Recent policy changes

Why it matters: The fund-hold provision materially alters the finality and timing of seller payouts. Previously, the agreement specified conditions under which accounts could be suspended (25% refund rate) but did not explicitly authorize holds on earned funds pending settlement. The new language establishes broad discretion to withhold payouts indefinitely based on subjective factors (suspected violations, chargeback risk, misleading marketing, incomplete verification), creating potential cash-flow disruption for suppliers and impacting the operational reliability of Gumroad as a payment partner.

Why it matters: The updated terms establish automatic renewal as the default state for paid plans, meaning users must take affirmative action to prevent recurring charges. This shifts the burden from Ford to affirmatively charge to the user to affirmatively cancel, which is material to how subscribers manage their accounts and budgets. The explicit pricing variability clause also signals that subscription fees are not guaranteed to remain static, which may affect long-term cost planning for subscribers.

Why it matters: The revised language introduces an explicit contingency on Shein's return offer: returns are now 'subject to our Fair Use Policy,' which is referenced but not detailed in the policy text. This means return eligibility may depend on criteria defined outside the visible return policy, which could affect customer expectations if returns are denied based on Fair Use grounds not previously disclosed.

Why it matters: This change clarifies which legal entity merchants contract with and which courts have exclusive jurisdiction to resolve disputes, based on the store's billing region. The reorganized format makes the regional assignments more transparent and reduces ambiguity about the correct contracting party and dispute forum for each geographic market. For merchants involved in disputes or those managing contracts referencing Shopify as a counterparty, confirming the correct entity and jurisdiction under the updated table is operationally important.

Why it matters: The compressed referral timeline reduces the effective promotion window by over five months, materially narrowing the window for both referrers and referees to complete the required activities and earn bonuses. The automatic Overdraft Protection enrollment at SoFi Plus subscription represents a material shift in default account behavior: instead of opting into overdraft coverage, SoFi Plus members now have it enabled automatically at subscription, which affects how overdraft fees and account linking operate unless the user takes action to disable it.

Why it matters: The updated terms impose a hard deadline of August 4, 2026, for referral program participation and new account opening, and require deposits to settle within 21 days of both account opening and user registration, creating a tighter compliance window than previously stated. For SoFi Plus members, automatic Overdraft Protection enrollment represents a material change to default account behavior; while fee-free and disableable, it affects how checking accounts interact with savings without explicit per-transaction consent.

Why it matters: The updated terms materially increase financial obligations and reduce advance notice for subscription users. The 48-hour pre-charge window and explicit liability for failed-payment retry attempts mean users have less time to manage their payment methods before charges occur. The new explicit liability for background data fees from system services significantly expands what users may owe if their devices are actively updating or communicating without active user interaction, a cost that may be substantial in regions with expensive mobile data. The backup payment method authorization without explicit prior consent may violate consumer protection standards in several jurisdictions, increasing risk of chargebacks and regulatory scrutiny.

Why it matters: The updated terms establish explicit use-case boundaries for AWS IoT SiteWise Scenario Discovery in safety-critical contexts, particularly vehicle systems, and clarify that AWS assumes no liability for uses that violate these boundaries. This change directly affects organizations developing vehicle systems, autonomous features, or regulatory-compliance tools that rely on AWS IoT services; they must now confirm that their architecture includes independent human review and does not treat AWS outputs as autonomous safety validators.

Why it matters: The updated terms materially alter dispute resolution for consumers by replacing universal California jurisdiction with a consumer-favorable approach where consumers can use their home country's courts and laws. This change affects how complaints are filed and resolved. Additionally, the introduction of separate Automated Data Collection Terms with revocable permission creates new compliance obligations for users employing bots or crawlers, and the 30-day advance notice requirement provides greater transparency into future Terms modifications.

Why it matters: The removal of explicit training exclusions for paid services may affect vendor contracts and Data Processing Addenda that organizations relied on to satisfy their own privacy commitments. The expanded definition of Input data to include third-party integration data means Mistral now processes a broader scope of user information for its stated business purposes. Together, these changes may require organizations to renegotiate vendor agreements and revise customer-facing privacy disclosures to reflect the updated scope of data collection and processing.

Why it matters: The extended 120-day error-reporting window gives account holders significantly more time to identify transaction discrepancies before the dispute window closes. Under Wise's prior terms, an error discovered after 60 days would be outside the reporting period; under the revised terms, the same error reported within 120 days can be escalated to Wise Support.

Why it matters: The updated terms now authorize the sale or commercial sharing of data collected through cookies from major ad platforms (Facebook, Bing, Google, Braze, LinkedIn). This expands how Mercury may use or share user data beyond advertising and analytics functions. Organizations relying on Mercury should update their own privacy disclosures to reflect this expanded data-sharing purpose.

Why it matters: The expanded Seller Policy explicitly codifies seller obligations that were previously implicit or scattered across multiple documents. By centralizing these requirements, Poshmark establishes clear expectations for product accuracy, fulfillment conduct, and pricing practices, while reserving the right to enforce compliance through account suspension or termination at its sole discretion. Sellers who fail to comply with these requirements may face account restrictions or permanent removal from the platform.

Why it matters: The removal of explicit consent and opt-out language from the user-facing registration interface affects how transparently Shein communicates privacy rights and marketing opt-out mechanisms to users. Under GDPR and UK GDPR, organizations are required to obtain affirmative, informed consent and to provide clear information about how users can withdraw consent or opt out of marketing. If these disclosures have been removed from the registration flow without being relocated elsewhere, users may not receive adequate notice of their rights, and Shein may face compliance challenges. The change is operationally significant because it alters the user's experience of privacy consent and opt-out communication at a critical point in the registration process.

Why it matters: The updated Privacy Notice now explicitly states that Perplexity does not sell personal data or share conversation content with advertisers, directly addressing a core privacy concern for users of AI services. This formalized disclosure provides clearer transparency about how user data is handled in relation to advertising, which is operationally significant given the prevalence of advertiser data practices in technology services.

Why it matters: The updated terms establish explicit authority to collect detailed Web3 wallet information and share pseudonymous wallet data with third parties. The removal of US-only data storage requirements affects how customer data may be processed and where it may be retained, which is operationally significant for organizations subject to international data protection frameworks.

Why it matters: The updated terms grant Coinbase explicit unilateral authority to conduct protocol upgrade migrations on customer assets without per-migration consent, while disclaiming liability for losses during these transfers. This expands Coinbase's operational control over customer assets and eliminates a potential avenue for customer recourse if migrations result in losses, making the terms of asset custody and migration procedures materially more favorable to Coinbase.

Why it matters: The removal of Samsung's prior commitment to delete personal information from defective devices before analysis represents a material shift in data handling for warranty service; the policy now permits analysis of returned devices without the pre-deletion protection customers may have expected. The expansion of repair-related data collection and the addition of state privacy rights disclosures clarifies Samsung's data practices and consumer opt-out rights, but the loss of the data-wiping guarantee may affect consumer confidence in repair processes.

Why it matters: The updated terms establish distinct contractual frameworks for different geographic regions, moving from a single global agreement to region-specific terms. This affects how disputes are resolved (mandatory arbitration rather than litigation), what legal responsibility users bear (new indemnification obligations), and what privacy rights apply (new Job Applicant Privacy Notice). The separation of terms by geography creates the operational need for users and recruiters to understand which version applies to them and what their specific rights and obligations are under that regional version.

Why it matters: The updated terms expand the categories of device information Indeed collects by explicitly including phone numbers, and broaden the stated justification for data processing to encompass service improvement. Organizations relying on Indeed must ensure their own privacy documentation accurately reflects these expanded data collection practices and processing purposes, particularly under GDPR and similar frameworks that require clear statement of lawful basis and processing scope.

Why it matters: The updated terms now explicitly authorize collection of phone numbers as part of device data and broaden the stated legitimate basis for processing to include service improvement. This expansion increases the scope of personal information Indeed may collect and the purposes for which it may be used under its privacy framework.

Why it matters: The corporate entity change from Glassdoor LLC to Indeed, Inc. affects where legal claims must be directed and who holds contractual liability. The expanded DMCA procedures create a clear, statutory dispute mechanism for copyright claims, reducing ambiguity but also increasing procedural burden on claimants. The clarified arbitration opt-out process removes discretion about whether a waiver is valid, but the removal of login deadline language shifts enforcement timing from scheduled to discretionary, expanding Glassdoor's operational flexibility without user-facing transparency about when legacy authentication will end.

Why it matters: The updated terms establish explicit legal authority for AWS to police and enforce against resale of On-Demand Capacity Reservations, creating operational risk for organizations that may have treated reservations as tradeable assets. Additionally, the differentiated Capacity Block termination window (60 minutes for UltraServer versus 30 minutes for standard instances) affects workload scheduling and orchestration practices for ML customers, requiring updated runbook documentation and automation logic.

Why it matters: The introduction of UK and EU regional schedules creates a jurisdiction-dependent compliance framework that significantly affects how businesses in those regions operate under the agreement. The expansion of sanctions screening to four regimes instead of one materially increases transaction screening complexity and risk exposure for international payment operations. The removal of default monthly billing terms shifts the onus to customers to affirmatively select renewal periods, which may affect contract management and customer retention mechanics.

Why it matters: This change introduces a new compliance pathway for self-employed individuals accepting business payments, but activates automatic tax reporting, backup withholding, and account transition rights that materially affect how income is processed and taxed. The terms establish mandatory Social Security Number collection, penalty provisions for payment misdesignation, and cash flow impacts (24% withholding) tied to tax reporting thresholds, making this operationally significant for users who qualify and enroll.

Why it matters: The updated terms introduce conditional language around a stated commitment regarding workspace admin authority over data retention. This shift from direct control to optional control may affect how enterprise customers rely on admin-driven retention settings to fulfill their own data governance obligations. Organizations with data processing agreements or compliance requirements tied to specific retention controls should verify whether this change affects their operational capability.

Why it matters: The addition of mandatory binding arbitration with elimination of court access and class action rights represents a material change to dispute resolution procedures affecting all Eufy users. The updated terms also establish affirmative acceptance of privacy and cookie policies as a mandatory condition of service use, tightening consent requirements and potentially limiting user recourse in privacy disputes. Enforceability of the arbitration clause may be subject to challenge under state consumer protection laws, particularly in California, making this a significant compliance and litigation exposure item.

Why it matters: The updated policy establishes new procedural protections and operational requirements for international personal data transfers under the Data Privacy Frameworks. For EU, UK, and Swiss users, the change creates formal complaint and dispute resolution mechanisms, including TRUSTe referral and binding arbitration options. For all users, the updated terms introduce a new requirement that Mailchimp must offer opt-out or obtain opt-in consent before using personal data for materially new purposes or sharing with external parties outside its normal processor relationships.

Why it matters: The updated terms establish a new geographic participation restriction that prevents Alberta residents from registering or using FanDuel Fantasy services. This change directly affects the platform's Canadian service footprint and may reflect regulatory changes in Alberta's gaming framework.

Why it matters: The revised privacy policy expands disclosure of data collection practices, particularly AI interactions and clipboard content, and explicitly addresses state-level health privacy frameworks. For users, this means clearer disclosure of what data is collected when using AI features and sharing content. For organizations integrating TikTok into their vendor or partner ecosystem, the entity change to TikTok USDS Joint Venture LLC and expanded regulatory references may require verification of existing data processing agreements and privacy certifications.