This is what I use to develop my privacy policies:
http://www.oecd.org/document/39/0,33..._1_1_1,00.html
Check out
http://www.w3c.org for info on P3P implementation
For TOS, contact Greg Piccionelli – he has some great takes on the subject that provide for remedies under the federal anti-hacking laws
