The policy states that using or interacting with Thomson Reuters Services constitutes authorization for cross-border transfer of personal data to countries, including the United States, that may offer lesser privacy protections than the user's home country.
This analysis describes what Thomson Reuters's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts that the act of interacting with Services constitutes consent to international data transfers, including to jurisdictions with lower privacy standards. Whether this mechanism satisfies the specificity and granularity requirements of GDPR Article 49 derogations or UK GDPR transfer adequacy provisions warrants regulatory evaluation, as broad behavioral consent embedded in a privacy notice may not meet the standards those frameworks require.
Interpretive note: The enforceability of interaction-based consent for international transfers under GDPR Article 49 and analogous frameworks is legally uncertain; the DPF supplemental statement may supersede this mechanism for EU, UK, and Swiss residents, but the primary clause's application to other jurisdictions remains ambiguous.
This clause establishes that interacting with Thomson Reuters products or services constitutes authorization for personal data to be transferred internationally, including to countries whose laws may not provide equivalent privacy protections to the user's home jurisdiction, and acknowledges that government authority access to transferred data may not be preventable.
Cross-platform context
See how other platforms handle Cross-Border Transfer Consent via Service Interaction and similar clauses.
Compare across platforms →"As described above, we are a global organization, so your personal information may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States. When you interact with us, you authorize us to transfer your personal information outside of your home country, and you acknowledge the risk that we may transfer your personal information to countries that may provide less protection than your home country's privacy laws, and we may not be able to prevent government authorities in some countries from accessing your personal information.Excerpt from Thomson Reuters's Privacy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Chapter V (international transfers), UK GDPR international transfer requirements, and Swiss Federal Act on Data Protection transfer provisions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision asserts that the act of interacting with Services constitutes consent to international data transfers, including to jurisdictions with lower privacy standards. Whether this mechanism satisfies the specificity and granularity requirements of GDPR Article 49 derogations or UK GDPR transfer adequacy provisions warrants regulatory evaluation, as broad behavioral consent embedded in a privacy notice may not meet the standards …
This clause establishes that interacting with Thomson Reuters products or services constitutes authorization for personal data to be transferred internationally, including to countries whose laws may not provide equivalent privacy protections to the user's home jurisdiction, and acknowledges that government authority access to transferred data may not be preventable.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Thomson Reuters.