Stripe updated its Terms of Service with multiple substantive changes effective September 28, 2026. Key changes include: revised support terminology from 'basic business and technical support' to 'standard technical support'; expanded liability caps for Preview Services from a flat USD $1,000 to the lesser of total fees paid in the prior 12 months or USD $1,000; introduced new obligations around AI Agent use, stating that actions initiated by AI Agents are legally binding on users; added a new section on 'Stripe Output Data' restricting how users may employ Stripe-generated data, including prohibitions on using it for automated decision-making, credit/employment eligibility determinations, or training substitute AI systems; changed data breach notification requirements from 'immediately' to 'without undue delay, no later than 48 hours' and expanded the required notification content; and clarified confidentiality obligations to require 'no less than the same degree of care' used to protect the recipient's own confidential information.
Businesses: If you use an AI Agent to access Stripe, you are legally responsible for everything the AI Agent does, and those actions are binding on you.
Businesses: You cannot use Stripe-generated data to automatically decide whether to do business with someone, determine their creditworthiness, or build your own AI system to replace Stripe's services.
Businesses: You must tell Stripe about data incidents within 48 hours and provide details about what data was affected, how many people, and what you are doing to fix it.
Businesses: Your maximum liability for Preview Services is now capped at either your total fees from the past year or $1,000, whichever is lower, instead of a flat $1,000.
Businesses: You must protect Stripe's confidential information with at least as much care as you use to protect your own confidential information.
The updated terms establish new restrictions on how merchants may use Stripe Output Data, prohibiting its use for automated decision-making about customer relationships, credit or employment eligibility determinations, or training AI systems that substitute for Stripe's Services. Merchants using AI Agents to access Stripe Services are now explicitly liable for all actions initiated by those agents, as the terms state such actions are legally binding. Data breach notification obligations have been tightened: users must notify Stripe within 48 hours of becoming aware of a data incident affecting Stripe or its Affiliates, and must provide specific information about the type of data, affected individuals, and remediation status. You can review the specific restrictions on Stripe Output Data use in the updated Service Terms and adjust any automated processes or AI Agent integrations accordingly.
→ Review current AI Agent implementations and establish monitoring controls to ensure compliance with liability framework.
→ Audit use of Stripe Output Data to identify any applications for automated decision-making, credit eligibility, or AI training, and modify or discontinue non-compliant uses.
→ Update incident response procedures to ensure data breach notification to Stripe can occur within 48 hours with required content.
Actions initiated by AI Agents are legally binding on users; users assume full responsibility for AI Agent conduct.
Prohibits use of Stripe Output Data for automated decision-making, credit/employment eligibility, or training substitute AI systems; restricts to internal business purposes only.
Compressed notification timeline from 'immediately' to 48 hours maximum; expanded required disclosure content.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
Stripe introduced three material compliance obligations: (1) a new AI Agent liability framework establishing that actions initiated by AI Agents are legally binding on users, creating potential liability for automated transactions; (2) expanded restrictions on …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-005277.
Stripe renamed its Link service to Onelink throughout its Privacy Policy. Every passage about the service now uses the new …
Mastercard, Stripe, and Cloudflare are building payment infrastructure for autonomous AI agents. The governance layer is not keeping pace.
The Kickstarter-Stripe controversy reveals how payment processors, cloud providers, and AI platforms quietly shape downstream policy decisi…
Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business ow…
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.