footer. Stub body (`