Recent policy changes

Why it matters: The updated terms clarify what advertising formats Premium subscribers may encounter, expanding beyond live read ads to include host-read sponsorships, original broadcast advertisements, and native placements such as boosted content and homepage ads. This change materially affects the scope of advertising disclosure in the Premium subscription offering and may influence consumer expectations about the premium experience.

Why it matters: The removal of explicit Data Processing Addendum language may affect how organizations document Anthropic as a subprocessor and authorize international data transfers under their own compliance frameworks. The expanded disclosure for Kiro clarifies the scope of human review in abuse detection, which may be material for organizations processing sensitive content or operating under privacy regulation requiring transparency on data handling practices.

Why it matters: The removal of published privacy disclosures from Midjourney's FAQ affects transparency about data handling practices. Previously, users and organizations could review documented explanations of data collection, sharing, security, and children's privacy protections. The removal of these sections means this FAQ no longer serves as a reference for those disclosures, and it is unclear whether equivalent documentation remains available elsewhere or whether privacy protections for children and regional compliance have been modified.

Why it matters: This change fundamentally restructures how disputes are resolved. The updated terms establish binding arbitration as the sole mechanism for resolving nearly all disputes, removing court access and jury trial rights that previously applied. The mandatory pre-arbitration procedure and class action waiver substantially alter the practical options available to customers seeking to resolve grievances with Amazon.

Why it matters: The updated terms establish a clearer but more restrictive cancellation timeline for pre-paid medication plans. Users who request cancellation after a billing date will now have their subscription continue through the end of their current medication supply period, which may result in additional medication shipments and charges after cancellation is requested. This affects the practical timing and cost control available to subscribers managing their medication subscriptions.

Why it matters: The age restriction change eliminates access for users under 18, which affects platform eligibility and downstream vendor representations. The Files API procedures establish concrete commitments about encryption, access control, and deletion that affect data processing agreements, vendor compliance certifications, and privacy notice accuracy for any organization relying on OpenRouter for file handling or inference processing.

Why it matters: This change establishes a material barrier to service access for minors and introduces mandatory content safeguards with federal reporting obligations. The elimination of the parental permission pathway creates immediate compliance implications for any organization that previously relied on that mechanism to serve younger users, while the automated file scanning and NCMEC reporting obligations formalize OpenRouter's independent legal duties under federal CSAM law.

Why it matters: The updated terms create new compliance obligations for organizations serving minors 13-17 via audio services (parental consent and supervision verification), expand Stability's authority to process and adapt all submitted content, and narrow the arbitration clause to US users only, shifting dispute resolution frameworks for Canadian users. These changes materially alter the legal and operational terms governing use of the platform, particularly for organizations and products targeting younger audiences.

Why it matters: The updated policy removes explicit disclosures about how Cursor processes and retains codebase data during indexing. Users and organizations can no longer rely on the stated data handling practices for plaintext code deletion and metadata storage, creating ambiguity about retention practices for sensitive source code and metadata.

Why it matters: The updated policy removes a disclosed opt-out mechanism for Verizon Community users. Under state privacy laws, removal of a previously published privacy control or instruction may raise compliance concerns unless the functionality remains accessible and is disclosed elsewhere. Verizon Community users will no longer locate this opt-out guidance in the policy as written.

Why it matters: The updated language formalizes Gusto's disclosure of personal information sales and sharing practices under U.S. state privacy laws, clarifying what data is shared, with whom, and how users can opt out. This affects how Gusto consumers understand their data privacy rights and responsibilities under CCPA, CPRA, and similar state regimes, and may require employers and vendors using Gusto to align their own privacy practices and agreements with these disclosures.

Why it matters: The updated policy expands the category of personal information Mercury collects and processes on behalf of businesses, now explicitly including employees, contractors, payment beneficiaries, and dependents collected directly from those individuals rather than just the business. This affects data flow and disclosure obligations for any business using Mercury's payroll, contractor payment, or benefits services, and may require those businesses to update their own privacy disclosures and data processing agreements to reflect this expanded third-party collection. The SMS consent change also clarifies the distinction between transactional and marketing message consent, which affects how marketing communications are permissioned and personalized.

Why it matters: The updated policy expands Verizon's stated authority to use customer data for new purposes: determining eligibility for employment-related discounts and rewards programs, and contacting you with partner marketing offers based on third-party data. This narrows the scope of what constitutes 'unexpected' data use and may increase the volume or frequency of eligibility assessments and marketing contact tied to your personal data. In jurisdictions with privacy laws requiring explicit notice of all data uses (GDPR, CCPA, state privacy acts), this expansion of stated uses affects the adequacy of privacy disclosures.

Why it matters: This change clarifies the liability allocation in Google's Platform Terms by confirming that Google cannot contractually cap its liability if customers violate the agreement's usage or license restrictions. The revision affects the contractual risk framework for organizations that depend on Google Maps Platform for production services.

Why it matters: The restructured print fulfillment model introduces a separate contractual framework for marketplace seller transactions, which affects the governing terms and remedies available to customers. The explicit order rejection authority and refund limitation clarify what remedies are not available to consumers, which may narrow dispute resolution options compared to the prior model where all print services were attributed to Canva's third-party partners. Organizations relying on Canva's print services should confirm which contractual tier applies and adjust customer expectations accordingly.

Why it matters: The explicit addition of class action and jury trial waivers to the arbitration clause materially restricts users' legal remedy options and creates regulatory exposure for Venmo under CFPB and FTC standards. The restructuring of the cash back program with specific spending thresholds and transaction exclusions changes how rewards are calculated and may reduce the rewards available to users who do not meet the higher spending tiers, affecting the practical value proposition of the program.

Why it matters: The updated policy introduces formal disclosure of Automated Decision-Making and AI systems (section 10), expanding regulatory transparency expectations under GDPR and emerging AI frameworks. The policy scope now explicitly covers banking and accounts receivable services, creating new data-handling obligations beyond the original corporate card and expense management focus. Organizations using Ramp should confirm whether these changes require updates to vendor assessments, Data Processing Agreements, or customer privacy notices.

Why it matters: The updated terms broaden the circumstances under which your email address is shared with event organizers. Previously, sharing occurred only when you registered for their events; now it also occurs when you affirmatively opt into marketing communications through the platform. The policy clarifies that organizers own the relationship with you for these marketing subscriptions and can use email tools to reach you.

Why it matters: The updated terms establish new automated decision-making systems affecting retailer payment terms and credit limits, expand what business data Faire collects and infers about retailers, and broaden how that information is shared within the marketplace and with external partners. These changes affect how retailers' accounts are managed, what information other marketplace participants can access about their business, and what sensitive information they may need to provide to access Faire's credit product. Retailers should understand that payment terms may be set by algorithm based on credit assessment and that business profile information is now actively shared to facilitate marketplace discovery and transactions.

Why it matters: The restructured Cash App Tag pricing introduces variable fees up to $250 (vs. a prior fixed $25) and shifts the point of price certainty to checkout disclosure rather than upfront terms. This affects customer cost predictability and purchase decisions. Simultaneously, extending Tag eligibility to Children broadens transaction capabilities for minors previously restricted, requiring parents managing Sponsored Accounts to understand that children can now conduct Tag transactions within sponsor-set limits.

Why it matters: This change establishes a financial consequence for creators who change their payout country or method without withdrawing unpaid balances first. The forfeiture mechanism introduces operational risk for creators managing earnings across multiple jurisdictions, and the notice-and-confirmation requirement creates a friction point in account modifications that creators need to understand to avoid unintended losses.

Why it matters: The revised terms materially change the cost of exiting SoFi Plus and the liquidity constraints on investment deposits. Prior terms imposed a one-year membership lock with a cancellation fee for early exit; the revised terms eliminate the fee but impose a five-year holding requirement on deposits themselves. Members can now cancel SoFi Plus without penalty, but deposits cannot be withdrawn for five years without forfeiting the 1% match. This shifts the friction from membership continuity to account liquidity and may affect portfolio rebalancing, tax-loss harvesting, and withdrawal planning.

Why it matters: The updated terms establish a five-year asset retention requirement as the new condition for receiving and retaining the SoFi Plus 1% investment match benefit, replacing the prior one-year membership requirement. This structural shift materially extends the period during which members cannot withdraw deposits without forfeiting match proceeds, fundamentally altering the liquidity profile and financial planning implications of the benefit. The change also restarts the promotional period and introduces a secondary limited-time offer window, creating distinct eligibility cohorts and enforcement dates that SoFi members must track separately.

Why it matters: The updated terms establish AWS's authority to suspend and permanently close accounts based on spend limit violations, and introduce new team member content ownership and liability rules that affect how data and intellectual property are governed within shared projects. Organizations using AWS Bedrock should understand that enabling spend limits creates exposure to account suspension and permanent content deletion without a specified reactivation grace period. Project owners become liable for team member conduct and content contributions, which affects internal governance and contract allocation of risk.

Why it matters: The updated terms establish explicit data retention, logging, and opt-out procedures that organizations subject to data protection regulations (GDPR, CCPA) need to evaluate against their own data governance obligations. The 30-day automatic deletion with stated exceptions, training data opt-out mechanism, and disclosure of safety monitoring provide operational clarity that was previously implicit, enabling organizations to confirm alignment with their vendor contracts and regulatory obligations.

Why it matters: The updated DPA restructures how subprocessor disclosures are communicated and managed, shifting from static document amendments to a live online registry that customers must actively monitor. The introduction of product-specific data postures for Embeddings API and Perplexity Search creates a more complex compliance model where different services operate under different rules, which organizations subject to GDPR or UK GDPR must carefully track to ensure their own data controller obligations are met.

Why it matters: The updated pricing reflects a material increase in per-token costs for mistral-medium-3-5 API consumption and a shift in the primary pricing currency to USD. Organizations that budget for Mistral API expenses, embed the model in production systems, or operate on margins sensitive to inference costs should evaluate the impact on their cost structure and contract terms.

Why it matters: The updated policy removes an explicit, prominent reassurance that personal data is not sold and user conversations are not shared with advertisers. While the document may retain substantive privacy protections elsewhere, the removal of this upfront commitment changes what assurances are immediately visible to users and may affect how privacy commitments are represented in third-party vendor assessments or customer-facing disclosures.

Why it matters: The updated terms fundamentally restructure dispute resolution from a private, streamlined arbitration process to mandatory public litigation in Texas courts with strict filing deadlines. Users in other states or countries face significantly increased friction and cost to pursue claims, and claims not filed within 1-2 years are permanently barred. This change affects access to justice and the practical enforceability of user rights under the agreement.

Why it matters: The updated terms substantially expand Perplexity's unilateral authority to modify which services are covered, introduce marketing data sharing outside the data processing agreement, and establish automatic acceptance of changes through continued use. For organizations with vendor governance frameworks, data processing agreements, or privacy representations tied to specific product scope and processor-only data handling, these changes create new compliance review obligations and potential gaps between what the organization has represented to customers or regulators and what Perplexity's terms now permit.