Provisions Index

Coinbase collects your facial geometry data when you verify your identity, which is some of the most sensitive personal data that exists....

Why it matters: Biometric data is irreplaceable — unlike a password, you cannot change your face. Its collection and potential misuse creates lifelong privacy risks....

Coinbase can hand your personal and financial data to law enforcement or government agencies without telling you, based on its own judgment about what counts as suspected illegal activity....

Why it matters: The 'good faith belief' standard for voluntary disclosure — beyond legally compelled process — means Coinbase can share your data with authorities proactively without a court order and without notifying you, which has significant implications for financial privacy....

Coinbase shares your personal and financial data with advertising companies and analytics firms to target you with ads, in addition to sharing with operational service providers....

Why it matters: Sharing cryptocurrency trading data and financial information with advertising networks goes beyond what most consumers expect from a financial services provider and may enable highly sensitive inferences about wealth, investment behavior, and risk appetite....

Coinbase transfers your personal data to the United States for processing, even if you are based in the EU or another country with stronger privacy protections than the US....

Why it matters: US privacy law provides weaker protections than GDPR for EU residents, and transferring your data to the US means it may be accessible to US government surveillance programs without the same legal safeguards you have in Europe....

Coinbase collects your government ID, passport, tax ID number, date of birth, and bank account details as part of its mandatory identity verification process — you cannot use most Coinbase services without providing this information....

Why it matters: This is among the most sensitive combination of personal data that can be collected — government ID plus financial account information plus biometrics together enable identity theft, financial fraud, and comprehensive financial surveillance if breached or misused....

Coinbase shares your personal data with companies that analyze blockchain transaction records, which can link your Coinbase identity to your cryptocurrency wallet addresses and on-chain activity....

Why it matters: Blockchain analytics firms can use your linked identity and wallet address to trace all your on-chain cryptocurrency transactions across the entire public blockchain, permanently associating your real identity with your transaction history in ways that cannot be undone....

Uber tracks your exact GPS location at all times while the Uber app is open on your phone, even when you are between trips and the app is running in the background....

Why it matters: This means Uber knows where you are at all times during your working hours — not just when you have a passenger — which creates a comprehensive record of your movements and could be used to make decisions about your account....

Uber monitors how you drive — including your speed, how hard you brake, and how you hold your phone — and uses this data alongside passenger ratings to evaluate your performance on the platform....

Why it matters: Telematics data is used to make decisions about your driver account, including potential deactivation. You have limited visibility into how these scores are calculated and limited ability to challenge adverse decisions....

Uber requires drivers to take selfies to verify their identity, and uses facial recognition technology to match these photos against the driver's profile — this is considered biometric data collection under several state laws....

Why it matters: Biometric data is uniquely sensitive because it cannot be changed if compromised. Laws like Illinois BIPA create per-violation statutory damages of up to $5,000, and several states require explicit written informed consent before collecting biometric identifiers....

In some regions, Uber or its safety partners may access audio and video recordings captured inside your vehicle during trips, for purposes like investigating safety incidents or resolving insurance claims....

Why it matters: Audio and video recordings of passengers and drivers inside vehicles implicate wiretapping and electronic surveillance laws in many states, particularly two-party consent states. Drivers may face legal exposure if they record passengers without proper disclosure....

Uber shares your personal information — including your location, trip history, driving record, and background check results — with insurance companies, background check firms, and other business partners....

Why it matters: Once your data is shared with third parties, Uber's privacy policy no longer governs how those parties use it — each third party has its own data practices, and you may have limited ability to control secondary uses of your information....

Uber transfers your personal data to the United States and other countries. For drivers in the EU and UK, Uber says it uses legal safeguards called Standard Contractual Clauses to protect data during these international transfers....

Why it matters: The Irish DPC fined Uber €290 million in 2023 specifically because its international data transfer safeguards were inadequate. This provision is directly relevant to that ongoing compliance risk....

TikTok's platform embeds technical code that monitors your device's motion sensors (accelerometer, gyroscope), clipboard contents, battery status, geolocation API usage, and camera/microphone API access — even on its policy overview webpage....

Why it matters: This level of device-level monitoring goes far beyond what most users would expect from a policy page and may constitute covert collection of sensitive signals used for device fingerprinting and behavioral profiling....

TikTok has implemented a cookie consent management system that blocks or reports third-party trackers (Google Analytics, Facebook Pixel, Bing, LinkedIn) if a user has not given consent — this is a privacy-protective mechanism required by EU law....

Why it matters: This shows TikTok has a consent management platform (CMP) in place, but the effectiveness and granularity of consent collection determines whether EU and UK users' data rights are genuinely protected....

TikTok's platform policy includes safety frameworks specifically designed for users under 18, including content restrictions, account controls, and parental oversight tools such as Family Pairing....

Why it matters: Children and teenagers are among TikTok's largest user groups, and the adequacy of age verification and parental consent mechanisms directly affects compliance with COPPA, GDPR Art. 8, and the UK Age Appropriate Design Code....

TikTok routes user data to servers in multiple jurisdictions including the US, Singapore, Ireland (EU), and ByteDance infrastructure, meaning your data may be transferred internationally to countries with different levels of data protection....

Why it matters: Cross-border data transfers to countries outside the EU/EEA — including transfers to ByteDance infrastructure — require specific legal safeguards under GDPR, and TikTok's ownership structure has made these transfers a focus of regulatory and national security scrutiny....

TikTok's embedded technical code monitors access to your device's clipboard — the temporary storage used when you copy and paste text — including both reading from and writing to the clipboard....

Why it matters: Clipboard monitoring is particularly invasive because clipboard contents can include passwords, personal messages, financial information, and other sensitive data that users copy from other applications....

TikTok's embedded code monitors every time the geolocation API is called — including continuous location tracking via 'watchPosition' — and logs this at a 100% sampling rate....

Why it matters: Precise geolocation data is among the most sensitive personal data categories, and continuous location monitoring ('watchPosition') is typically used for real-time location tracking rather than simple location-based features....

Audible's website runs code in your browser that records your keystrokes, mouse movements, clicks, and scroll events in real time. This data is packaged and sent to Amazon's analytics servers....

Why it matters: Keystroke and mouse-movement capture goes beyond standard page analytics — it can reconstruct exactly what you typed and how you navigated, raising significant privacy concerns if not properly disclosed and consented to....

If you have a dispute with Headspace, you must resolve it through private arbitration instead of going to court. You also cannot join a class action lawsuit against Headspace....

Why it matters: This clause prevents users from suing Headspace in court or banding together with other affected users in a class action, which significantly limits consumers' ability to seek redress for widespread harms....

Your Headspace subscription automatically renews at the end of each billing period and you will be charged unless you cancel before the renewal date....

Why it matters: Users who forget to cancel will be charged for another subscription period, and the terms do not guarantee refunds after renewal has processed — creating direct financial risk for consumers....

Headspace says it is a technology platform, not a healthcare provider, even though it offers therapy and psychiatry through affiliated medical groups....

Why it matters: This disclaimer creates ambiguity about whether users' mental health and therapy data is protected under HIPAA, and limits Headspace's liability if something goes wrong with the clinical services it facilitates....

You agree not to participate in any class action, collective, or representative lawsuit against Headspace. All claims must be brought individually in arbitration....

Why it matters: This prevents users from joining together to challenge Headspace's practices collectively, which is often the only economically viable way for individual consumers to pursue small-value claims against a large company....

TikTok's platform infrastructure — including its policy pages — runs JavaScript that monitors device sensors such as accelerometer, gyroscope, geolocation, clipboard contents, battery status, and camera/microphone access APIs. This occurs in the background without a prominent disclosure on the page ...

Why it matters: Most users visiting a policy or safety page would not expect their device's physical sensors and clipboard to be monitored; this collection goes significantly beyond what is necessary for displaying informational content....

TikTok's platform embeds trackers from Google Analytics, Facebook Pixel, Microsoft Bing, LinkedIn, Reddit, and its own TikTok Pixel, and operates a consent management system that is supposed to block these trackers until user consent is obtained. However, the technical rules in the page source show ...

Why it matters: If third-party advertising and analytics trackers fire before you have given consent, your browsing data — including your visit to TikTok's own safety and privacy pages — may be shared with Google, Meta, Microsoft, and LinkedIn without your knowledge or agreement....

TikTok reserves the right to remove content or suspend accounts that violate its Community Guidelines, which are enforced through a combination of automated systems and human reviewers. Users whose content is removed or accounts suspended can submit an appeal through the in-app process....

Why it matters: TikTok's moderation systems — both automated and human — can remove your content or restrict your account, which can significantly impact creators, businesses, and individuals who rely on the platform for income or communication....

TikTok's Trust & Safety framework includes specific policies for users under 13 and under 18, including age-gating, restricted content settings for minors, and parental controls. These reflect TikTok's obligations under COPPA and international child safety laws....

Why it matters: TikTok has a documented history of COPPA violations and has been subject to regulatory enforcement actions specifically concerning children's data; the adequacy of its age verification and parental consent mechanisms remains a live compliance issue....

TikTok's platform JavaScript includes calls to the browser's geolocation API (getCurrentPosition and watchPosition), enabling the collection of precise GPS-level location data from users' devices. The watchPosition function enables continuous location tracking, not just a single location lookup....

Why it matters: Continuous or repeated collection of precise geolocation data is considered sensitive personal data in most jurisdictions and requires explicit consent; the presence of watchPosition in TikTok's web infrastructure indicates the platform may track your location over time, not just at the moment you a...

TikTok's web platform code monitors clipboard read and write operations (navigator.clipboard.read, readText, write, and writeText APIs), meaning TikTok may be able to access text or data that you have copied to your device's clipboard from any application....

Why it matters: Clipboard data can contain highly sensitive information including passwords, bank account numbers, personal messages, or confidential documents copied from other apps, and monitoring clipboard access has previously been identified as a significant privacy risk in TikTok's mobile app....

TikTok's Trust & Safety hub includes a Transparency section that publishes reports on government data requests, content removals, and platform enforcement actions. These reports are intended to demonstrate accountability under applicable regulatory frameworks....

Why it matters: Transparency reports are a key accountability mechanism for large platforms; the completeness and accuracy of TikTok's transparency reporting is subject to DSA obligations and is a material factor in ongoing regulatory scrutiny of the platform....

If you have a dispute with Hulu, you cannot take them to court — you must resolve it through private arbitration on an individual basis. This means you also cannot join a class action lawsuit with other affected subscribers....

Why it matters: Arbitration eliminates your right to a jury trial and class action participation, which are the most powerful tools consumers have against large companies; individual arbitration is costly and rarely pursued, effectively limiting corporate accountability....

You agree that you will never participate in a class action lawsuit or class-wide arbitration against Hulu, Disney+, or ESPN — every dispute must be handled individually....

Why it matters: Class actions are the primary mechanism by which consumers collectively hold large corporations accountable for widespread but individually small harms such as overbilling or deceptive advertising; waiving this right effectively makes it economically irrational to pursue many legitimate claims....

Your Hulu subscription automatically renews every billing period and Hulu explicitly states it will not send you a notice before your free trial ends or before your subscription renews — you are responsible for tracking your own renewal dates....

Why it matters: Consumers who forget they have a free trial or subscription will be automatically charged without any reminder, and because Hulu does not provide pre-renewal notices (except where legally required), many subscribers are billed without expectation....

Hulu collects and may share your personal information, viewing data, and usage information as described in its Privacy Policy, which is incorporated into this Agreement by reference....

Why it matters: Video streaming services like Hulu collect detailed records of everything you watch, which is protected by the Video Privacy Protection Act — understanding what data is shared and with whom is critical to protecting your viewing privacy....

US and Canadian users must resolve any disputes with Taskrabbit through individual binding arbitration rather than going to court. You also waive the right to participate in a class action lawsuit against Taskrabbit....

Why it matters: This clause eliminates your ability to sue Taskrabbit in court or join other users in a class action, which is often the only practical avenue for redress when individual claim amounts are small....

Taskrabbit's total financial liability to you for any claim is capped at the greater of the fees you paid in the prior 12 months or $100 USD, regardless of the nature or severity of the harm....

Why it matters: If a Tasker causes significant property damage, personal injury, or other serious harm facilitated through the platform, this clause prevents you from recovering more than a nominal amount from Taskrabbit — even if the platform's conduct contributed to the harm....

Taskrabbit states that Taskers are independent contractors — not employees — of Clients, and that Taskrabbit itself is not an employer of any user. Taskers are responsible for all their own taxes, insurance, and legal compliance....

Why it matters: This classification determines whether Taskers receive employment protections (minimum wage, workers' compensation, benefits), and places all tax and compliance obligations on Taskers — but regulators in California, the UK, and EU have challenged similar classifications by gig economy platforms....

Taskrabbit uses labels like 'background checked', 'vetted', 'elite', and 'reliable' to describe Taskers, but the Terms state these labels only mean the Tasker completed a registration process — not that Taskrabbit endorses, certifies, or guarantees anything about the Tasker's skills, safety, or suit...

Why it matters: Consumers may reasonably rely on trust-signaling language like 'vetted' and 'background checked' when inviting strangers into their homes, but this clause discards any legal responsibility that such language would normally imply....

If you have a dispute with Redfin, you must resolve it through private arbitration — not in a public court — unless you opt out within 30 days of accepting these Terms. Arbitration is conducted under American Arbitration Association (AAA) Consumer Arbitration Rules....

Why it matters: Arbitration removes your ability to have a judge or jury hear your case in a public courtroom, and typically makes it harder and more expensive for individuals to pursue claims against large companies....

You agree that you cannot join any class action lawsuit or class arbitration against Redfin — every dispute must be handled individually, even if many other users have the same complaint....

Why it matters: Class actions allow many consumers harmed in the same way to pool resources and sue together, which is often the only practical way to hold large companies accountable for widespread small-value harms. This waiver eliminates that option....

Headspace collects highly sensitive personal information including mental health history, therapy and psychiatry session content, mood and stress data, and meditation habits across its platform. This data is collected both directly from users and inferred from usage patterns....

Why it matters: Mental health data is among the most sensitive categories of personal information and its misuse or breach could cause serious harm to users' employment, insurance, and personal relationships....

Headspace shares user data — including data inferred from mental health app usage — with third-party advertising networks, analytics providers, and business partners to serve targeted advertising and measure marketing effectiveness....

Why it matters: The use of mental health and wellness behavior data for advertising purposes goes beyond what most users would expect, and may constitute a 'sale' or 'sharing' of sensitive personal information under California law, triggering opt-out rights....

Headspace states it is subject to HIPAA as a business associate of its Care Providers (who provide therapy and psychiatry services), but data collected through the general wellness app (meditation, mood tracking) is NOT covered by HIPAA — two different legal regimes apply to different data on the sa...

Why it matters: Most users will not understand that their therapy session data has HIPAA protections but their meditation and mood data on the same app does not — this creates a significant risk that users believe all their health data is protected when it is not....

California residents have the right to opt out of the sale or sharing of their personal information, limit the use of sensitive personal information (including health data), and request access, correction, or deletion of their data under the California Privacy Rights Act....

Why it matters: California law gives Headspace users specific enforceable rights over their sensitive mental health and wellness data, including the right to stop Headspace from sharing it with advertisers....

EU and UK users have rights under GDPR and UK GDPR to access, correct, delete, restrict processing of, and port their personal data, as well as the right to object to processing and to withdraw consent at any time....

Why it matters: EU and UK users benefit from strong statutory data rights over their sensitive health and wellness data, and can compel Headspace to stop processing their data or provide a copy of all information held about them....

When you post anything on Reddit — text, images, video, or other content — you grant Reddit a permanent, royalty-free, irrevocable license to use, copy, modify, distribute, and create derivative works from that content across any media, even if you later delete it or close your account....

Why it matters: This clause means Reddit can commercially exploit everything you post indefinitely, including potentially using your content to train AI systems or for advertising, without paying you or asking for further permission....

If you have a dispute with Reddit, you must resolve it through binding individual arbitration rather than going to court, and you cannot participate in a class-action lawsuit against Reddit....

Why it matters: This clause strips you of your right to sue Reddit in court or join other users in a collective legal action, which significantly reduces your practical ability to seek redress for widespread harms....

Reddit can change these Terms of Service at any time by posting the updated terms on the site, and your continued use of Reddit after changes are posted means you have accepted the new terms....

Why it matters: Reddit can modify your legal rights and obligations without direct notification or your affirmative agreement — simply continuing to use the platform is treated as acceptance of potentially materially different terms....

Reddit prohibits users under the age of 13 from creating accounts or using the platform, and users aged 13-17 may only use Reddit with parental consent and subject to additional restrictions....

Why it matters: If a child under 13 uses Reddit, the platform is not legally authorized to collect their data under COPPA, but the ToS places enforcement burden on users and parents rather than Reddit implementing robust age verification....

Reddit's liability to you is capped at $100 or the amount you paid Reddit in the past six months, whichever is greater, and Reddit excludes liability for indirect, incidental, or consequential damages including data loss....

Why it matters: Even if Reddit causes you significant harm — such as wrongful account termination, data breach, or loss of content — you can only recover a maximum of $100 or your recent subscription payments, which may be far less than your actual loss....