Indeed's privacy policy was updated in an update detected on July 21, 2026. The policy now explicitly lists phone number as a category of device information collected, alongside IP address, device ID, and user agent. Additionally, the legitimate interests basis for data processing was expanded to include 'improving our Sites and services' beyond the previous scope of keeping sites safe and secure. A reference to the Joint Controller Addendum was removed from the policy.
Data controllers using Indeed: Indeed's stated reason for processing personal data now includes product improvement, not just security, which may require data controllers to reassess whether this expanded purpose aligns with their own lawful basis under GDPR or similar frameworks.
The updated policy explicitly includes phone number as a type of device information that Indeed collects. Previously, the policy described device information as limited to IP address, device ID, and user agent. Additionally, the policy now states that Indeed relies on legitimate interests not only for keeping sites safe and secure, but also for 'improving our Sites and services', which broadens the stated basis for processing personal data. These changes formalize expanded data collection categories and processing justifications under the same legal framework.
This is the 2nd significant Data Collection Expansion change Indeed has made since ConductAtlas began monitoring.
Across all monitored documents, Indeed has made 4 significant changes.
3 of Indeed's significant changes have been classified as negative for consumers.
Phone number is now explicitly listed as a category of device information collected alongside IP address, device ID, and user agent.
Expanded to include 'improving our Sites and services' in addition to the previous scope of keeping sites safe and secure.
Reference to Joint Controller Addendum was removed from the policy without replacement language describing controller roles.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Indeed expanded its stated data collection categories to explicitly include phone numbers and broadened its legitimate interests basis to encompass service improvement. Under GDPR Article 6(1)(f) and similar privacy frameworks, legitimate interests claims require documented …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-003861.
Indeed expanded its data processing and sharing practices in an update detected on August 13, 2026. The policy previously stated …
Indeed revised its privacy policy in an update detected on August 13, 2026 to expand the categories of personal data …
Indeed modified its password security requirements for user accounts in an update detected on August 13, 2026. The previous requirement …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.