Terms of Service (Hong Kong)

A Terms of Service in Hong Kong fixes the respective duties and entitlements of the parties to the arrangement.

Hong Kong common law governs the formation and enforceability of a ToS under the same principles of offer, acceptance, and consideration that apply throughout common law jurisdictions. For a ToS to bind a user, the user must have had reasonable notice of the terms before agreeing — a standard analysed by Hong Kong courts by reference to English cases such as Thornton v Shoe Lane Parking [1971] and the Electronic Transactions Ordinance (Cap. 553), which gives legal recognition to electronic signatures and electronic contracts under ss. 6 and 17. A clickwrap mechanism — requiring the user to tick a checkbox or click "I Agree" — provides the strongest evidence of assent. A browsewrap mechanism — where a hyperlink to the ToS appears on the page without requiring active acknowledgment — is less certain, and Hong Kong courts may find it insufficient if the link was not prominently displayed.

The Control of Exemption Clauses Ordinance (Cap. 71, CECO) is the primary statute regulating exclusion and limitation of liability clauses in Hong Kong ToS agreements. Under s. 7 of the CECO, a business cannot exclude or restrict liability for death or personal injury caused by negligence. For other types of loss — financial loss, data loss, business interruption — an exclusion or limitation clause is enforceable only if it satisfies the reasonableness test under s. 3(1) and Schedule 2, which directs the court to consider the relative bargaining power of the parties, whether the customer knew of the term, and whether it was fair and reasonable to include it in all the circumstances. Businesses drafting Hong Kong ToS agreements should cap liability at the amounts actually paid by the user rather than excluding it entirely.

The Personal Data (Privacy) Ordinance (Cap. 486, PDPO), administered by the Office of the Privacy Commissioner for Personal Data (PCPD), imposes obligations on any data user — including online platforms — that collect, hold, process, or use personal data of Hong Kong residents. The six Data Protection Principles (DPPs) in Schedule 1 to the PDPO require: collection for a lawful purpose directly related to the data user's function (DPP 1); adequacy and non-excessiveness of data collected (DPP 2); use only for the specified purpose (DPP 3); security against unauthorised access (DPP 4); openness about the data user's policies (DPP 5); and access and correction rights for data subjects (DPP 6). The 2021 amendments to the PDPO introduced criminal liability for doxxing — disclosing personal data of another person with intent to cause harm — punishable by up to 5 years' imprisonment under s. 64(3A). A Hong Kong ToS must reference a compliant Privacy Policy and confirm PDPO obligations.

Intellectual property protection in the ToS is grounded in the Copyright Ordinance (Cap. 528), the Trade Marks Ordinance (Cap. 559), and the Patents Ordinance (Cap. 514). The Intellectual Property Department of Hong Kong administers trade mark and patent registrations. A ToS for a Hong Kong platform should assert ownership of all platform content under Cap. 528, prohibit unauthorised reproduction, and include a user content licence grant for platforms that host user-generated material. The Contracts (Rights of Third Parties) Ordinance (Cap. 623) — Hong Kong's codification of the Contracts (Rights of Third Parties) Act 1999 — allows third parties to enforce contractual terms if the contract expressly confers a benefit on them; ToS agreements typically include a provision disapplying Cap. 623 to prevent unintended third-party claims.

A Hong Kong Terms of Service agreement under the Electronic Transactions Ordinance (Cap. 553) and governed by Hong Kong common law is needed whenever a business provides digital services, an online platform, software as a service (SaaS), mobile applications, e-commerce, or any internet-based offering to users located in or accessing services from Hong Kong.

When a Hong Kong company incorporated under the Companies Ordinance (Cap. 622) and registered with the Companies Registry launches a consumer-facing website or mobile application, a ToS is required to establish the binding relationship with users, define permitted uses, allocate risk through liability caps compliant with the Control of Exemption Clauses Ordinance (Cap. 71), and comply with the Personal Data (Privacy) Ordinance (Cap. 486) data collection obligations before any user data is processed.

When a fintech business operating under a Money Service Operator licence issued by the Customs and Excise Department, or an entity regulated by the Hong Kong Monetary Authority (HKMA) under the Banking Ordinance (Cap. 155), provides digital payment or financial services, the ToS must address the regulatory terms of service imposed by the HKMA, the Securities and Futures Commission (SFC) under the Securities and Futures Ordinance (Cap. 571) for investment-related platforms, and the Mandatory Provident Fund Schemes Authority (MPFA) for employee benefits platforms — each regulator prescribes mandatory disclosures that must appear in or be referenced by the ToS.

When an e-commerce platform supports sales of goods to Hong Kong consumers, the ToS must address the Supply of Services (Implied Terms) Ordinance (Cap. 457) implied terms that services will be provided with reasonable care and skill, and the Sale of Goods Ordinance (Cap. 26) implied terms about quality and fitness for purpose for goods sold — terms that cannot be excluded for consumer transactions under the Control of Exemption Clauses Ordinance (Cap. 71) s. 7.

When a platform collects personal data from users — including names, email addresses, HKID numbers, or financial information — the ToS must work in conjunction with a Privacy Policy compliant with the PDPO Data Protection Principles and must specify the retention period for personal data under DPP 2, the data security measures under DPP 4, and the user's right to access and correct data under DPP 6. Following the 2021 PDPO amendments, platforms with user-generated content must implement procedures for removing doxxing content that discloses personal data with intent to cause harm.

When a mainland China or international company establishes a Hong Kong entity to access Asian markets, the ToS governs the relationship with Hong Kong-based users under Hong Kong law — confirming that the company's contractual protections are governed by the well-established Hong Kong common law framework, enforceable in the Court of First Instance and Court of Appeal of the High Court of Hong Kong, rather than by the laws of jurisdictions with less developed online platform regulation.

A Hong Kong Terms of Service agreement compliant with the Electronic Transactions Ordinance (Cap. 553), the Control of Exemption Clauses Ordinance (Cap. 71), and the Personal Data (Privacy) Ordinance (Cap. 486) must include the following components to be enforceable in Hong Kong courts and compliant with PCPD requirements.

Service provider identification must state the full registered name of the Hong Kong company (as registered with the Companies Registry under the Companies Ordinance Cap. 622), the Hong Kong Business Registration number issued by the Inland Revenue Department under the Business Registration Ordinance (Cap. 310), and the registered address. For regulated entities — SFC licensees under Cap. 571, HKMA-regulated institutions under Cap. 155, or Mandatory Provident Fund intermediaries licensed by the MPFA — the regulatory licence number and the name of the relevant regulator must be disclosed.

Acceptance mechanism must specify whether the ToS is accepted through clickwrap (active user action), browsewrap (use of the service constituting acceptance), or a combination. Hong Kong courts following English common law precedent require that unusual or onerous terms be specifically drawn to the user's attention — the ToS should highlight liability limitation clauses, arbitration clauses, and data processing consents in a manner that satisfies Cap. 71's reasonableness test under Schedule 2.

Permitted use and prohibited conduct must define the scope of the licence granted to users for access to the platform, and must expressly prohibit: violations of the Copyright Ordinance (Cap. 528) through unauthorised copying or distribution of platform content; violations of the Trade Marks Ordinance (Cap. 559) through misuse of the platform's registered marks; doxxing conduct that violates the PDPO s. 64(3A); and any activity that contravenes the Crimes Ordinance (Cap. 200) provisions on criminal damage to computer systems.

Intellectual property ownership must assert the platform operator's rights in all original content under the Copyright Ordinance (Cap. 528), where copyright subsists automatically in original works without registration. For user-generated content, a broad licence grant from the user to the platform operator — covering reproduction, distribution, adaptation, and communication to the public in the platform's territory — is required to avoid copyright infringement claims when the platform displays, shares, or indexes user content.

Liability limitation must comply with the Control of Exemption Clauses Ordinance (Cap. 71). Liability for death or personal injury caused by negligence cannot be excluded (Cap. 71 s. 7). For other losses, the limitation clause must be reasonable under Schedule 2 — courts look at factors including the platform's relative bargaining power, the user's sophistication, and industry standard practices for similar Hong Kong platforms. A cap on aggregate liability equal to the fees paid by the user in the preceding 12 months is generally considered reasonable for B2B platforms.

Data protection and privacy must confirm compliance with the PDPO Data Protection Principles 1–6, name the platform operator as the data user responsible for data held on the platform, specify the retention period under DPP 2(2), disclose the classes of persons to whom personal data may be transferred (including whether transfer to mainland China or overseas recipients occurs), and confirm the user's DPP 6 right to access and correct their data by contacting the Privacy Compliance Officer.

Governing law and dispute resolution must specify Hong Kong law as the governing law, the non-exclusive jurisdiction of the Hong Kong courts, and any arbitration clause referring disputes to the Hong Kong International Arbitration Centre (HKIAC) under the HKIAC Administered Arbitration Rules or the Hong Kong Arbitration Ordinance (Cap. 609). The Contracts (Rights of Third Parties) Ordinance (Cap. 623) should be expressly disapplied.

The forms-legal.com Hong Kong Terms of Service template incorporates Cap. 71-compliant liability limitation language, PDPO Data Protection Principles 1–6 disclosure clauses, Cap. 528 copyright assertion and user content licence, Cap. 553 electronic acceptance confirmation, and HKIAC arbitration clause for business-to-business dispute resolution.