-
YouTube Ads
· Google Privacy Policy
The policy authorizes Google to link activity across its own services and across user devices, and to associate activity on third-party sites and apps with a user's personal information for advertising and service improvement purposes, subject to account settings....
Why it matters: This provision establishes that Google's advertising personalization system operates across services and devices and may incorporate third-party site activity into a user's personal data profile, depending on account settings. The scope of this linkage has been subject to regulatory scrutiny under GDPR, and the degree to which settings-based controls satisfy applicable consent or legitimate interest requirements may vary by jurisdiction....
-
YouTube Ads
· Google Privacy Policy
The policy discloses that third-party websites and apps using Google services (such as Google Ads or Google Analytics) share user activity with Google regardless of the browser or browser mode used, including Chrome Incognito mode....
Why it matters: This provision establishes that Google's data collection from third-party sites operates at the network and server level through integrated Google services, not solely through browser-level controls. The disclosure that this occurs in Incognito mode has been the subject of regulatory and litigation attention in the United States....
-
YouTube Ads
· Google Privacy Policy
The policy states that Google uses publicly available information to train AI models used in products including Google Translate, Gemini Apps, and Cloud AI capabilities....
Why it matters: This provision discloses that publicly accessible data, which may include user-generated content indexed by Google, is used for AI model training purposes. This disclosure is relevant to ongoing regulatory discussions regarding AI training data provenance, copyright, and privacy obligations under emerging frameworks including the EU AI Act....
-
YouTube Ads
· Google Privacy Policy
The policy states that when a device detects a voice activation command such as 'Hey Google,' Google records the user's voice and audio including a brief period of audio captured before the activation command was detected....
Why it matters: This provision establishes that Google's voice activation system captures audio content recorded before the user's intentional activation command, which constitutes passive audio collection. This practice is relevant to wiretapping statutes, biometric privacy laws, and consumer protection frameworks in certain jurisdictions....
-
YouTube Ads
· Google Privacy Policy
The policy states that for users on organizational Google accounts, domain administrators and resellers have access to account data including email content, usage statistics, and account credentials, and can modify, suspend, or restrict the account and its privacy settings....
Why it matters: This provision establishes that organizational administrators have broad access and control over employee or student Google accounts, including the ability to restrict users' own privacy controls. This has particular significance for educational settings covered by FERPA and COPPA, and for employment contexts governed by applicable data protection laws....
-
Monitoring
These provisions have changed before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
-
YouTube Ads
· Google Privacy Policy
The policy establishes a tiered data retention framework under which some data is deleted at user request, some is automatically deleted or anonymized after set periods, and some is retained until account deletion or for extended periods for legitimate business or legal purposes, with acknowledged delays between user deletion requests and removal from backup systems....
Why it matters: This provision establishes that user-initiated deletion does not result in immediate removal from all systems, and that certain categories of data are retained beyond user control for business or legal purposes. The acknowledgment of backup system delays is relevant to the operationalization of deletion rights under GDPR and U.S. state privacy laws....
-
YouTube Ads
· Google Privacy Policy
The policy states that Google does not sell personal information and does not share it as defined under the CCPA, and discloses that U.S. state privacy laws provide users rights to access, correct, delete, and port their data, as well as opt out of profiling and targeted advertising....
Why it matters: This provision makes a material legal representation that Google's data practices do not constitute a sale or CCPA-defined share of personal information, which is significant given the breadth of Google's advertising and data partnerships. The enumeration of state privacy rights establishes the operative framework for user rights requests across approximately twenty U.S. jurisdictions....
-
YouTube Ads
· Google Privacy Policy
The policy states that Google collects and stores data from users who are not signed in to a Google Account, linking this data to unique identifiers tied to the user's browser, application, or device, and uses this data for preference maintenance and ad relevance....
Why it matters: This provision establishes that Google's data collection applies to signed-out and unregistered users through device and browser-level identifiers, not only to users with Google Accounts. This collection is relevant to cookie consent frameworks, ePrivacy obligations in the EU, and the scope of U.S. state privacy law coverage for non-account holders....
-
OnlyFans
· OnlyFans Privacy Policy
The policy states that personal data may be retained indefinitely where OnlyFans reasonably suspects a Terms of Service violation, for the duration of investigations by law enforcement or organizations such as NCMEC, and for up to 7 years for financial and identity record-keeping obligations....
Why it matters: The Trust and Safety retention basis is triggered by reasonable suspicion of a Terms of Service violation, not a confirmed violation, and does not specify a maximum retention period. This provision may create tension with GDPR storage limitation principles under Article 5(1)(e) and UK GDPR equivalents, where indefinite retention on suspicion grounds may require proportionality justification....
-
OnlyFans
· OnlyFans Privacy Policy
The policy states that personal data may be transferred outside the UK, EEA, and Switzerland to group companies and third parties, using adequacy decisions, appropriate safeguards (such as standard contractual clauses), or other legal authorizations, depending on the destination country....
Why it matters: This provision discloses that international transfers occur but does not specify the destination countries, the specific transfer mechanisms used for each category of recipient, or the third-party providers involved in cross-border processing. Users seeking this information are directed to contact the company using the details in Section 19....
-
OnlyFans
· OnlyFans Privacy Policy
The policy states that OnlyFans does not sell personal data, does not share personal data for targeted or cross-context behavioural advertising, and does not use cross-site tracking technologies, while disclosing that sensitive information including partial payment card data, government identifiers, usernames and passwords, and biometric data may be disclosed to service providers for business purposes....
Why it matters: This provision makes explicit data practice representations that engage CCPA opt-out rights and Nevada law requirements. The policy simultaneously confirms no data sale or targeted advertising while disclosing that sensitive information categories are shared with service providers for operational purposes, which the policy characterizes as business purpose disclosures rather than sales....
-
OnlyFans
· OnlyFans Privacy Policy
The policy discloses that Creators must provide bank account information, VAT numbers, tax identification numbers, and US tax forms (W-9, 1099-MISC, 1099-NEC) as part of the onboarding and payment process, with Financial Data also collected as a verification and anti-fraud measure....
Why it matters: This provision establishes that Creator onboarding requires submission of tax identification data and IRS-reportable income forms, indicating that OnlyFans operates as a reporting entity for US tax purposes with respect to Creator earnings. The collection of W-9, 1099-MISC, and 1099-NEC forms indicates compliance with IRS reporting obligations for independent contractor payments....
-
OnlyFans
· OnlyFans Privacy Policy
The policy enumerates data subject rights including access, correction, deletion, restriction, portability, and consent withdrawal, and establishes an appeals process for US state residents whose privacy rights requests are denied, with a final escalation path to the relevant state Attorney General....
Why it matters: This provision establishes a multi-tier rights request and appeals process consistent with GDPR, UK GDPR, and US state privacy law requirements, including identity verification procedures for request submissions and authorization requirements for third-party representatives. The appeals escalation to state Attorneys General reflects compliance with Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other state laws requiring internal appeals before regulatory escalation....
-
OnlyFans
· OnlyFans Privacy Policy
The policy states that OnlyFans moderates text and content uploaded to the platform, livestreams, and chat messages, and maintains records of banned users to prevent re-access, with legal bases including performance of a contract, compliance with legal obligations, and legitimate interests....
Why it matters: This provision establishes that chat messages and livestream content are subject to monitoring and moderation in addition to uploaded content, and that a permanent ban record is maintained under the legitimate interests legal basis. The filtration of direct messages is listed as a separate processing activity from general content moderation....
-
Google
· Google Terms of Service
When users upload or share content through Google services, they grant Google a worldwide, non-exclusive, royalty-free license to host, reproduce, distribute, modify, create derivative works from, publicly display, and sublicense that content for purposes including service operation, automated analysis, ad personalization, product promotion, and new technology development. This license persists for as long as the content retains intellectual property protection....
Why it matters: This provision establishes the contractual basis on which Google processes, analyzes, and uses user-generated content across its services, including through automated systems for ad targeting and machine learning model development. Organizations and users submitting content to Google services should assess whether the scope of this license, including sublicensing to contractors and use for new technology development, is compatible with their own data governance, confidentiality, or IP obligations....
-
Google
· Google Terms of Service
Google's maximum financial liability to users under these terms is capped at the greater of $200 or fees paid to Google in the 12 months preceding the dispute. The cap does not apply to liability arising from gross negligence or willful misconduct, and the document states the cap applies only to the extent permitted by applicable law....
Why it matters: This provision establishes the outer bound of Google's financial exposure to individual users in disputes arising under these terms, which is particularly significant for users who rely on Google services for business operations or data storage, where actual damages could substantially exceed $200 or prior fees paid. The carve-outs for gross negligence, willful misconduct, and applicable law limits introduce conditions under which the cap may not apply, which requires jurisdiction-specific legal analysis....
-
Google
· Google Terms of Service
The terms designate California law as governing all disputes and require that disputes be resolved exclusively in federal or state courts in Santa Clara County, California. Users consent to personal jurisdiction in those courts by accepting these terms. These terms do not include a mandatory arbitration clause or class action waiver....
Why it matters: This provision establishes the forum and applicable law for all disputes arising under these terms, requiring users located outside California to litigate in Santa Clara County courts. The absence of a mandatory arbitration clause or class action waiver is operationally notable relative to many large platform terms of service, as it preserves access to federal and state court litigation including potential class actions....
-
Google
· Google Terms of Service
Google reserves the right to suspend or terminate user access to services or delete Google Accounts for material or repeated terms violations, legal compliance requirements, court orders, or conduct causing harm or liability. The terms state that Google will provide advance notice and an opportunity to address the issue when reasonably possible, with specified exceptions....
Why it matters: This provision establishes the conditions and procedural framework under which Google may restrict or terminate access to its full suite of services, including email, cloud storage, and integrated third-party applications. Because a Google Account serves as authentication infrastructure for many third-party services, account termination may have operational consequences beyond Google's own products....
-
Google
· Google Terms of Service
Business users and organizations agree to indemnify Google and its personnel against third-party legal proceedings, including government enforcement actions, arising from unlawful service use or terms violations. The indemnification covers claims, losses, damages, fines, and legal fees....
Why it matters: This provision places financial indemnification obligations on business users and organizations for a broad range of third-party legal proceedings, including government authority actions, arising from their use of Google services in violation of the terms. The inclusion of government authority actions within the scope of indemnified proceedings is operationally significant for organizations in regulated industries....
-
Google
· Google Terms of Service
Users below the minimum account management age must obtain parental or guardian consent to use a Google Account, and parents or guardians who permit their child's use accept these terms and bear responsibility for the child's activity on Google services....
Why it matters: This provision places parental responsibility for minor users' Google service activity on parents or guardians who permit that use, which has implications for content licensing, data processing, and terms compliance obligations where a minor submits content or engages in conduct that would otherwise be attributable to an adult user....
-
Google
· Google Terms of Service
The terms prohibit a defined list of abusive, harmful, and deceptive service uses, including malware, hacking, jailbreaking, adversarial prompting, prompt injection, creating fake accounts or reviews, misrepresenting AI-generated content as human-created, and using Google's AI-generated content to train third-party machine learning models....
Why it matters: This provision explicitly prohibits using AI-generated content from Google services to develop third-party machine learning models, which is operationally significant for AI developers, researchers, and organizations building products that incorporate outputs from Google's generative AI services. The prohibition on jailbreaking and adversarial prompting, except in authorized safety and bug testing programs, also has implications for security researchers....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The agreement permits use of user Inputs and Outputs for AI model training by default, with an opt-out available in account settings, but specifies two conditions under which training use continues regardless of opt-out status: when conversations are flagged for safety review, and when users have explicitly submitted content as feedback....
Why it matters: This provision establishes a conditional opt-out structure in which the training data opt-out right is subject to two categorical exceptions that may encompass a meaningful subset of user conversations. Compliance teams should evaluate whether this carve-out structure satisfies the opt-out right requirements under CCPA and the purpose limitation and legal basis requirements under GDPR and UK GDPR....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The policy establishes that agentic sessions, in which Claude performs multi-step tasks including sending communications, modifying files, or interacting with third-party services on the user's behalf, generate Inputs and Outputs that Anthropic collects, and that personal data included in Inputs may be reproduced in Outputs....
Why it matters: This provision establishes that data generated during agentic sessions, including instructions that result in actions in external systems, is collected as part of the Services and may be used for the purposes described in the policy including model training. The scope of data collection extends to any personal data included in instructions or retrieved from connected third-party services....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The policy discloses that de-identified Inputs and Outputs, including those disassociated from user IDs for safety classification purposes, may be re-identified and linked back to specific users when necessary to enforce the Terms of Service or Usage Policy....
Why it matters: This provision establishes that de-identification of Inputs and Outputs for training purposes is conditional rather than permanent, and that Anthropic reserves the right to re-link de-identified content to specific user accounts for enforcement purposes. Compliance teams should evaluate whether this re-identification carve-out is consistent with de-identification representations made elsewhere in the policy and with applicable privacy law requirements....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The policy discloses that consumer accounts using an employer-owned or organization-owned email address may be linked to that organization's enterprise account, with implications for how personal data from that account is received or disclosed....
Why it matters: This provision establishes that consumer account data may be associated with an enterprise account controlled by a user's employer or organization when an organizational email address is used, which affects the confidentiality of user activity and the governance framework applicable to that data....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The policy states that EEA and UK personal data transferred outside those regions is covered by either European Commission adequacy decisions under Article 45 GDPR or Standard Contractual Clauses under Article 46 GDPR, with equivalent mechanisms for UK and Switzerland transfers, and that Brazil transfers rely on ANPD-approved SCCs....
Why it matters: This provision establishes the legal transfer mechanisms supporting Anthropic's global data flows for EEA, UK, Swiss, and Brazilian personal data, and specifies reliance on GDPR Articles 45 and 46 mechanisms. Compliance teams should verify that SCCs are executed with all relevant processors and that the subprocessor list referenced in the Trust Center is current....
-
Anthropic
· Anthropic Privacy Policy (Superseded Capture)
The policy states that Anthropic's services are not directed at users under 18, that Anthropic does not knowingly collect personal data from minors under 18, and that measures are in place to detect and remove minors from the services....
Why it matters: This provision establishes a minimum age threshold of 18, which is higher than the 13-year COPPA threshold applicable in the US, and discloses that technical detection measures are in place to identify and remove underage users. The policy does not detail the specific detection methodology or its accuracy....
-
Microsoft
· Microsoft Privacy Statement (Legacy)
The statement authorizes Microsoft to use Copilot prompts, location, and related settings to deliver relevant advertising as part of the Copilot service. This applies to the consumer Microsoft Copilot website and app....
Why it matters: This provision establishes that conversational input submitted to Microsoft Copilot, including user prompts, may be used to deliver advertising. The statement separately notes that Microsoft does not use email content, human-to-human chat, video calls, or personal files to target ads, but Copilot prompt data is disclosed as an advertising input....