Provisions Index

Coinbase collects your facial geometry data when you verify your identity, which is some of the most sensitive personal data that exists....

Why it matters: Biometric data is irreplaceable — unlike a password, you cannot change your face. Its collection and potential misuse creates lifelong privacy risks....

Coinbase can hand your personal and financial data to law enforcement or government agencies without telling you, based on its own judgment about what counts as suspected illegal activity....

Why it matters: The 'good faith belief' standard for voluntary disclosure — beyond legally compelled process — means Coinbase can share your data with authorities proactively without a court order and without notifying you, which has significant implications for financial privacy....

Coinbase shares your personal and financial data with advertising companies and analytics firms to target you with ads, in addition to sharing with operational service providers....

Why it matters: Sharing cryptocurrency trading data and financial information with advertising networks goes beyond what most consumers expect from a financial services provider and may enable highly sensitive inferences about wealth, investment behavior, and risk appetite....

Coinbase transfers your personal data to the United States for processing, even if you are based in the EU or another country with stronger privacy protections than the US....

Why it matters: US privacy law provides weaker protections than GDPR for EU residents, and transferring your data to the US means it may be accessible to US government surveillance programs without the same legal safeguards you have in Europe....

Coinbase collects your government ID, passport, tax ID number, date of birth, and bank account details as part of its mandatory identity verification process — you cannot use most Coinbase services without providing this information....

Why it matters: This is among the most sensitive combination of personal data that can be collected — government ID plus financial account information plus biometrics together enable identity theft, financial fraud, and comprehensive financial surveillance if breached or misused....

Coinbase shares your personal data with companies that analyze blockchain transaction records, which can link your Coinbase identity to your cryptocurrency wallet addresses and on-chain activity....

Why it matters: Blockchain analytics firms can use your linked identity and wallet address to trace all your on-chain cryptocurrency transactions across the entire public blockchain, permanently associating your real identity with your transaction history in ways that cannot be undone....

If you live in California, you have specific legal rights to see, delete, correct, and limit the use of your personal information, and Coinbase is required to honor these rights without penalizing you....

Why it matters: California's CPRA grants some of the strongest consumer privacy rights in the US, including the right to limit how companies use sensitive data like your government ID and financial information, but you must proactively exercise these rights....

Coinbase keeps your personal data — including your identity documents, transaction records, and financial information — for years after you close your account, because financial regulations require it....

Why it matters: Even if you close your Coinbase account and request data deletion, your identity and transaction records will be retained for years due to AML and financial reporting obligations, meaning exercising privacy rights will have limited effect on your historical data....

Coinbase automatically tracks your device, browser, IP address, and how you navigate and interact with the platform every time you use it....

Why it matters: Combined with your identity and financial data, behavioral tracking data creates a comprehensive profile that can reveal your trading strategies, financial risk tolerance, and investment patterns....

Coinbase does not allow users under 18 and will delete any personal data collected from minors if discovered....

Why it matters: The policy's age restriction is self-enforced through user attestation, not technical verification, meaning minors who misrepresent their age can access Coinbase and their data will be collected until discovered....

Uber tracks your exact GPS location at all times while the Uber app is open on your phone, even when you are between trips and the app is running in the background....

Why it matters: This means Uber knows where you are at all times during your working hours — not just when you have a passenger — which creates a comprehensive record of your movements and could be used to make decisions about your account....

Uber monitors how you drive — including your speed, how hard you brake, and how you hold your phone — and uses this data alongside passenger ratings to evaluate your performance on the platform....

Why it matters: Telematics data is used to make decisions about your driver account, including potential deactivation. You have limited visibility into how these scores are calculated and limited ability to challenge adverse decisions....

Uber requires drivers to take selfies to verify their identity, and uses facial recognition technology to match these photos against the driver's profile — this is considered biometric data collection under several state laws....

Why it matters: Biometric data is uniquely sensitive because it cannot be changed if compromised. Laws like Illinois BIPA create per-violation statutory damages of up to $5,000, and several states require explicit written informed consent before collecting biometric identifiers....

In some regions, Uber or its safety partners may access audio and video recordings captured inside your vehicle during trips, for purposes like investigating safety incidents or resolving insurance claims....

Why it matters: Audio and video recordings of passengers and drivers inside vehicles implicate wiretapping and electronic surveillance laws in many states, particularly two-party consent states. Drivers may face legal exposure if they record passengers without proper disclosure....

Uber shares your personal information — including your location, trip history, driving record, and background check results — with insurance companies, background check firms, and other business partners....

Why it matters: Once your data is shared with third parties, Uber's privacy policy no longer governs how those parties use it — each third party has its own data practices, and you may have limited ability to control secondary uses of your information....

Depending on where you live, you have rights to see, correct, or delete the personal data Uber holds about you, and you can submit these requests through Uber's online privacy portal....

Why it matters: Exercising your data rights is one of the most important tools you have to understand and control what Uber knows about you, but the effectiveness of these rights depends on Uber responding correctly and within required legal timeframes....

Uber runs background checks on drivers using third-party companies, collecting your criminal history and driving record, and uses this to decide whether you can use the platform....

Why it matters: Background check data is highly sensitive and its use to make eligibility determinations triggers specific legal protections under the Fair Credit Reporting Act, including the right to receive a copy of the report and to dispute inaccurate information before adverse action is taken....

Uber transfers your personal data to the United States and other countries. For drivers in the EU and UK, Uber says it uses legal safeguards called Standard Contractual Clauses to protect data during these international transfers....

Why it matters: The Irish DPC fined Uber €290 million in 2023 specifically because its international data transfer safeguards were inadequate. This provision is directly relevant to that ongoing compliance risk....

TikTok's platform embeds technical code that monitors your device's motion sensors (accelerometer, gyroscope), clipboard contents, battery status, geolocation API usage, and camera/microphone API access — even on its policy overview webpage....

Why it matters: This level of device-level monitoring goes far beyond what most users would expect from a policy page and may constitute covert collection of sensitive signals used for device fingerprinting and behavioral profiling....

TikTok has implemented a cookie consent management system that blocks or reports third-party trackers (Google Analytics, Facebook Pixel, Bing, LinkedIn) if a user has not given consent — this is a privacy-protective mechanism required by EU law....

Why it matters: This shows TikTok has a consent management platform (CMP) in place, but the effectiveness and granularity of consent collection determines whether EU and UK users' data rights are genuinely protected....

TikTok's platform policy includes safety frameworks specifically designed for users under 18, including content restrictions, account controls, and parental oversight tools such as Family Pairing....

Why it matters: Children and teenagers are among TikTok's largest user groups, and the adequacy of age verification and parental consent mechanisms directly affects compliance with COPPA, GDPR Art. 8, and the UK Age Appropriate Design Code....

TikTok reserves the right to remove content and suspend or terminate accounts that violate its Community Guidelines, with moderation decisions made at TikTok's discretion....

Why it matters: Account suspension without adequate notice, appeal rights, or transparency about decision-making criteria can deprive users — including creators who earn income on the platform — of access to their content, followers, and revenue....

TikTok routes user data to servers in multiple jurisdictions including the US, Singapore, Ireland (EU), and ByteDance infrastructure, meaning your data may be transferred internationally to countries with different levels of data protection....

Why it matters: Cross-border data transfers to countries outside the EU/EEA — including transfers to ByteDance infrastructure — require specific legal safeguards under GDPR, and TikTok's ownership structure has made these transfers a focus of regulatory and national security scrutiny....

TikTok's embedded technical code monitors access to your device's clipboard — the temporary storage used when you copy and paste text — including both reading from and writing to the clipboard....

Why it matters: Clipboard monitoring is particularly invasive because clipboard contents can include passwords, personal messages, financial information, and other sensitive data that users copy from other applications....

TikTok's embedded code monitors every time the geolocation API is called — including continuous location tracking via 'watchPosition' — and logs this at a 100% sampling rate....

Why it matters: Precise geolocation data is among the most sensitive personal data categories, and continuous location monitoring ('watchPosition') is typically used for real-time location tracking rather than simple location-based features....

TikTok monitors calls to your browser's battery status API, which can reveal your device's battery level and charging status — a signal commonly used in device fingerprinting....

Why it matters: Battery status information, while seemingly innocuous, has been identified by privacy researchers and regulators as a device fingerprinting vector that can be used to track users across websites even when cookies are blocked....

TikTok publishes transparency reports and maintains internal telemetry reporting systems that send user activity data to its servers at regular intervals — every 3 seconds with batches of up to 15 events....

Why it matters: Frequent telemetry reporting means TikTok collects near-real-time behavioral data from users, and the transparency of this collection depends entirely on whether it is adequately disclosed in TikTok's privacy policy....

Audible's website runs code in your browser that records your keystrokes, mouse movements, clicks, and scroll events in real time. This data is packaged and sent to Amazon's analytics servers....

Why it matters: Keystroke and mouse-movement capture goes beyond standard page analytics — it can reconstruct exactly what you typed and how you navigated, raising significant privacy concerns if not properly disclosed and consented to....

Data collected about your behaviour on Audible's site is sent to Amazon's servers at unagi.amazon.com and fls-na.amazon.com via tracking beacons. This happens automatically as you browse....

Why it matters: Your browsing activity on Audible is transmitted to Amazon's centralised analytics infrastructure, meaning your audiobook interests and listening habits are aggregated into Amazon's broader consumer profile....

Audible sets a 'csm-hit' cookie and uses localStorage to track your session activity, linking your browsing behaviour to a persistent session and device identifier. This cookie persists for 7 days....

Why it matters: A persistent 7-day tracking cookie tied to a session ID means Audible can recognise and profile your device across multiple visits within that period, even if you do not log in....

Audible's site captures any security policy violations that occur in your browser and collects them for reporting. This involves listening to browser security events triggered during your session....

Why it matters: While primarily a security feature, this mechanism means Audible is collecting technical event data from your browser environment, which could include information about your browser extensions or security configuration....

Audible uses Amazon's proprietary 'UE' (User Experience) analytics framework to measure page load times, interaction events, and performance metrics, tagging each with your session and request ID....

Why it matters: The UE framework links performance telemetry to your unique session ID and request ID, meaning your browsing speed data is tied to an identifiable session rather than being collected anonymously....

If you have a dispute with Headspace, you must resolve it through private arbitration instead of going to court. You also cannot join a class action lawsuit against Headspace....

Why it matters: This clause prevents users from suing Headspace in court or banding together with other affected users in a class action, which significantly limits consumers' ability to seek redress for widespread harms....

Your Headspace subscription automatically renews at the end of each billing period and you will be charged unless you cancel before the renewal date....

Why it matters: Users who forget to cancel will be charged for another subscription period, and the terms do not guarantee refunds after renewal has processed — creating direct financial risk for consumers....

Headspace says it is a technology platform, not a healthcare provider, even though it offers therapy and psychiatry through affiliated medical groups....

Why it matters: This disclaimer creates ambiguity about whether users' mental health and therapy data is protected under HIPAA, and limits Headspace's liability if something goes wrong with the clinical services it facilitates....

When you submit any content to Headspace — such as reviews, comments, or other materials — you grant Headspace a broad, royalty-free, worldwide license to use, reproduce, modify, and distribute that content....

Why it matters: This means Headspace can use content you post on the platform for its own purposes without paying you, and without requiring your additional permission for each use....

You agree not to participate in any class action, collective, or representative lawsuit against Headspace. All claims must be brought individually in arbitration....

Why it matters: This prevents users from joining together to challenge Headspace's practices collectively, which is often the only economically viable way for individual consumers to pursue small-value claims against a large company....

Headspace states that its meditation and mindfulness content is not a substitute for professional medical advice, and users assume risk for how they use the service, including any mental health impacts....

Why it matters: For a platform that also provides actual therapy and psychiatry services, this broad risk assumption clause may obscure to users where general wellness content ends and regulated clinical services begin....

Headspace requires users to be at least 16 years old to use the service. Users under 16 are not permitted to create accounts....

Why it matters: Setting the minimum age at 16 rather than 13 means Headspace goes beyond COPPA's requirements but must still ensure effective age verification, particularly given the sensitive mental health data the platform collects....

Headspace provides its services 'as is' with no guarantees that they will work perfectly, be available at all times, or meet your specific needs....

Why it matters: This means Headspace accepts no legal responsibility if its app goes down, content is inaccurate, or the service fails to deliver the mental health benefits it advertises....

By using Headspace, you consent to receiving electronic communications from Headspace, including notices, updates, and promotional messages....

Why it matters: This consent covers marketing emails and app notifications, and users should know how to opt out of promotional communications if they do not wish to receive them....

These Terms are governed by California law, and any disputes not subject to arbitration must be resolved in California courts....

Why it matters: This means users outside California who want to take Headspace to court — if the arbitration clause is unenforceable — may need to litigate in California, which can be costly and impractical for users in other states or countries....

TikTok's platform infrastructure — including its policy pages — runs JavaScript that monitors device sensors such as accelerometer, gyroscope, geolocation, clipboard contents, battery status, and camera/microphone access APIs. This occurs in the background without a prominent disclosure on the page ...

Why it matters: Most users visiting a policy or safety page would not expect their device's physical sensors and clipboard to be monitored; this collection goes significantly beyond what is necessary for displaying informational content....

TikTok's platform embeds trackers from Google Analytics, Facebook Pixel, Microsoft Bing, LinkedIn, Reddit, and its own TikTok Pixel, and operates a consent management system that is supposed to block these trackers until user consent is obtained. However, the technical rules in the page source show ...

Why it matters: If third-party advertising and analytics trackers fire before you have given consent, your browsing data — including your visit to TikTok's own safety and privacy pages — may be shared with Google, Meta, Microsoft, and LinkedIn without your knowledge or agreement....

TikTok reserves the right to remove content or suspend accounts that violate its Community Guidelines, which are enforced through a combination of automated systems and human reviewers. Users whose content is removed or accounts suspended can submit an appeal through the in-app process....

Why it matters: TikTok's moderation systems — both automated and human — can remove your content or restrict your account, which can significantly impact creators, businesses, and individuals who rely on the platform for income or communication....

TikTok's Trust & Safety framework includes specific policies for users under 13 and under 18, including age-gating, restricted content settings for minors, and parental controls. These reflect TikTok's obligations under COPPA and international child safety laws....

Why it matters: TikTok has a documented history of COPPA violations and has been subject to regulatory enforcement actions specifically concerning children's data; the adequacy of its age verification and parental consent mechanisms remains a live compliance issue....

TikTok's platform JavaScript includes calls to the browser's geolocation API (getCurrentPosition and watchPosition), enabling the collection of precise GPS-level location data from users' devices. The watchPosition function enables continuous location tracking, not just a single location lookup....

Why it matters: Continuous or repeated collection of precise geolocation data is considered sensitive personal data in most jurisdictions and requires explicit consent; the presence of watchPosition in TikTok's web infrastructure indicates the platform may track your location over time, not just at the moment you a...

TikTok's web platform code monitors clipboard read and write operations (navigator.clipboard.read, readText, write, and writeText APIs), meaning TikTok may be able to access text or data that you have copied to your device's clipboard from any application....

Why it matters: Clipboard data can contain highly sensitive information including passwords, bank account numbers, personal messages, or confidential documents copied from other apps, and monitoring clipboard access has previously been identified as a significant privacy risk in TikTok's mobile app....

TikTok's web platform code includes calls to the navigator.getBattery API, which retrieves the device's battery charge level and charging status. While this data seems innocuous, battery status information has been used as a fingerprinting vector to track users across sessions....

Why it matters: Battery status data has been specifically identified by European privacy regulators as a browser fingerprinting vector that can be used to re-identify users even after they clear cookies, effectively bypassing consent mechanisms....

TikTok's Trust & Safety hub includes a Transparency section that publishes reports on government data requests, content removals, and platform enforcement actions. These reports are intended to demonstrate accountability under applicable regulatory frameworks....

Why it matters: Transparency reports are a key accountability mechanism for large platforms; the completeness and accuracy of TikTok's transparency reporting is subject to DSA obligations and is a material factor in ongoing regulatory scrutiny of the platform....