Square updated its Privacy Notice on May 30, 2026, substantially expanding the document with 217 new sentences and modifying 2 existing sentences. The updated notice now includes effective dates (Last Updated: March 16, 2026; Effective Date: April 16, 2026), clarifies that separate privacy notices apply to consumers shopping at Square-using businesses and to buyers using Square Buyer Services, and establishes which Square entity serves as data controller based on the user's country of residence (Block, Inc. for US users; Square Canada, Inc. or Square Technologies, Inc. for Canada; Square KK for Japan; Square AU PTY, Ltd. for Australia; Squareup International Ltd. for EU residents). The expanded notice creates clearer operational delineation between merchant-facing services and consumer-facing services, with users directed to separate notices depending on their relationship with Square.
The updated Privacy Notice establishes explicit jurisdiction-specific data controller identities and clarifies which privacy notice applies depending on whether you are a Square seller, consumer shopping at a Square-using merchant, or user of Square Buyer Services. The notice now states that EU residents' data is controlled by Squareup International Ltd., while US residents' data is controlled by Block, Inc., and similar entity assignments apply to Canada, Japan, and Australia. This change establishes clearer governance structure rather than modifying substantive data practices.
→ Identify whether you are a Square seller, consumer shopping at a Square merchant, or user of Square Buyer Services to determine which Privacy Notice governs your data.
→ If you are an EU resident, note that Squareup International Ltd. is identified as your data controller; if you are a US resident, Block, Inc. is your data controller.
Establishes Squareup International Ltd. as data controller for EU residents, Block, Inc. for US residents, and specific entities for Canada, Japan, and Australia.
Clarifies that consumers shopping at Square-using merchants and Square Buyer Services users are governed by separate privacy notices, directing them to the appropriate document.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Square expanded its Privacy Notice to clarify jurisdiction-specific data controller assignments and separate applicability statements for merchants versus consumers. The document now explicitly identifies Squareup International Ltd. as data controller for EU residents, Block, Inc. …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002484.
Square reorganized the order of linked documents in its Privacy Notice, detected on August 22, 2026. Eleven items in the …
Square reordered its list of linked terms and conditions in its Terms of Service. The change moved several documents to …
Square reorganized the list of linked documents and policies in its Privacy Notice in an update detected on August 18, …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.