Provisions index

Operators must disclose to affected individuals that AI was involved in producing any High-risk AI Recommendation delivered to them or used to make a decision about them, though they are not required to identify the specific AI system or provider....

Why it matters: This provision establishes a mandatory disclosure obligation at the point of AI-assisted decision delivery in high-risk domains, creating an operational requirement for operators to implement consumer-facing disclosure mechanisms in workflows involving legal, medical, financial, employment, housing, and related decisions....

View provision → Watch Anthropic →

Operators deploying consumer-facing chatbots or AI agents built on Claude must disclose to users at the start of each chat session, or in the product interface, that they are communicating with AI rather than a human; the disclosure need not name Anthropic or the specific model....

Why it matters: This provision establishes a session-level or interface-level disclosure obligation for all consumer-facing Claude-powered chatbot deployments, creating an operational requirement for operators to implement disclosure mechanisms in product UI or chat initiation flows....

View provision → Watch Anthropic →

Anthropic reserves the right to warn, throttle, limit, suspend, or terminate any user's access upon suspected AUP violation, and operates real-time output safeguards that may block specific outputs independently of whether a formal AUP violation has occurred....

Why it matters: This provision establishes that enforcement action may be taken on suspicion of violation without a confirmed finding, and that real-time blocks do not constitute AUP violations, distinguishing between automated safeguard responses and formal enforcement decisions....

View provision → Watch Anthropic →

Operators who build or deploy agentic AI systems using Claude are responsible for ensuring that all actions those agents take through connected tools, browsers, or external systems comply with the AUP, extending operator accountability to agent-initiated downstream actions....

Why it matters: This provision allocates AUP compliance responsibility to the operator for the full scope of actions taken by Claude-powered agents in agentic deployments, including tool use, browser interactions, and connected system actions, which extends compliance obligations beyond direct model prompting to autonomous agent behavior....

View provision → Watch Anthropic →

The policy states that Claude conversation inputs and outputs may be used to train Anthropic's AI models, with an opt-out available in account settings. The opt-out does not apply to content that has been flagged for safety review or that the user has explicitly reported through feedback mechanisms....

Why it matters: This provision establishes a conditional opt-out structure in which the stated right to exclude conversational data from model training is subject to exceptions that activate when content is flagged by Anthropic's systems or reported by the user. Compliance teams should assess whether this structure satisfies informed consent and data minimization requirements under GDPR and CCPA, particularly whether the exceptions are disclosed with sufficient prominence at the point of opt-out....

View provision → Watch Anthropic →

The policy states that using a work or organizational email address to create an Anthropic account may result in the account being linked to that organization's enterprise account, potentially making account data accessible to organizational administrators....

Why it matters: This provision establishes that individual consumer accounts created with employer-owned email addresses may be administratively linked to enterprise accounts, which could affect the privacy expectations of individual employees and require organizations to assess their data governance obligations with respect to employee use of Claude.ai....

View provision → Watch Anthropic →

The policy states that when third-party integrations are enabled, Claude may transmit inputs, outputs, and instructions to those third-party services, which then process the data under their own privacy policies. Anthropic expressly disclaim responsibility for third-party data practices. Some integrations may enable ongoing third-party access until the user disables them....

Why it matters: This provision establishes that enabling third-party integrations results in data flows to third parties outside Anthropic's privacy policy coverage, with ongoing access possible until the user affirmatively disables the integration. The policy places responsibility for reviewing third-party privacy policies on users prior to enabling integrations....

View provision → Watch Anthropic →

The policy states that Anthropic's services are not directed at users under 18 and that Anthropic does not knowingly collect data from minors under 18. The policy states that detection and removal measures are in place and provides a reporting mechanism for known minor data collection....

Why it matters: This provision establishes a minimum age of 18 for use of Anthropic's consumer services, which is above the 13-year threshold established by COPPA for U.S. platforms. The policy's statement that detection measures are in place may be relevant to regulatory assessments of whether Anthropic's age assurance practices are adequate under applicable law....

View provision → Watch Anthropic →

The policy establishes a rights exercise process requiring identity verification and, for third-party representatives, evidence of authorization. Response timelines are stated to follow applicable law, with GDPR and UK GDPR requests acknowledged within one calendar month and extendable by two months for complex requests....

Why it matters: This provision establishes the procedural requirements for exercising data subject rights under Anthropic's policy, including identity verification requirements that apply to all requests and authorization evidence requirements for third-party representatives. The policy notes that processes for acting on training dataset requests are complex, which may affect the practical ability to fulfill deletion or correction requests involving data used in AI model training....

View provision → Watch Anthropic →

The guidelines require all users who post content that promotes a product, brand, or business to use TikTok's proprietary content disclosure setting; this obligation applies regardless of whether the promotion is paid or organic....

Why it matters: This provision requires affirmative use of a platform-specific disclosure mechanism for any promotional content, establishing a compliance obligation that interacts with FTC endorsement and disclosure guidance applicable to influencers, creators, and business accounts operating in the US market....

View provision → Watch TikTok →

The guidelines require creators to apply clear labels to content where AI or editing tools are used to realistically depict people or scenes, and prohibit AI-generated content that misleads on matters of public importance or harms individuals....

Why it matters: This provision establishes an affirmative disclosure obligation for AI-assisted content depicting people or scenes, and creates a separate prohibition on misleading AI-generated content, with both requirements subject to platform enforcement including content removal....

View provision → Watch TikTok →

The guidelines establish three operationally distinct enforcement responses to content: outright removal for prohibited content, age-restriction limiting viewership to adults for certain content, and exclusion from the For You Feed recommendation system without removal for other content categories....

Why it matters: The three-tier system means that content may be subject to reduced distribution through FYF exclusion without triggering account-level enforcement or removal, creating a distinct operational outcome that affects creator reach and monetization without constituting a formal violation finding....

View provision → Watch TikTok →

The guidelines prohibit trade, marketing, or facilitation of access to regulated, prohibited, or high-risk goods and services for general users, but create an exception permitting verified business accounts and verified TikTok Shop sellers to sell or market certain regulated items subject to criteria described only as 'strict requirements.'...

Why it matters: The carve-out for verified sellers creates a tiered access system for regulated goods categories, but the specific eligibility criteria are not disclosed in this document, creating a disclosure gap for sellers seeking to understand their compliance obligations and eligibility status....

View provision → Watch TikTok →

The guidelines prohibit misinformation that could cause significant harm to individuals or society, and specifically prohibit content that could mislead voters or interfere with elections, including false claims about voting procedures, eligibility, or election outcomes....

Why it matters: These provisions establish platform-level content removal authority over a broad category of information-related content, with the operative threshold of 'significant harm' undefined in the document, creating interpretive discretion in enforcement that may affect political, journalistic, and public interest content....

View provision → Watch TikTok →

The guidelines prohibit sharing personal information that could lead to harms including identity theft, stalking, or fraud, and separately prohibit any attempts to hack, reverse-engineer, or compromise TikTok's platform systems....

Why it matters: These provisions establish content removal authority over doxing and related privacy-harming disclosures, and create a platform-level prohibition on security research or reverse-engineering activities, the latter of which may interact with security researcher safe harbor expectations and applicable computer fraud statutes....

View provision → Watch TikTok →

The guidelines prohibit accounts that engage in deceptive behavior or attempt to manipulate the platform, and prohibit the trade of services designed to artificially boost engagement metrics or circumvent the recommendation algorithm....

Why it matters: This provision creates account-level enforcement exposure for users who purchase or sell engagement-boosting services, and applies to both the accounts purchasing such services and those providing them, with implications for influencer marketing practices and platform eligibility....

View provision → Watch TikTok →

The GLBA Notice discloses that Kraken shares personal information with affiliates for everyday business purposes and marketing, and authorizes marketing by affiliates, with opt-out rights available for affiliate marketing sharing and creditworthiness sharing but not for sharing for everyday business purposes or affiliates' everyday business purposes regarding transactions and experiences....

Why it matters: This provision establishes the scope of permissible financial information sharing under GLBA and specifies which sharing categories are subject to consumer opt-out. Sharing for everyday business purposes, including with affiliates for transaction and experience information, is stated as non-restrictable, while affiliate marketing sharing and creditworthiness sharing with affiliates are opt-outable....

View provision → Watch Kraken →

The provision states that residents of nineteen named states have privacy rights including access, deletion, correction, portability, and opt-out of targeted advertising, sales, and profiling, with specific exclusions for Iowa and Utah regarding correction and profiling opt-out rights....

Why it matters: This provision acknowledges a multi-state privacy rights framework applicable to residents of nineteen states, establishing that Kraken recognizes and will process rights requests under these laws. The provision's acknowledgment that rights may vary by state, and its specific exclusions for Iowa and Utah, indicates operational differentiation in rights response workflows....

View provision → Watch Kraken →

The policy states that state-law privacy rights such as data access, deletion, and correction do not apply to Nonpublic Personal Information that is subject to GLBA, which includes financial account data, transaction records, and other information collected in connection with financial products or services....

Why it matters: This provision establishes that a significant portion of the personal information Stash collects from financial services customers, specifically Nonpublic Personal Information as defined in Section 2.2, falls outside the scope of state privacy rights frameworks, which may limit the practical scope of consumer data access and deletion requests for financial customers....

View provision → Watch Stash →

The policy states that by providing a phone number, users consent to automated and prerecorded calls and texts from Stash, and acknowledges that users may incur charges for receiving such communications; consent to informational text messages may be revoked by replying STOP....

Why it matters: This provision conditions platform phone number provision on consent to automated dialing and prerecorded messaging under the TCPA, and the terms acknowledge the possibility that users may incur costs from receiving these communications; the opt-out mechanism is limited to text messages and does not explicitly address revocation of consent to automated calls....

View provision → Watch Stash →

The policy reserves Stash's right to modify the privacy policy at any time, with material changes communicated by email or platform notice; continued use of the platform after changes constitutes acceptance, and if a user does not agree to changes, Stash reserves the right to terminate the relationship....

Why it matters: This provision establishes that continued use of the Stash platform following a policy change constitutes acceptance of revised terms, and separately states that Stash may terminate the user relationship if the user declines to accept future changes; for a financial services platform where account closure may affect ongoing investment positions, this termination right has operational significance....

View provision → Watch Stash →

Guideline 5.1.1(ii) requires apps to obtain user consent before collecting any user or usage data, including data considered anonymous at collection, and prohibits conditioning paid functionality on consent to data collection. Apps must provide a mechanism for users to withdraw consent and must describe data use clearly in purpose strings....

Why it matters: This provision requires consent for data collection regardless of whether the data is classified as anonymous at the time of collection, which is a broader consent trigger than some regulatory frameworks apply. The prohibition on conditioning paid functionality on data access consent establishes a platform-level data minimization standard applicable to all App Store apps....

View provision → Watch Apple →

Guideline 4.8 requires that any app using a third-party social login for primary account authentication must also offer an alternative login option that limits data collection to name and email, permits email privacy, and does not collect app interaction data for advertising without consent. Sign In with Apple satisfies these requirements....

Why it matters: This provision effectively requires that Sign In with Apple or an equivalent privacy-preserving login option be offered alongside any third-party social login used for primary account authentication, limiting the extent to which social platforms can capture user authentication data through App Store apps. Developers using multiple social login options must verify that at least one compliant alternative is available....

View provision → Watch Apple →

The policy authorizes Google to associate activity collected across its own services and across third-party sites and apps that use Google products with a user's personal information, depending on account settings, for purposes including personalized advertising and service improvement....

Why it matters: This provision establishes the operational basis for Google's cross-service and cross-device advertising and personalization infrastructure, affecting how data collected across Search, YouTube, Gmail, and third-party integrated sites is linked to individual accounts....

View provision → Watch Google →

The policy states that Google uses publicly available information to train its AI models for products including Google Translate, Gemini Apps, and Cloud AI capabilities....

Why it matters: This provision discloses that publicly available information is used as training data for Google's AI systems, including Gemini Apps and Cloud AI, without specifying the categories of publicly available information collected or the consent mechanisms applicable to individuals whose publicly available data may be included....

View provision → Watch Google →

The policy discloses that third-party websites and apps using Google advertising or analytics services share user activity data with Google regardless of browser mode, including when users are browsing in Chrome Incognito mode....

Why it matters: This provision establishes that Incognito mode does not prevent third-party sites using Google services from sharing activity data with Google, which is operationally significant for users who rely on Incognito mode as a privacy measure when visiting third-party sites....

View provision → Watch Google →

The policy discloses that for users on organizational Google accounts, domain administrators and resellers have access to account data including email content, can change passwords, suspend account access, and can restrict the user's ability to delete or edit information or privacy settings....

Why it matters: This provision establishes that users operating under organizational Google accounts, including students using Google Workspace for Education and employees using Google Workspace, have reduced personal control over their account data and privacy settings relative to individual consumer accounts....

View provision → Watch Google →

The policy states that deleted data may persist in Google's active and backup systems for an unspecified period before complete removal, and that retained data may be kept in anonymized form rather than deleted entirely in some circumstances....

Why it matters: This provision establishes that user-initiated deletion requests do not result in immediate removal from all Google systems, and that some data may be retained in anonymized form, which has implications for compliance with data subject deletion rights under GDPR and U.S. state privacy laws....

View provision → Watch Google →

The policy authorizes collection of precise location data from GPS, IP address, Wi-Fi access points, cell towers, and Bluetooth-enabled devices, and states this data is used for service delivery and for advertising based on a user's location....

Why it matters: This provision establishes that Google collects multiple categories of location data, potentially including precise GPS coordinates as well as inferred location from network infrastructure, and authorizes use of that data for targeted advertising, subject to device and account settings....

View provision → Watch Google →

The policy asserts that Google does not sell personal information and does not share personal information as defined under CCPA, and states that anonymization policies and technical measures are in place to prevent re-identification of anonymized data....

Why it matters: This provision makes an explicit legal assertion under CCPA that Google does not sell or share personal information as defined by the statute, which affects the scope of opt-out rights available to California consumers and the regulatory obligations applicable to Google's advertising data practices under CCPA....

View provision → Watch Google →

The policy discloses that Google may collect biometric information including fingerprints when users choose to participate in Google product development studies....

Why it matters: Biometric data collection is subject to specific statutory requirements in multiple U.S. states, most notably Illinois BIPA, which imposes written consent, retention schedule, and destruction requirements independent of general privacy law frameworks....

View provision → Watch Google →

The policy states that user data may be processed on servers outside the user's country of residence, and asserts that Google applies consistent protections regardless of processing location and complies with applicable data transfer legal frameworks....

Why it matters: Cross-border data transfer compliance is a significant operational and legal requirement for organizations processing personal data of EU and EEA residents, requiring legally recognized transfer mechanisms such as Standard Contractual Clauses or adequacy decisions under GDPR....

View provision → Watch Google →

The policy authorizes disclosure of User Data and Usage Data to advertising partners for ad delivery and effectiveness measurement, and to marketing partners for promotions and advertising on third-party online services, with an exception prohibiting disclosure to advertising partners for users under age 18....

Why it matters: This provision establishes that personal data is disclosed to both advertising and marketing partner categories, and that marketing partners may combine disclosed data with other data they independently hold about the user, which has implications for the downstream use of that data beyond Spotify's control....

View provision → Watch Spotify →

The policy discloses that Spotify collects audio recordings of users' voices when voice features are available in the user's market and the user chooses to use those features, and this voice data is used for service provision, AI model development, and legal compliance purposes....

Why it matters: Voice data is classified as a sensitive or biometric data category under several state privacy laws, and its collection and use for AI model training purposes described elsewhere in the policy creates heightened compliance obligations in jurisdictions with biometric privacy statutes....

View provision → Watch Spotify →

Spotify may modify these Terms by providing notice through reasonable means, including posting to the service, with supplemental notice for material changes. Continued use of the Spotify Service after a change constitutes acceptance of the updated terms. Premium subscribers who do not accept updated terms must close their account before their renewal date or within thirty days of the effective date, whichever is earlier....

Why it matters: This provision establishes that continued use of the Spotify Service following any terms update constitutes acceptance of the revised terms, and sets a specific thirty-day or renewal-date window for premium subscribers to exit without being bound by updated terms. The mechanism for material changes includes email and in-service notification, but the standard for what constitutes a material change is not defined in the document....

View provision → Watch Spotify →

By using the Spotify Service, users grant Spotify the right to use their device's processor, bandwidth, and storage hardware for service operation, to deliver advertising and information to users, and to allow Spotify's business partners to deliver advertising and information to users through the same device access....

Why it matters: This provision establishes that Spotify and its business partners are authorized to use device resources (processor, bandwidth, storage) and to deliver advertising to users. The scope of 'business partners' and 'other information' is not defined in this provision, and the Privacy Policy incorporated by reference governs the associated data practices....

View provision → Watch Spotify →

Users agree to indemnify Spotify and hold it harmless from all damages, losses, and expenses, including attorneys' fees, arising from the user's breach of the Terms, any User Content posted, any activity conducted on the service, or any violation of law or third-party rights....

Why it matters: This provision establishes a broad user indemnification obligation covering any activity engaged in on or through the Spotify Service, not limited to clear terms violations. The scope of category (3) (any activity on the service) is potentially broad and may create indemnification exposure in contexts where the user's activity is not itself a breach of the Terms....

View provision → Watch Spotify →

The terms require users to be at least eighteen years old, or between thirteen and seventeen with parental or guardian consent. Users must also represent that they reside in the United States and that registration information is accurate. The document does not describe the mechanism by which Spotify verifies age or obtains and records parental consent....

Why it matters: This provision establishes that users aged thirteen to seventeen are permitted to use the service with parental consent, engaging COPPA compliance obligations for users under thirteen and creating age verification and parental consent documentation questions for the thirteen-to-seventeen cohort. The absence of a described consent verification mechanism in the Terms is operationally relevant for compliance assessments....

View provision → Watch Spotify →

The policy prohibits using OpenAI services to aggregate, monitor, profile, or distribute individuals' private or sensitive information without their authorization, in addition to the specific biometric and likeness prohibitions enumerated separately....

Why it matters: This provision establishes a general prohibition on privacy-compromising use cases that applies across all information types, supplementing the specific biometric and categorical prohibitions with a broad restriction on unauthorized aggregation, monitoring, and distribution of personal information....

View provision → Watch OpenAI →

The policy prohibits using OpenAI services for deceit, fraud, scams, spam, impersonation, academic dishonesty, and political campaigning, lobbying, or any form of foreign or domestic election interference or demobilization activities....

Why it matters: This provision explicitly prohibits election interference and demobilization activities, including domestic political campaign automation, which has direct operational relevance for political advertising platforms, campaign technology vendors, and media organizations deploying OpenAI services....

View provision → Watch OpenAI →

Effective November 1, 2026, the updated terms clarify that Roblox acts as the principal distributor and merchant of record for all platform purchases, meaning all content transactions are between the user and Roblox rather than between users and individual creators....

Why it matters: This structural clarification, effective November 2026, repositions Roblox as the legal counterparty for all content transactions on the platform, which has implications for consumer protection obligations, tax remittance, refund liability, and the application of consumer law rights against Roblox rather than individual creators....

View provision → Watch Roblox →

The agreement limits Roblox's liability to the maximum extent permitted by law, excluding all categories of damages including direct, indirect, special, incidental, exemplary, and consequential losses arising from commerce features and third-party transactions....

Why it matters: This provision limits the categories of recoverable damages available to users for losses connected to commerce provider transactions and platform features, subject to the constraints of applicable law in each jurisdiction....

View provision → Watch Roblox →

The policy discloses that PayPal generates inferred data including gender, income estimates, creditworthiness assessments, fraud risk scores, and behavioral preferences derived from transactions, service interactions, and interactions with Partners and Merchants....

Why it matters: This provision establishes that PayPal creates derived data profiles, including income and creditworthiness inferences, from user transaction and behavioral data; these inferred profiles may then be used in Automated Decision Making or shared with Partners and Merchants as part of the personalized shopping framework, creating a data derivation and downstream sharing chain with potential regulatory implications....

View provision → Watch PayPal →

The policy states that Personal Information is retained for the duration of the user relationship plus 10 years after the relationship ends, with extensions permitted for legal obligations, AML compliance, litigation, investigations, and audit purposes....

Why it matters: A standard 10-year post-relationship retention period is stated for all Personal Information categories, with open-ended extensions for legal and compliance purposes. This retention framework may require evaluation against GDPR's data minimization and storage limitation principles for EEA users, and against state privacy law deletion rights for US users who submit deletion requests after closing their accounts....

View provision → Watch PayPal →

The policy states that PayPal collects Personal Information from individuals who do not have a PayPal account when they use Pay without a PayPal Account, Braintree, Fastlane, or receive payments via Visa+, Hyperwallet, or third-party networks, and may associate that pre-account transaction data with a PayPal account if one is later created....

Why it matters: This provision establishes that PayPal's data collection scope extends to individuals who have not established a PayPal account and have not agreed to PayPal's terms of service, with subsequent association of pre-account transaction data to accounts created later. This retroactive data association may have implications for the adequacy of notice and consent at the time of original data collection....

View provision → Watch PayPal →

The policy states that PayPal transfers Personal Information internationally and that by using the services, users in jurisdictions where such consent is permitted agree to cross-border data transfers including to countries with different data protection standards. For EU users, intra-company Binding Corporate Rules and Standard Contractual Clauses are cited as transfer mechanisms....

Why it matters: The policy's use of 'by using our Sites and Services, where permitted under applicable privacy laws, you agree to your Personal Information being transferred' as a transfer consent mechanism may require evaluation under GDPR, which does not recognize general terms-of-service consent as a valid transfer mechanism for Article 46 purposes; instead, specific transfer mechanisms such as adequacy decisions, SCCs, or BCRs are required....

View provision → Watch PayPal →

X reserves the right to suspend or terminate accounts if it reasonably believes any of five specified conditions apply, including 'risk or possible legal exposure' and commercial inviability, and may also terminate for any other reason or no reason at its convenience to the extent permitted by law....

Why it matters: This provision authorizes termination not only for Terms violations but also for circumstances such as risk of legal exposure to X or commercial inviability, and includes a general convenience termination right. The EU/EFTA/UK version does not include the explicit 'any other reason or no reason at our convenience' clause and instead lists enumerated reasons for termination....

View provision → Watch X →

For non-EU/EFTA/UK users, Texas law governs all disputes and users must bring all claims exclusively in federal or state courts in Wichita County or Tarrant County, Texas, waiving any objection to those venues as inconvenient....

Why it matters: This provision requires all non-EU/EFTA/UK users to litigate disputes in Wichita County or Tarrant County, Texas, regardless of the user's location, and waives inconvenient forum objections. The provision explicitly extends to patent disputes and applies to disputes involving US corporate affiliates including SpaceXAI, Cursor, and SpaceX entities....

View provision → Watch X →

Users grant X a worldwide, royalty-free, sublicensable license to use, reproduce, adapt, modify, distribute, and display their content across all current and future media formats for any purpose, including sublicensing to third parties....

Why it matters: The license is granted for 'any purpose' across 'any and all media or distribution methods now known or later developed,' including the right to sublicense. The EU version includes a limiting clause stating that if users have chosen to restrict content distribution to a restricted community, X will respect that choice, which the non-EU version does not include in equivalent terms....

View provision → Watch X →

X's total liability for any claim is capped at the greater of $100 USD or the amount the user paid X in the prior six months for the relevant Services. Indirect, incidental, special, consequential, and punitive damages are excluded to the maximum extent permitted by law....

Why it matters: The aggregate liability cap of $100 USD or six months of paid fees applies across all theories of liability including warranty, contract, statute, and tort, and excludes loss of data, goodwill, revenues, and profits. The EU version states only that liability is 'limited to the maximum extent permissible in your country of residence' without specifying a dollar amount....

View provision → Watch X →