-
Betterment
· Betterment Privacy Policy
The policy discloses that Betterment shares identifiers, commercial information, and internet and electronic network activity data with advertising and marketing networks for targeted advertising, and acknowledges this may constitute a 'sale' or 'share' under certain state privacy laws including CCPA....
Why it matters: This provision establishes that Betterment's advertising technology practices involve sharing three categories of personal data with advertising networks, and the policy explicitly acknowledges this activity may meet the legal definition of 'sale' or 'sharing' under state privacy laws, triggering opt-out rights for eligible residents....
-
Betterment
· Betterment Privacy Policy
The policy reserves the right for Betterment to modify its terms at any time without prior notice, with changes effective immediately upon posting; for material changes, the document states Betterment will make best-efforts notification via email or in-app alert....
Why it matters: This provision establishes that the governing privacy terms can change without advance notice, with the revised version taking effect upon publication, and places responsibility on users to monitor the policy for updates....
-
Betterment
· Betterment Privacy Policy
The policy states that by using Betterment's services, customers acknowledge and agree that the privacy policies of multiple third-party providers, including Socure, Plaid, Stripe, MX Technologies, Apex Clearing, Ascensus, and Capitalize, govern those providers' use of customer data, and in some cases expressly grants those providers the right, power, and authority to access, store, and transmit customer information....
Why it matters: This provision establishes that data governance for a material portion of customer information is delegated to the terms of multiple third-party providers, and in the case of Plaid and Stripe, customers expressly authorize those providers to access and transmit their financial and payment information under those providers' own privacy frameworks....
-
Betterment
· Betterment Privacy Policy
The policy states that Betterment uses Socure for identity verification, which may collect facial images including selfie photographs and identification card images, as well as device information, with Socure's own privacy policy governing the use of that data....
Why it matters: This provision discloses collection of facial image data as part of account creation, a category of information that may constitute biometric data under Illinois BIPA and analogous state laws, with data governance delegated to Socure's privacy policy rather than Betterment's stated commitments....
-
Betterment
· Betterment Privacy Policy
The policy states that Betterment is authorized by plan sponsors to share plan participant personal information with employer-selected third-party advisors, and those advisors may use participant information both to provide investment services and to market their other services to participants, and may further direct transmission of plan information to additional third parties....
Why it matters: This provision establishes a data sharing chain in which plan participant personal information flows to employer-selected third-party advisors based on employer consent rather than individual participant consent, and those advisors may use the information for marketing purposes beyond plan administration....
-
These provisions have changed before
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
-
Google Ads
· Google Ads Editorial and Technical Requirements
The policy restricts the business name field in applicable ad formats to the advertiser's domain, recognized business name, or promoted downloadable app name, and prohibits the use of promotional language in that field....
Why it matters: This provision creates a discrete approval gate for advertiser identity disclosure in ad formats that require a business name field. Campaigns using product names, taglines, or DBAs that do not map to a recognized business name or domain may be disapproved....
-
Google Ads
· Google Ads Editorial and Technical Requirements
The policy states that translated versions of the Google Ads policies are provided for reference only and that the English-language text is the authoritative version for enforcement purposes....
Why it matters: This provision establishes that non-English translations of the policy carry no enforcement weight, meaning advertisers who rely on translated versions may operate under a different understanding of policy requirements than Google will apply during enforcement....
-
Google Ads
· Google Ads Editorial and Technical Requirements
The policy prohibits ads and their destination pages from failing to identify the product, service, or entity being promoted....
Why it matters: This provision extends identification requirements beyond the ad creative to the destination URL or landing page, requiring that both the ad and its destination clearly identify what is being promoted. Non-compliant destinations may result in ad disapproval regardless of the ad creative's compliance....
-
Google Ads
· Google Ads Prohibited Content Policy
During events Google designates as Sensitive Events, the policy states Google Ads may take a variety of unspecified actions. The category is defined broadly to include civil emergencies, natural disasters, public health emergencies, terrorism, conflict, and mass acts of violence, among other events of significant social, cultural, or political impact....
Why it matters: This provision reserves broad discretionary authority for Google to modify advertiser permissions, restrict content categories, or take other unspecified platform actions during Sensitive Events without enumerating the specific measures that may be applied or establishing procedural notice requirements for affected advertisers....
-
Google Ads
· Google Ads Prohibited Content Policy
The policy prohibits ad content that incites hatred or promotes discrimination against individuals or groups based on enumerated protected characteristics, as well as content that harasses, bullies, threatens harm, or seeks to exploit others. This prohibition applies to ads, assets, and destinations....
Why it matters: This provision establishes a broad content eligibility standard covering hate speech, harassment, exploitation, and advocacy of harm across a wide range of protected characteristics, including the open-ended category of any other characteristic associated with systemic discrimination or marginalization....
-
Google Ads
· Google Ads Prohibited Content Policy
The policy prohibits ads that facilitate or promote access to political materials obtained through unauthorized computer intrusion, including materials distributed by third parties rather than the original hacking actor. The prohibition applies to political entities within the scope of Google's Election Ads policies....
Why it matters: This provision extends the prohibition to third-party distributors of hacked political materials, not only original threat actors, which may affect advertisers in news, political commentary, or information aggregation verticals who reference or link to content derived from unauthorized access....
-
Google Ads
· Google Ads Prohibited Content Policy
The policy states that Google may use information from the advertiser's ads, website, accounts, and unspecified third-party sources when assessing whether a policy violation has occurred. The third-party sources that may be consulted are not defined or limited in the policy text....
Why it matters: This provision authorizes Google to incorporate third-party source information into enforcement determinations, meaning that content or associations beyond the advertiser's direct account or submitted creatives may inform account suspension decisions. The scope of third-party sources is not enumerated in the policy....
-
Google Ads
· Google Ads Advertising Policies Overview
Google employs automated AI systems trained on human reviewer decisions as the primary enforcement mechanism for ad policy compliance, with human expert review reserved for complex or severe cases....
Why it matters: This provision discloses that primary enforcement is algorithmic, with human review applied selectively. Advertisers whose ads are disapproved by automated systems may have limited transparency into the specific decision logic applied, which is operationally relevant for appeals processes....
-
Google Ads
· Google Ads Advertising Policies Overview
Advertisers in restricted categories including gambling, healthcare, financial products, cryptocurrency exchanges and wallets, dating services, and copyrighted content are required to obtain specific Google Ads certification before their ads are eligible to run, in addition to complying with applicable local laws....
Why it matters: This provision establishes that eligibility to advertise in restricted verticals is conditioned on obtaining and maintaining Google-issued certification, creating an operational prerequisite that must be satisfied before campaigns in these categories can serve, regardless of content compliance....
-
Google Ads
· Google Ads Advertising Policies Overview
The policy states that when ads may reach children and teens, ad personalization is disabled and sensitive ad content categories are restricted, and that all advertisers must comply with local legal requirements for advertising to users under 18....
Why it matters: This provision establishes mandatory protections for advertising directed at or likely to reach minors, including disabling personalization features and restricting sensitive content categories, in addition to requiring advertiser compliance with local age-related advertising laws....
-
Google Ads
· Google Ads Advertising Policies Overview
The policy prohibits ads and destinations that omit or obscure billing details, financial charges, contact information, or legal identifiers, and bars misleading claims regarding weight loss, financial gain, charitable donations, or impersonation of reputable entities....
Why it matters: This provision establishes that transparency obligations extend to the ad destination as well as the ad itself, requiring that landing pages and websites accurately represent billing terms, fees, contact information, and business identity as conditions of ad eligibility....
-
Google Ads
· Google Ads Advertising Policies Overview
Google reserves the authority to apply impression limits to ads it determines have higher potential for abuse or poor user experience, with unrestricted serving available only to advertisers it designates as qualified....
Why it matters: This provision establishes a tiered ad delivery system in which impression volume is contingent on Google's qualification determination, meaning that ad campaign reach is not solely a function of budget and targeting parameters but also of platform-assigned advertiser status....
-
Google Ads
· Google Ads Advertising Policies Overview
Google operates and is continuing to expand a strike-based enforcement system for repeat policy violations, under which advertisers accumulate strikes that may lead to escalating enforcement actions, and Google states it will provide information on its enforcement decisions....
Why it matters: This provision discloses a progressive enforcement framework in which repeated policy violations result in escalating consequences, including the potential for account suspension, and establishes that Google will communicate its enforcement rationale to affected advertisers....
-
DocuSign
· DocuSign Privacy Statement
The notice states that DocuSign trains AI models using de-identified customer data only where customer consent has been obtained, and that systems are designed to avoid using personal information for AI training without consent....
Why it matters: This provision establishes the conditions under which DocuSign may use customer data for AI model development, requiring consent and de-identification as stated preconditions. The notice does not specify the consent mechanism or what 'de-identification' standard is applied, which may require evaluation under applicable AI governance frameworks, particularly GDPR and emerging EU AI Act requirements....
-
DocuSign
· DocuSign Privacy Statement
The notice authorizes third-party advertising and marketing partners to use cookies and similar technologies on DocuSign marketing websites to deliver targeted advertising, while stating that such cookies are not deployed within eSignature, CLM, and Identity products and that customer data is not disclosed to advertising and marketing partners....
Why it matters: This provision establishes that advertising partner data sharing is limited to marketing website contexts and is not applied within DocuSign's core product infrastructure. Enterprise customers should note that this carve-out applies specifically to customer data and core products, while marketing website visitors remain subject to third-party advertising cookie deployment....
-
DocuSign
· DocuSign Privacy Statement
The notice states that DocuSign uses Binding Corporate Rules for intra-group EEA and UK data transfers, and that transfers outside the DocuSign group rely on adherence to BCR standards or EU Standard Contractual Clauses....
Why it matters: This provision establishes the legal mechanisms DocuSign asserts for international personal data transfers from the EEA and UK, which is a mandatory requirement under GDPR and UK GDPR. Enterprise customers who rely on DocuSign as a processor for EU/UK personal data should verify that applicable transfer mechanisms are documented in their data processing agreements....
-
DocuSign
· DocuSign Privacy Statement
The notice establishes a Privacy Request Portal as the designated mechanism for submitting data subject rights requests including access, deletion, correction, and export, and states that identity verification is required for all requests, with account login accepted as verification for registered users....
Why it matters: This provision establishes the operational procedure for exercising data subject rights under GDPR, UK GDPR, CCPA, and applicable state privacy laws, including the identity verification standard and authorized agent process. The requirement to provide additional verification for non-account holders may affect the ease of exercising rights for individuals who receive documents through DocuSign without having a registered account....
-
DocuSign
· DocuSign Privacy Statement
The notice states that personal information may be disclosed to third parties during due diligence or upon completion of corporate transactions including mergers, sales, and bankruptcy proceedings, and that DocuSign will notify users of changes to data control and available choices if a transaction occurs....
Why it matters: This provision reserves DocuSign's right to transfer user personal information as part of business asset transactions, including in bankruptcy contexts. The commitment to notify users of control changes and available choices is stated but the notice does not specify the timing, method, or content of such notification....
-
DocuSign
· DocuSign Privacy Statement
The notice states that personal information is retained no longer than necessary for processing purposes or as required by law, with specific periods governed by a data retention policy and information handling standards referenced but not reproduced in the notice. Where technical limitations prevent deletion, the notice states that access is limited and security measures are applied....
Why it matters: The notice references a separate data retention policy and information handling standards that govern specific retention periods but does not reproduce those periods in the notice itself. The acknowledgment that technical limitations may prevent deletion, with safeguards applied in lieu of deletion, is an operationally relevant disclosure for enterprise data governance purposes....
-
Medium
· Medium Privacy Policy
The policy states that Medium and its vendors may scan, analyze, and review user content, messages, AI interactions, and associated metadata, including for the purpose of training, testing, and improving machine learning models and algorithms....
Why it matters: This provision establishes that user-generated content and AI interactions, along with associated metadata, may be shared with and analyzed by third-party vendors for ML model training purposes. The scope of 'AI interactions' is not defined in the document, leaving the precise categories of data subject to this processing operationally ambiguous....
-
Medium
· Medium Privacy Policy
The policy discloses that personal information may be transferred to and stored in jurisdictions outside the user's home country, including via Amazon Web Services data centers globally, and states that Medium will take steps to ensure adequate protection without specifying the legal transfer mechanisms used....
Why it matters: This provision establishes that international data transfers occur to jurisdictions that may not provide equivalent data protection to the user's home jurisdiction. The policy does not name the specific legal mechanisms used to safeguard these transfers, such as Standard Contractual Clauses, which is a detail that GDPR Chapter V compliance reviews typically require....
-
Medium
· Medium Privacy Policy
The policy states Medium does not currently sell personal information but reserves the right to do so in the future, and grants California residents the right to opt out of any such future sale, along with rights to know, delete, and non-discrimination under the CCPA....
Why it matters: This provision establishes that Medium may engage in personal information sales in the future, with a corresponding opt-out right for California residents. The reservation of the right to sell personal information, while paired with an opt-out, is a material disclosure for users who may not anticipate this potential future practice....
-
Medium
· Medium Privacy Policy
The policy articulates four GDPR lawful bases for processing: contractual necessity, legitimate interests, legal obligation, and consent, with withdrawal of consent available at any time where consent is the stated basis....
Why it matters: This provision establishes the legal framework under which Medium processes personal data for EEA, UK, and Swiss users, and defines the conditions under which users may withdraw consent or object to processing. The reliance on legitimate interests for analytics, product improvement, and data analytics is operationally significant because it does not require prior consent from users....
-
Zillow
· Zillow Privacy Notice
The policy states that Zillow's disclosure of device identifiers, hashed email addresses, cookie IDs, and interest inferences to advertising networks, social networks, and advertising partners may qualify as the sale of personal data or targeted advertising under applicable state privacy laws. The policy separately notes that Zillow does not sell or share for targeted advertising the personal data of individuals known to be under 18....
Why it matters: This provision establishes that Zillow's data disclosures to advertising partners may trigger opt-out obligations under state privacy statutes including the CCPA, requiring Zillow to provide and honor opt-out mechanisms and potentially to disclose the categories of personal data involved in such transfers. Compliance teams should evaluate whether Zillow's Privacy Portal opt-out infrastructure satisfies the requirements of each state privacy law under which a covered user resides....
-
Zillow
· Zillow Privacy Notice
The policy authorizes Zillow and its third-party partners to link multiple devices belonging to a single user or household using shared account identifiers (such as hashed email addresses) or statistical modeling, and to use that linkage for interest-based advertising, personalized content, analytics, and campaign measurement. This cross-device linking is conducted both by Zillow directly and by third-party partners....
Why it matters: This provision establishes that Zillow's advertising and analytics activities may extend across all devices associated with a user or household, using both deterministic (account identifier-based) and probabilistic (statistical modeling-based) methods. Organizations assessing data minimization obligations or proportionality requirements under applicable privacy frameworks should evaluate the scope of this cross-device data processing....
-
Zillow
· Zillow Privacy Notice
The policy states Zillow may collect approximate location inferred from IP address automatically, and may collect precise GPS geolocation data if the user grants permission through device or browser settings. The stated purpose for precise geolocation collection is to provide property information near the user's location....
Why it matters: This provision establishes that Zillow collects two distinct categories of location data: approximate location derived from IP address (collected without specific user permission) and precise GPS coordinates (collected only with device-level permission). Several state privacy laws treat precise geolocation as sensitive personal data subject to heightened consent or opt-out requirements, which may interact with this provision's scope....
-
Zillow
· Zillow Privacy Notice
The policy states that when a user contacts an agent, requests a tour, or submits a similar request, Zillow may share the user's name, email, phone number, home search history, and saved or liked properties with the relevant real estate professional. The policy characterizes this sharing as occurring 'at your direction,' meaning it is triggered by the user's own request actions on the platform....
Why it matters: This provision establishes that a user's home search history, including properties saved or liked, is disclosed to real estate professionals when the user submits contact or tour requests. Real estate professionals receiving this data operate under their own privacy notices, which may differ from Zillow's, creating a context in which Zillow's privacy protections no longer govern how that data is used....
-
Zillow
· Zillow Privacy Notice
The policy states that Zillow uses generative artificial intelligence and machine learning as part of its day-to-day business operations, including for purposes of helping users find homes and connecting them with real estate professionals, lenders, and property managers. The policy references alignment with Zillow's AI Principles but does not detail those principles within the notice itself....
Why it matters: This provision discloses that personal data collected across Zillow's platform may be processed using generative AI and machine learning systems. The reference to external AI Principles without incorporating their substance into the privacy notice means users and compliance teams must consult a separate document to assess the scope of AI-related data processing....
-
Ancestry
· Ancestry Privacy Statement
The agreement states that Ancestry requires valid legal process for any government or law enforcement access to user data, does not permit law enforcement to use the Services for investigative purposes, and commits to providing users advance notice of compelled disclosures where legally permitted....
Why it matters: This provision establishes that law enforcement access to DNA Data and Genetic Information requires a valid legal process rather than voluntary disclosure, and explicitly prohibits investigative use of the platform by law enforcement, which is a materially specific commitment given the sensitivity of genetic data and its forensic utility....
-
Ancestry
· Ancestry Privacy Statement
The agreement discloses that laboratory partners that process AncestryDNA samples are independently required under CLIA regulations to retain DNA Data and test results for at least seven years, and that this retention continues even if the user requests deletion from Ancestry....
Why it matters: This provision establishes that a user's deletion request directed to Ancestry does not terminate the retention of DNA Data at the laboratory partner level, as CLIA and CAP regulatory obligations require laboratory partners to maintain records independently of Ancestry's user-facing deletion mechanisms....
-
Ancestry
· Ancestry Privacy Statement
The agreement states that Ancestry will not share Genetic Information with third-party marketers, insurance companies, or employers, and will not use Genetic Information for marketing or personalized advertising without the user's separate explicit consent....
Why it matters: This provision establishes explicit categorical prohibitions on Genetic Information sharing with insurance companies and employers, which are among the most sensitive potential misuse scenarios for genetic data, and conditions any marketing use of Genetic Information on a separate explicit consent that is distinct from general account consent....
-
Ancestry
· Ancestry Privacy Statement
The agreement states that Ancestry transfers Personal Information and Genetic Information from the EU, UK, and Switzerland to U.S.-based entities using Standard Contractual Clauses or the Data Privacy Framework, and that named Ancestry subsidiaries are certified under the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF....
Why it matters: This provision establishes the legal mechanisms for cross-border transfer of sensitive genetic data from the EU, UK, and Switzerland to the United States, and the DPF certification scope determines which entities and data categories are covered by the framework's accountability and redress mechanisms....
-
Ancestry
· Ancestry Privacy Statement
The agreement states that Ancestry collects audio recordings of phone calls with Member Services, transcripts of live chat sessions, and records of interactions with AI-powered support and research assistants, as well as information shared during consumer insights research....
Why it matters: This provision discloses that communications across multiple support channels including voice calls, live chat, and AI assistant interactions are recorded and retained, which may engage state wiretapping and call recording consent laws, GDPR provisions on automated processing, and applicable requirements for disclosure of AI system use in customer interactions....
-
WhatsApp
· WhatsApp Terms of Service
WhatsApp's total liability to any user for any claim connected to the terms or services is capped at $100 or the amount the user paid WhatsApp in the prior 12 months, whichever is greater. Consequential, special, punitive, indirect, and incidental damages are excluded from recovery under these terms....
Why it matters: This provision establishes a financial ceiling on WhatsApp's exposure per user that, for the majority of users who pay nothing for the service, is set at $100. The exclusion of consequential and punitive damages further narrows the categories of harm for which recovery may be sought under these terms, though applicable law in certain jurisdictions may limit the enforceability of these exclusions....
-
WhatsApp
· WhatsApp Terms of Service
Users must file any claim or commence arbitration against WhatsApp within one year of the date the dispute arose, or the claim is permanently barred. This shortened limitation period applies to all disputes except Excluded Disputes (intellectual property matters)....
Why it matters: This provision contractually shortens the period within which users must bring claims, which for many dispute categories is shorter than the statutory limitation period that would otherwise apply under state or federal law. The document states that the provision applies to the fullest extent permitted by applicable law, acknowledging that some jurisdictions may not permit contractual shortening of limitation periods....
-
WhatsApp
· WhatsApp Terms of Service
Users grant WhatsApp a worldwide, royalty-free, sublicensable, and transferable license to use, reproduce, distribute, create derivative works of, display, and perform content uploaded, submitted, stored, sent, or received through the Services. The document states this license is for the limited purpose of operating and providing the Services....
Why it matters: This provision establishes the contractual basis under which WhatsApp processes and transmits user content, including messages, profile pictures, and status messages. The license is described as limited to operating and providing the Services, though the terms sublicensable and transferable indicate the license may be passed to third-party service providers and successor entities....
-
WhatsApp
· WhatsApp Terms of Service
Users agree to indemnify and hold harmless WhatsApp and affiliated parties from all liabilities, damages, losses, and expenses, including legal fees, arising from third-party claims related to the user's actions, content, terms violations, or misrepresentations. The indemnification obligation applies to the maximum extent permitted by applicable law....
Why it matters: This provision requires users to bear the cost of defending WhatsApp against third-party claims that arise from the user's conduct, content, or misrepresentations on the platform. The scope includes legal fees and all related expenses, creating a broad financial obligation that could be material in the event of significant third-party litigation....
-
WhatsApp
· WhatsApp Terms of Service
WhatsApp reserves the right to modify, suspend, or terminate user access to its Services at any time for any reason, including violations of the terms or creation of harm, risk, or legal exposure. Accounts may also be deleted for inactivity or failure to activate after registration....
Why it matters: This provision authorizes WhatsApp to suspend or terminate user accounts without a defined notice period for a broad range of stated reasons, including the general standard of violating the letter or spirit of the terms. The provision also permits deletion of inactive accounts, which may result in loss of account data and message history....
-
WhatsApp
· WhatsApp Terms of Service
WhatsApp may amend these terms at any time, providing notice of material changes as appropriate, with continued use of the Services constituting acceptance of the amended terms. WhatsApp may assign its rights and obligations, and transfer user information, to affiliates, successor entities, or new owners in connection with corporate transactions without requiring additional user consent....
Why it matters: This provision authorizes WhatsApp to modify the terms of service unilaterally and treats continued platform use as acceptance of the amended terms. It also permits transfer of user information to successor entities in mergers, acquisitions, or restructurings, with the new owner's relationship to users governed by the existing terms....
-
WhatsApp
· WhatsApp Terms of Service
Users must be at least 13 years old (or the minimum age required in their country) to register independently. Parents or guardians may create parent-managed accounts for children below the minimum age where available, and are responsible for their child's activity under these terms....
Why it matters: This provision establishes the minimum age framework for WhatsApp use and places parental responsibility for child activity directly within the terms. The availability of parent-managed accounts for children under 13 is noted as jurisdiction-dependent, and parents who create such accounts assume responsibility for compliance with these terms....
-
WhatsApp
· WhatsApp Privacy Policy
The policy states that WhatsApp automatically collects hardware model, OS information, battery level, signal strength, IP address, mobile operator, browser information, language, time zone, and device identifiers that are linked to Meta Company Products on the same device or account. This collection occurs upon installation, access, or use of the Services....
Why it matters: This provision establishes collection of device identifiers that are explicitly described as unique to Meta Company Products, creating a technical linkage between WhatsApp usage data and a user's broader Meta account ecosystem. This identifier linkage underpins the cross-Meta data sharing described elsewhere in the policy....
-
WhatsApp
· WhatsApp Privacy Policy
The policy states that WhatsApp may access, retain, and share collected user information with government or law enforcement authorities in response to legal process or government requests, and also for internal enforcement, fraud prevention, security, and safety purposes. The standard applied is a good-faith belief of necessity....
Why it matters: This provision establishes the conditions under which WhatsApp may disclose user information to government or law enforcement authorities, applying a good-faith belief standard rather than requiring a court order in all circumstances. The scope of information potentially disclosed is defined by reference to the full information collection section of the policy....
-
WhatsApp
· WhatsApp Privacy Policy
The policy discloses that user data is transferred globally, including to the United States and to countries where Meta affiliates, partners, and service providers are located, using Meta's global infrastructure and data centers. The policy notes that destination countries may have different privacy laws than users' home countries....
Why it matters: This provision establishes that WhatsApp user data is subject to global transfer using Meta's infrastructure, and that the legal protections available to users' data may vary based on the destination country. For EU and UK users, this disclosure engages data transfer mechanism requirements under GDPR and UK data protection law....
-
WhatsApp
· WhatsApp Privacy Policy
The policy states that WhatsApp may amend or update the Privacy Policy and will provide notice of amendments as appropriate, with no specific notice period, consent mechanism, or opt-out right specified for policy changes....
Why it matters: This provision reserves the right to amend the Privacy Policy without specifying a minimum notice period, the form of notice, or any mechanism for users to reject changes and continue using the service on prior terms. The phrase 'as appropriate' leaves the adequacy of notice to WhatsApp's discretion....
-
WhatsApp
· WhatsApp Privacy Policy
The policy states that users may upload their device address book to WhatsApp on a regular basis, sharing phone numbers of both existing WhatsApp users and non-users. The policy states that phone numbers of non-users will be managed in a way that prevents identification of those individuals by WhatsApp....
Why it matters: This provision establishes that address book uploads may include phone numbers of individuals who are not WhatsApp users and have not consented to have their contact information shared with WhatsApp. The policy qualifies collection as permitted by applicable laws and states non-user contacts cannot be identified, but the operational mechanism for this anonymization is not described....