-
Instacart
· Instacart Privacy Policy
Instacart states it sells and shares certain categories of your personal information, including to advertising partners, and provides an opt-out mechanism for California residents and others....
Why it matters: The policy explicitly acknowledges that personal information is sold and shared within the meaning of CCPA, which means your purchase history, device identifiers, and browsing behavior may be transferred to third-party advertising and analytics companies....
-
Instacart
· Instacart Privacy Policy
Instacart operates a program through which aggregated and potentially de-identified purchase and behavioral data from its platform is licensed to consumer packaged goods brands and retail partners for advertising and market research purposes....
Why it matters: The Retail Data program means that your grocery purchase patterns and related behavioral data may be licensed to the brands whose products you buy, enabling those brands to target you with advertising based on your Instacart shopping history....
-
Instacart
· Instacart Privacy Policy
When you use Instacart to order prescription medications, the policy contains specific provisions governing how prescription-related personal information is collected, used, and disclosed, separate from standard order data....
Why it matters: Prescription data is among the most sensitive categories of personal information; the policy's separate treatment of this data category signals distinct handling obligations, but the applicable protections depend on whether Instacart qualifies as a HIPAA-covered entity or business associate in this context....
-
Instacart
· Instacart Privacy Policy
California residents have specific rights under CCPA and CPRA, including the right to know what personal information is collected and how it is used, the right to delete their data, the right to opt out of sale and sharing, and the right to limit use of sensitive personal information....
Why it matters: The California supplemental disclosures section provides the most detailed account of what data Instacart collects and shares with third parties, and it is the section most relevant to consumers who want to understand and exercise rights over their personal information....
-
Roblox
· Roblox Privacy and Cookie Policy
Roblox may ask you to take a selfie or provide a facial image to verify your age. The policy states this image is deleted after the age check is finished....
Why it matters: Facial images are sensitive biometric-adjacent data. The policy's assertion that images are deleted post-process may not resolve all legal obligations depending on the jurisdiction, particularly under laws that treat facial geometry or images used for identification purposes as biometric data requiring explicit consent....
-
Monitoring
These provisions have changed before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
-
Roblox
· Roblox Privacy and Cookie Policy
Even for children under 13, Roblox collects technical data like IP addresses and device IDs that can identify a child's device or household, and uses this data for purposes including serving contextual ads....
Why it matters: Under COPPA, persistent identifiers collected from children under 13 that can be used to recognize a child across platforms or over time are treated as personal information. The use of persistent identifiers for contextual advertising, even frequency capping, requires careful alignment with COPPA's internal operations exception....
-
Steam
· Steam Subscriber Agreement
When you buy a game or other digital content on Steam, you are purchasing a license to access it, not permanent ownership. Valve can revoke that license if your account is suspended or terminated....
Why it matters: This means your entire Steam game library could become inaccessible if Valve terminates your account, regardless of how much money you have spent....
-
Steam
· Steam Subscriber Agreement
US-based Steam users must resolve most disputes with Valve through private arbitration rather than court, and cannot join class action lawsuits against Valve....
Why it matters: This provision significantly limits your ability to pursue legal action against Valve collectively with other affected users, which is often the only economically practical route for smaller individual claims....
-
Steam
· Steam Subscriber Agreement
Valve can terminate your Steam account for violating the agreement, and because your account is non-transferable, you cannot sell or give away your games or account to anyone else....
Why it matters: Account termination means loss of access to all games, content, and wallet balance associated with that account, with no ability to transfer those assets to another person or account....
-
StockX
· StockX Privacy Policy
If you sell items on StockX, the company may ask you to provide a government-issued ID such as a passport or driver's license as part of verifying who you are....
Why it matters: Government-issued ID is among the most sensitive categories of personal data and its collection by a consumer marketplace creates heightened security and misuse risks if not properly protected....
-
StockX
· StockX Privacy Policy
StockX shares your personal information including browsing and purchase behavior with major advertising companies like Meta (Facebook/Instagram), Google, TikTok, and Amazon so those platforms can show you targeted ads....
Why it matters: This means your shopping habits and personal details from StockX are being shared with some of the largest data brokers and advertising networks in the world, which can result in highly targeted advertising following you across the internet....
-
Minecraft
· Minecraft End User License Agreement
Mojang can suspend or permanently remove your account if they determine you have violated their Community Standards or this EULA, with appeal details found at a separate page....
Why it matters: A permanent ban means losing access to all purchased Minecraft games and Realms subscriptions, as account access is required to use the Services on Microsoft platforms....
-
Minecraft
· Minecraft End User License Agreement
Parents or guardians are legally responsible for creating Microsoft accounts and accepting terms on behalf of minor children who use Minecraft....
Why it matters: This clause places the legal responsibility for minors' account terms on parents, but does not specify how Mojang or Microsoft verifies parental consent, which is critical under COPPA for children under 13....
-
Coursera
· Coursera Terms of Use
If you have a dispute with Coursera, you must resolve it through private arbitration rather than by suing in court, and you cannot join a class action lawsuit with other users. This applies to nearly all disputes about your account, payments, or the service....
Why it matters: Arbitration clauses limit your ability to use the court system, and class action waivers mean users cannot pool together to challenge Coursera's practices collectively, which is often the only practical way to address widespread but individually small harms....
-
Roblox
· Roblox Privacy Policy
Roblox does not show personalized ads to anyone under 18, and children under 13 only see contextual ads (ads not based on their personal data). Users between 13 and 17 may see non-personalized ads....
Why it matters: This provision directly governs how Roblox monetizes its large minor user base through advertising and establishes the age thresholds at which different advertising practices apply....
-
Roblox
· Roblox Privacy Policy
Roblox may collect a selfie or facial image from you to verify your age. The policy states this image is deleted after the age check is complete, but the collection of facial imagery is a form of biometric data processing....
Why it matters: Facial imagery used for age estimation constitutes biometric data in many jurisdictions, triggering specific legal requirements around consent, disclosure, and deletion that go beyond standard privacy obligations....
-
Roblox
· Roblox Privacy Policy
Children under 13 can use Roblox with a username, password, and birthdate, plus an optional gender. Roblox collects persistent identifiers like IP addresses for internal operations and states it does not use this data for behavioral advertising....
Why it matters: This provision establishes the data collection floor for Roblox's youngest users and the legal framework under which Roblox claims COPPA compliance, which is one of the most actively enforced areas of US privacy law for platforms with minor users....
-
Roblox
· Roblox Privacy Policy
Roblox shares data, including persistent identifiers like IP addresses and device IDs, with third-party service providers to run its platform and advertising systems. For users 13 and older, this can include sharing with advertising and analytics partners....
Why it matters: The scope of data sharing with advertising and analytics vendors determines how broadly your behavioral and device data flows beyond Roblox's own systems, which has direct implications for privacy and targeted advertising....
-
Midjourney
· Midjourney Terms of Service
If you have a legal dispute with Midjourney, you must resolve it through individual arbitration rather than suing in court, and you cannot join or start a class action lawsuit against the company....
Why it matters: This clause removes your ability to take Midjourney to court with other affected users as a group, which is often the only practical way consumers can pursue smaller or shared grievances against a larger company....
-
Midjourney
· Midjourney Terms of Service
When you use Midjourney, you give the company permission to use your text prompts and generated images to train its AI, worldwide and without paying you, and this license cannot be taken back....
Why it matters: Your creative prompts and the images you generate contribute to Midjourney's AI training dataset, even if you later delete your account, because the license is described as irrevocable....
-
Midjourney
· Midjourney Terms of Service
If you pay for a Midjourney subscription, you own the images you create. If you use the free plan, Midjourney owns the images and only gives you a non-commercial license to use them....
Why it matters: Free users cannot legally sell, license, or use their generated images in commercial projects because Midjourney retains ownership; this is a critical distinction for anyone using the platform for professional or monetized creative work....
-
Supabase
· Supabase Terms of Service
All disputes with Supabase must be resolved through individual arbitration, not in court, unless you send a written opt-out notice within 30 days of first accepting these terms....
Why it matters: This clause removes your default right to sue Supabase in court or join a class action, which can significantly limit your practical ability to seek redress for smaller claims or systemic issues....
-
Supabase
· Supabase Terms of Service
You give up your right to sue Supabase in court, have a jury decide your case, or join a class action lawsuit against Supabase....
Why it matters: Class actions allow large numbers of users with small individual claims to collectively seek redress; waiving this right means each user must pursue claims individually, which is often economically impractical for smaller disputes....
-
Thomson Reuters
· Thomson Reuters Terms
When you visit the Thomson Reuters website, several tracking tools are active on the page, including one that records a sample of user sessions and captures how you interact with the site. A cookie consent tool is present to manage some of these trackers....
Why it matters: Session replay technology can capture detailed behavioral data including mouse movements, clicks, and potentially form field interactions, which goes beyond standard analytics; the presence of Facebook tracking also means browsing behavior may be shared with Meta for advertising purposes....
-
Snapchat
· Snapchat Privacy Policy
Snapchat can collect your exact GPS location if you give it permission, and also estimates your general location from your IP address even without explicit permission....
Why it matters: Precise location data is among the most sensitive personal data types because it can reveal home and work addresses, religious or medical visits, and daily routines, and this data is shared with advertising partners....
-
Snapchat
· Snapchat Privacy Policy
Snapchat shares your device identifiers, hashed email, and phone number with advertising networks and data analytics companies to target ads and measure their effectiveness....
Why it matters: Sharing device identifiers and contact information with advertising networks enables cross-platform tracking and profile-building that extends well beyond Snapchat itself....
-
Snapchat
· Snapchat Privacy Policy
Snapchat is not intended for children under 13, and the company states it deletes data if it discovers it has been collected from under-13 users; teenagers aged 13-17 have some additional protections but still use the full service....
Why it matters: Given Snapchat's widespread use among teenagers, the adequacy of age verification and the specific nature of 'certain restrictions' for users aged 13-17 are material to assessing whether minors' data is adequately protected under COPPA and state children's privacy laws....
-
Snapchat
· Snapchat Privacy Policy
Snapchat collects images, videos, and associated metadata from your camera when you use the app, including content from Snaps and augmented reality Lenses that process your facial features....
Why it matters: Camera and image processing features, particularly augmented reality Lenses that map facial geometry, may generate data that constitutes biometric information under state laws such as Illinois BIPA, creating significant legal exposure....
-
TikTok
· TikTok Community Guidelines
TikTok maintains a framework for responding to law enforcement and government requests for user data, which is described in its Law Enforcement Guidelines linked from this policy hub....
Why it matters: When law enforcement requests your data, TikTok's guidelines determine what information is disclosed, under what legal standards, and whether you are notified, which directly affects your privacy and legal exposure....
-
TikTok
· TikTok Community Guidelines
TikTok maintains specific safety commitments and content restrictions for minor users, which are described across its Community Guidelines, Privacy Policy, and linked safety resources....
Why it matters: The platform's policies for users under 13 and users aged 13-17 determine what data is collected from minors, what content they can access, and what parental controls are available, which has significant implications under COPPA and equivalent laws globally....
-
Twilio
· Twilio Terms of Service
If someone sues Twilio because of how you used its services or something you did that violated the terms, you are required to pay Twilio's legal costs and any resulting damages....
Why it matters: This provision transfers significant financial and legal risk to the customer, requiring the customer to cover Twilio's defense costs and liability for claims arising from the customer's use of the platform....
-
Twilio
· Twilio Terms of Service
You are legally responsible for everything that happens through your Twilio account, including actions taken by your employees, contractors, or end users, even if you did not authorize those actions....
Why it matters: This provision places full accountability for account activity on the customer, including unauthorized third-party use, which means customers bear compliance and financial risk for how others use their Twilio-powered applications....
-
Meta Ads
· Meta Advertising Policies
Meta's advertising framework includes rules on how advertisers can target audiences, including restrictions on using sensitive personal characteristics such as race, religion, health status, or political views as targeting criteria....
Why it matters: These restrictions aim to prevent discriminatory targeting, but they also define the boundaries of what behavioral and demographic data advertisers can use — which has significant implications for both campaign effectiveness and legal compliance....
-
Redfin
· Redfin Terms of Use
If you have a legal dispute with Redfin, you generally cannot take them to court; instead, the dispute goes to a private arbitration process. There is a 30-day window to opt out of this requirement....
Why it matters: Arbitration typically favors companies over consumers because it is private, limits discovery, and removes the ability to appeal; combined with the class action waiver, this provision significantly narrows your legal remedies against Redfin....
-
Redfin
· Redfin Terms of Use
You agree not to participate in any class action lawsuit or class-wide arbitration against Redfin; any claims must be brought individually....
Why it matters: Class actions are often the only practical mechanism for consumers to pursue small-dollar claims against large companies; waiving this right means individual arbitration costs may exceed the value of any recovery....
-
Target
· Target Privacy Policy
Target may collect biometric data, such as facial geometry, when you use features like virtual try-on. In some states, Target must notify you and get your consent before collecting this data....
Why it matters: Biometric data is among the most sensitive categories of personal information. Unlike a password, it cannot be changed if compromised, and several states impose strict legal requirements on its collection, use, and storage....
-
Target
· Target Privacy Policy
Target uses your purchase history and browsing data to serve you personalized ads not only on Target's own platforms, but also across other websites and apps through its Roundel advertising business. Third-party ad companies can also track your online behavior across the internet for the same purpose....
Why it matters: Target's retail media network means your in-store and online shopping data can follow you around the internet in the form of targeted ads, and this data is shared with external advertising technology companies beyond Target's direct control....
-
Snowflake
· Snowflake Terms of Service
If something goes wrong and you want to hold Snowflake responsible, the maximum amount you can recover is limited to whatever fees you paid to Snowflake in the 12 months before your claim....
Why it matters: The agreement caps Snowflake's total financial exposure to the prior year of fees paid, regardless of the scale of data loss, service outage, or other harm; organizations with high-value or sensitive data stored on the platform should assess whether this cap is proportionate to their risk....
-
Snowflake
· Snowflake Terms of Service
Neither Snowflake nor you can sue the other for lost profits, lost data, business interruption, or other indirect losses, even if the other party knew those losses were possible....
Why it matters: The agreement explicitly excludes recovery for lost data and business interruption, which are among the most likely and significant harms that could arise from a cloud platform failure; this provision operates in tandem with the 12-month fee cap to define the outer boundary of Snowflake's financial exposure....
-
Nextdoor
· Nextdoor Privacy Policy
Nextdoor collects your neighborhood location as a condition of using the service, and may collect more precise location data with your permission, using both to serve targeted ads....
Why it matters: Your real home neighborhood is tied to your account by design, and this data is used for advertising, meaning your physical location is part of Nextdoor's ad-targeting infrastructure....
-
Nextdoor
· Nextdoor Privacy Policy
Nextdoor shares your personal data with advertising partners and business partners, including for targeted ads that may follow you to other websites and apps outside of Nextdoor....
Why it matters: Your Nextdoor activity and data may be used by third-party advertising networks to track and target you across the broader internet, not just within Nextdoor....
-
Duolingo
· Duolingo Privacy Policy
Duolingo records your voice when you use speaking exercises and uses those recordings to improve its speech recognition systems and provide pronunciation feedback....
Why it matters: Voice data is a sensitive category of personal information and is subject to specific legal protections in several US states (notably Illinois under BIPA) and under GDPR in the EU; collection for AI model improvement purposes may require explicit informed consent beyond general terms acceptance....
-
Duolingo
· Duolingo Privacy Policy
Duolingo states it does not collect personal data from children under 13 without parental consent, and will delete such data if collected accidentally, but parents must contact the company directly if they believe their child's data was collected without consent....
Why it matters: COPPA imposes strict requirements on operators of websites and apps directed at or knowingly collecting data from children under 13, including verifiable parental consent obligations; Duolingo's global reach and broad appeal to younger learners makes the adequacy of its COPPA compliance mechanisms a material regulatory consideration....
-
23andMe
· 23andMe Privacy Statement
If you agree to participate in 23andMe's research program, your genetic and health information (with your name and direct identifiers removed) may be combined with other users' data and shared with outside research partners, including pharmaceutical companies and academic institutions. You can withdraw this consent at any time, but research already done using your data cannot be undone....
Why it matters: Your genetic data is among the most sensitive personal information that exists and can reveal health risks, ancestry, and family relationships; sharing it with pharmaceutical companies, even in deidentified form, carries risks of re-identification and downstream commercial use that may not be fully visible to you at the time of consent....
-
23andMe
· 23andMe Privacy Statement
In the event of a merger, acquisition, bankruptcy, or sale of assets, your personal information including your genetic data may be transferred to a new owner as part of that transaction. The policy discloses this possibility but the document reviewed does not specify whether users will receive advance notice or a right to object before such a transfer occurs....
Why it matters: Genetic data is uniquely sensitive and permanent; if 23andMe is sold or restructured, your DNA data and health information could pass to a new corporate owner whose privacy practices and data use intentions are unknown at the time you originally consented....
-
23andMe
· 23andMe Privacy Statement
23andMe collects your genetic information from your DNA sample as well as self-reported health data, family history, traits, and behavioral information from how you use the service. This data collectively forms an unusually comprehensive personal profile....
Why it matters: Genetic data is permanent and uniquely identifying; combined with self-reported health conditions, family history, and behavioral usage data, the information 23andMe collects is among the most sensitive and irreplaceable personal data any consumer service can hold....
-
23andMe
· 23andMe Privacy Statement
Even if you withdraw your consent to research participation, 23andMe acknowledges that research already conducted using your deidentified data cannot be reversed or recalled from studies already underway or completed....
Why it matters: This limitation means that withdrawing research consent is only prospective, not retroactive; your genetic data may already have contributed to commercial pharmaceutical research before you exercise your right to opt out, and those contributions cannot be erased....
-
Mixpanel
· Mixpanel Terms of Use
When a business uses Mixpanel to track its users, that business is responsible for its users' data as the data controller. Mixpanel processes the data on the business's behalf and is not directly responsible to end users for how their data is handled....
Why it matters: This provision determines where legal accountability sits for end-user data. Because the business deploying Mixpanel is the data controller, end users must direct data rights requests such as access, deletion, and opt-out to the deploying business, not to Mixpanel....
-
Google Maps
· Google Maps Platform Terms of Service
You generally cannot save or store map data, geocoding results, or other Maps API outputs in your own databases for future use, with only narrow exceptions for temporary performance caching within the Maps interface itself....
Why it matters: This restriction prevents developers from building data pipelines that archive or reuse Maps API outputs, which is a common architectural pattern, and non-compliance is an enforcement trigger....
-
Google Maps
· Google Maps Platform Terms of Service
You cannot use Google Maps API data to build a product that competes with Google Maps or to enhance a competitor's mapping product....
Why it matters: This restriction limits the competitive use of Google Maps data and prevents developers from combining Maps API outputs with services from competing mapping providers....