Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that using or interacting with Thomson Reuters Services constitutes authorization for cross-border transfer of personal data to countries, including the United States, that may offer lesser privacy protections than the user's home country.
This analysis describes what Thomson Reuters's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts that the act of interacting with Services constitutes consent to international data transfers, including to jurisdictions with lower privacy standards. Whether this mechanism satisfies the specificity and granularity requirements of GDPR Article 49 derogations or UK GDPR transfer adequacy provisions warrants regulatory evaluation, as broad behavioral consent embedded in a privacy notice may not meet the standards those frameworks require.
Interpretive note: The enforceability of interaction-based consent for international transfers under GDPR Article 49 and analogous frameworks is legally uncertain; the DPF supplemental statement may supersede this mechanism for EU, UK, and Swiss residents, but the primary clause's application to other jurisdictions remains ambiguous.
This clause establishes that interacting with Thomson Reuters products or services constitutes authorization for personal data to be transferred internationally, including to countries whose laws may not provide equivalent privacy protections to the user's home jurisdiction, and acknowledges that government authority access to transferred data may not be preventable.
Cross-platform context
See how other platforms handle Cross-Border Transfer Consent via Service Interaction and similar clauses.
Compare across platforms →Monitoring
Thomson Reuters has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"As described above, we are a global organization, so your personal information may be transferred outside of your home country and may be stored in and accessed from multiple countries, including the United States. When you interact with us, you authorize us to transfer your personal information outside of your home country, and you acknowledge the risk that we may transfer your personal information to countries that may provide less protection than your home country's privacy laws, and we may not be able to prevent government authorities in some countries from accessing your personal information.Excerpt from Thomson Reuters's Privacy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Chapter V (international transfers), UK GDPR international transfer requirements, and Swiss Federal Act on Data Protection transfer provisions. GDPR Article 49 permits transfers to third countries based on explicit consent only when the consent is specific, informed, and freely given for the particular transfer; consent embedded in a privacy statement as a condition of service interaction may not satisfy this standard. The statement separately references the EU-U.S. Data Privacy Framework as the operative transfer mechanism for EU, UK, and Swiss individuals, which may indicate that the behavioral consent clause is intended for other jurisdictions. 2) GOVERNANCE EXPOSURE: High for EU, UK, and Swiss users. The DPF supplemental statement provides a more structured transfer basis for these populations, but the primary statement's framing of interaction-as-authorization remains legally ambiguous for GDPR purposes. For users in other jurisdictions such as Brazil, India, or other countries with adequacy-equivalent transfer requirements, the mechanism's enforceability may require jurisdiction-specific assessment. 3) JURISDICTION FLAGS: EU and UK users are the primary populations where the interaction-as-consent transfer mechanism may face regulatory challenge; however, the DPF supplemental statement appears to operate as the governing transfer mechanism for these groups. Brazilian LGPD, Indian DPDP Act, and Canadian PIPEDA all impose transfer restrictions that may not be satisfied by a behavioral consent mechanism embedded in a privacy notice. 4) CONTRACT AND VENDOR IMPLICATIONS: B2B customers contracting with Thomson Reuters should evaluate whether their own data transfer obligations to employees or end users are affected by Thomson Reuters' cross-border transfer practices, particularly where customer data is processed through Thomson Reuters platforms. Data processing agreements should specify the transfer mechanisms applicable to each service and jurisdiction. 5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that the DPF certification covers all Thomson Reuters entities and services relevant to EU, UK, and Swiss data transfers and confirm that Standard Contractual Clauses or other GDPR-compliant mechanisms are in place for transfers not covered by the DPF. For non-EU jurisdictions, counsel should assess whether the behavioral consent mechanism satisfies local transfer requirements on a jurisdiction-by-jurisdiction basis.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision asserts that the act of interacting with Services constitutes consent to international data transfers, including to jurisdictions with lower privacy standards. Whether this mechanism satisfies the specificity and granularity requirements of GDPR Article 49 derogations or UK GDPR transfer adequacy provisions warrants regulatory evaluation, as broad behavioral consent embedded in a privacy notice may not meet the standards …
This clause establishes that interacting with Thomson Reuters products or services constitutes authorization for personal data to be transferred internationally, including to countries whose laws may not provide equivalent privacy protections to the user's home jurisdiction, and acknowledges that government authority access to transferred data may not be preventable.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Thomson Reuters.