Found in 77 of 170 platforms tracked (45% adoption) · 130 provisions
Amazon builds a detailed profile of your interests and behavior and monetizes it through advertising — meaning your data is used to generate revenue beyond just serving you as a customer.
Your potentially sensitive conversations could become training data that influences a global AI system, and opting out is not absolute — flagged safety content can still be used.
Your private conversations with Claude could be used to improve Anthropic's AI systems unless you actively disable this in your account settings.
This means Bumble can use your photos and profile content indefinitely and for a wide range of commercial purposes, even after you delete your account, as content may persist in derivative works.
Your private conversations with AI characters can become part of the training data that shapes the AI system itself, with limited ability to prevent this after the fact.
This means Character.AI can use your chats, characters, and created content to train AI models, promote the service, or commercialize them in other ways, and you cannot revoke this permission later.
Your files and behavior on Dropbox could be used to develop AI systems, raising questions about consent, data minimization, and the scope of use beyond storage.
Cross-device profiling means your behaviour across different devices and services can be combined to build a detailed picture of you, often without explicit notice each time data is combined.
This provision means that proprietary designs, client work, brand assets, or confidential prototypes you store in Figma could be used to improve Figma's AI products, potentially beyond what users and…
Your design files, which may contain proprietary creative work, client assets, or personal data, could be used by Figma to train or improve its AI systems without additional payment or specific conse…
This provision means millions of Fitbit users may be unaware that their health data is governed by Google's expansive data ecosystem, not just Fitbit's narrower policy.
Developers storing code on GitHub — including potentially proprietary or sensitive code — should be aware their contributions and behavior may feed into commercial AI products.
This means Google can use your photos, videos, documents, and other content you upload across its global services and products without paying you, and may continue to do so even after you delete your…
This is the core commercial engine of Google's business model and means that sensitive personal information you generate in one service (e.g., a health query in Search or a private email topic in Gma…
Users typically assume AI conversations are private or only processed by machines; the ability for humans to read submitted content creates significant privacy risk for anyone sharing sensitive, conf…
Your personal conversations, including potentially sensitive disclosures, contribute to training commercial AI products, which raises questions about informed consent and the long-term use of your da…
Grindr can use content you post — including photos — for purposes beyond displaying it to other users, potentially including promotional materials or product development, without paying you or seekin…
Health information is among the most sensitive data and its misuse can lead to discrimination, financial harm, or privacy violations. It may be subject to HIPAA protections depending on context.
Content you believe is private may be accessed by Hugging Face employees or systems without notifying you, particularly for security investigations or regulatory compliance.
Your personal content and professional information could be used to build AI systems, potentially without your active awareness, and this use extends to third-party AI tools LinkedIn works with.
LinkedIn can repurpose, modify, and distribute your professional content — including articles, photos, and posts — across its platform and partner services without paying you or seeking further permi…
Having inferred sensitive attributes attached to your advertising profile creates risks of discrimination, manipulation, and exposure of information you never chose to share with Meta or advertisers.
This means Meta can use your personal photos and posts to make money from advertising without paying you, and potentially to train AI systems, as long as your content is live.
Your personal behavior, interests, location data, and social connections are continuously analyzed by Meta's systems to build an advertising profile that is the commercial engine of the entire platfo…
Your usage data, content, and personal information are collected and used by Microsoft for service operation, personalization, advertising (on free services), and product improvement.
As AI becomes central to Microsoft's products, the use of your personal conversations, documents, and inputs to train AI models represents a significant and growing use of personal data that many use…
This license is particularly significant for users of Copilot and other AI services, as it may allow Microsoft to use your prompts, documents, and generated content to improve its AI models, subject …
This means Midjourney can use your creative work and inputs indefinitely for any purpose, including training AI models or commercial use, without paying you or needing your future consent.
Your browsing activity outside of Netflix is being used to target you with ads inside Netflix, which many consumers are unaware of and may find intrusive.
Your private conversations with ChatGPT or other OpenAI tools may be used to train future AI systems, meaning sensitive information you share — health questions, legal issues, personal problems — cou…
This means private, sensitive, or personal information you share with ChatGPT could be reviewed and used to shape future AI behavior, raising significant privacy concerns.
Users often share highly sensitive information with ChatGPT without realizing it becomes part of OpenAI's dataset, potentially processed for AI training and accessible to the company's systems and pe…
Anything you share with ChatGPT — including sensitive personal, medical, or financial details — could become part of OpenAI's AI training dataset unless you proactively opt out.
Your messages, creative work, and uploaded files may be used to train OpenAI's AI systems, potentially influencing future AI outputs and having your data persist in model weights even after you delet…
This license grant is broad and covers modification and distribution of your content globally without payment, which means creative work, proprietary business information, or personal data you input …
This means your behavior on Paramount+ — and potentially elsewhere online — is monitored and used to build an advertising profile that follows you across your phone, computer, TV, and other devices.
PayPal is creating an invisible profile about you that goes beyond what you directly share, and this inferred data can influence credit decisions, targeted advertising, and what products or offers yo…
Pinterest can build detailed profiles about sensitive aspects of your life based on what you search, save, and click — even if you never explicitly share this information.
Your personal browsing habits, pins, and interactions could be used to train AI systems, which raises concerns about consent and the long-term use of your data beyond the original purpose.
Pinterest can use the photos, videos, and other content you upload in a wide variety of ways — including in advertising and across third-party partner services — without paying you or asking for addi…
Your browsing history and activity — including on other websites — can be used to target you with ads, which many consumers find intrusive and are unaware is happening.
This means Poshmark can continue to use your listing photos and descriptions commercially indefinitely, and you cannot revoke this permission even if you close your account or delete the content.
This provision means your creative posts, comments, and contributions to Reddit communities could be used to build commercial AI products without your explicit consent or compensation.
This clause means Reddit can commercially exploit everything you post indefinitely, including potentially using your content to train AI systems or for advertising, without paying you or asking for f…
Your messages, audio, and other content on Roblox may be used to train artificial intelligence systems, which is a significant secondary use of your personal data you may not have anticipated.
This provision means Snap can use your personal photos, videos, and creative content for its own commercial purposes without paying you or asking further permission, which goes beyond what many users…
Inferred data can include sensitive inferences about your health, political views, or lifestyle that you never directly shared with Snapchat, which are then used for commercial purposes.
The license is described as irrevocable, meaning Spotify can continue using your content indefinitely regardless of what you do with your account, and the sublicensable nature means they can pass tho…
Your transaction history, account activity, and behavioral data across Square's ecosystem can be combined and used for profiling purposes, which goes beyond what most consumers expect when they simpl…
Your creative inputs and queries could become part of Stability AI's commercial AI training datasets, raising questions about ownership, consent, and how your data contributes to a for-profit product.
Even though the Heatmap is described as aggregated, individual users' frequent routes can be inferred from it — potentially revealing home addresses, workplaces, and daily routines — as demonstrated …
This license means Strava can use your fitness routes, workout patterns, and health data to build commercial data products and sell insights derived from your activity, even if you later delete your …
Health and biometric data is among the most sensitive personal information, and using it to train AI models creates risks of re-identification, unintended disclosure, and processing beyond the origin…
Stripe's position as a payment processor gives it access to detailed transaction-level data about your customers, and the terms of data use — including Stripe's ability to use aggregated data for its…
CPNI is highly sensitive telecommunications data that reveals your communication patterns and personal relationships; federal law (47 U.S.C. § 222) specifically restricts how carriers may use this da…
Any video or content you post publicly on TikTok can be downloaded, remixed, and redistributed by any other TikTok user — permanently and irrevocably — which can affect your ability to control how yo…
This means TikTok can use your face, voice, creative work, and personal data inputs to build commercial AI products, with no obligation to compensate you and no ability for you to revoke that permiss…
Tinder can use your photos and personal content in ways you may not anticipate, including for marketing or AI training, and this license may survive account deletion.
Your browsing habits, location data, and usage patterns may be used for targeted advertising or shared with partners, which has direct privacy implications.
Being enrolled by default means your detailed browsing and location data is used for advertising unless you take action to stop it — most consumers may not be aware this is happening.
Profiling based on financial transaction data is particularly sensitive and can affect how you are marketed to or assessed by third parties, often without your awareness.
Most consumers assume their payment data is only used to process transactions, not to build advertising profiles. This practice extends the use of sensitive financial behavior data into commercial ma…
Your driving patterns and location history are being used to commercially profile you, which many users may not expect from a navigation app.
This means Waze can use anything you contribute to the platform for commercial purposes, including advertising and data products, without further permission or payment to you.
This means X can use your photos, videos, and posts for almost any purpose globally without paying you, and can allow others to do so as well, which has significant implications for creators and anyo…
Your content and behavior on X may be used to train AI systems, which has significant implications for how your data is processed and potentially retained beyond normal service purposes.
Your personal data — including things you type, say, or create — may be used to improve Microsoft's AI systems, often without a clear opt-out mechanism surfaced at the point of collection.
This significantly expands data use beyond the YouTube Kids app into the broader Google ecosystem, potentially including Google Search, Google Assistant, and other Google products.
Any content you submit to 23andMe — including profile information, forum posts, or other user-generated material — can be used by the company for a wide range of purposes without additional compensat…
This restriction is designed to protect users from having their genetic data used against them in insurance underwriting or employment decisions, which is also prohibited by federal law under GINA.
This is a meaningful consumer protection in an era when many platforms use user-generated content for AI training without clear consent; however, Stock contributors should review the separate Contrib…
When Adobe relies on legitimate interests rather than your consent, it can process your data without asking you first, though you have the right to object to this processing in certain circumstances.
Amazon can use your submitted content — including reviews, images, and ideas — for commercial purposes without paying you or asking for additional permission, and this license does not expire.
Apple's advertising platform uses your behavioral data to target ads, and while Apple claims to use less data than competitors, users should understand their opt-out options and the scope of data use…
Your photos and videos are not just yours once posted — BeReal has the right to use them for platform purposes, and this license persists as long as your content remains on the platform.
Any content you share in connection with Calm — including social media posts tagging Calm — can be used by Calm for marketing and commercial purposes without your additional consent or compensation.
Inferring demographic characteristics like age and gender from usage data without explicit consent may be considered processing of sensitive personal information under various privacy laws.
As a financial platform, Cash App has access to highly sensitive personal and financial data including transaction history, linked bank accounts, government-issued ID information, Social Security num…
If you sign a document sent by a company using DocuSign, that company — not DocuSign — is primarily responsible for how your data is used, which affects where you direct privacy complaints.
The documents you upload — which may include sensitive contracts, personal information, and legally binding agreements — are licensed to DocuSign for their business purposes, which users may not full…
The license Dropbox receives is broad and includes the ability to access and process your files — understanding exactly what this covers is important for anyone storing sensitive personal or business…
Your personal information, including event preferences and behavioral data, could be used to build AI systems in ways that go beyond your original expectations when signing up.
Eventbrite can use your content for its own purposes, including marketing and promotion, without paying you or asking for additional permission each time.
This means Fitbit can use content you share — including health data, photos, and other uploads — to improve their products and services, potentially beyond what you originally intended.
Any content you upload to Fiverr can be used by the company for its own business purposes without paying you, which could be a concern for original creative work or proprietary materials.
Behavioral tracking and inferences can build detailed profiles about your interests and employment situation that may be used for targeted advertising or shared with third parties without your awaren…
This means Headspace can use content you post on the platform for its own purposes without paying you, and without requiring your additional permission for each use.
Hinge can use content you post — including your photos and personal information you share — to operate and potentially promote the service, and this license continues even after you delete your accou…
The legitimate interests basis is broad and gives Hugging Face significant discretion to process your data for purposes you may not be aware of or have agreed to specifically.
Hugging Face holds a broad license to use your uploaded models, datasets, and applications to operate and improve its platform, which users should understand before uploading proprietary or sensitive…
This means Ledger can process some of your personal data without asking your permission, though you do have the right to object to this type of processing.
LinkedIn builds advertising profiles from your professional data and behavior, and these profiles may be used to target you with ads even on third-party websites and apps.
LinkedIn may build a profile of who you are that goes beyond what you explicitly shared, and these inferences can affect the jobs, content, and people shown to you and to others looking at your profi…
This means Microsoft can use photos, documents, emails, and other files you store on OneDrive or other services for purposes beyond just storing them, which raises privacy and intellectual property c…
Noom can use things you share — including personal health-related content — for a wide range of purposes without paying you or asking for additional permission.
Creators retain ownership of their content, but Patreon gains broad rights to use that content, which may extend beyond what creators expect when sharing their work.
Peloton can use content you create or share on its platform for its own purposes, including marketing, without compensating you or seeking further permission.
Your posts and contributions to the platform can be used by Public for commercial purposes, including in marketing or AI training, without additional compensation to you.
Redfin can use your photos and listing content for purposes beyond just displaying your listing — including sharing with third parties and using for marketing — without paying you or asking permissio…
Comprehensive behavioral profiling can be used for purposes beyond game improvement, including targeted advertising, and creates a detailed picture of your habits and preferences over time.
Understanding Salesforce's privacy practices is essential for anyone whose data is processed through Salesforce's platform, as it determines how personal information is handled, shared, and protected.
Merchants should understand that their proprietary content and branding may be used by Shopify for platform-related purposes, which could have implications for brand control and confidentiality.
Your personal information and behavior are used to train AI systems, which may have long-term implications for how your data is processed and retained beyond your immediate use of the service.
Your messages, files, and usage data may be used to train Slack's AI features, which could raise concerns about how sensitive business communications are processed and retained.
Slack's right to use Customer data — including messages and files — to improve its products means your business communications may inform Slack's product development, subject to applicable privacy te…
This provision means Spotify and its partners are building a profile of your interests and behaviors to serve targeted ads, which has significant privacy implications, especially for free-tier users …
Businesses that upload branding, product images, or other proprietary content to Square's platform grant Square significant rights to that content, which may extend beyond what users reasonably expec…
This means content you upload or enter could be used by Stability AI beyond just generating your output, including potentially for model training or service improvement.
Once Stash anonymizes your data, it can be used or shared without restriction — and there is no guarantee that anonymized data cannot be re-identified in combination with other datasets.
Data collected during payment processing may be used beyond the immediate transaction to build Stripe's own commercial products and AI models, expanding the use of your data beyond what you might exp…
Target Circle membership creates a persistent, identity-linked behavioral profile tied to your name, email, and purchase history that is used for commercial profiling at a scale most consumers don't …
Target can use your reviews, images, or creative submissions indefinitely and without paying you, even if you later delete your account or request removal of the content.
Marketing is conducted across multiple channels and linked to personalization profiling, meaning opting out of one channel may not stop all marketing contact.
Demographic data sourced from external marketing partners can be combined with your purchase history to create detailed profiles that go beyond what you directly provided to Ticketmaster.
Business customers and their end users' communications data passes through Twilio's infrastructure, making it critical to understand what data Twilio retains, uses, and shares.
While Waze describes this data as anonymous, research has shown that anonymized location data can often be re-identified, potentially revealing your identity and movements.
Your browsing and investment behavior may be used to profile you for advertising purposes, which many users do not expect from a financial services platform.
This license means WhatsApp has broad rights over the content you share, which could include using it for service improvement, security purposes, or compliance with legal obligations.
If you use other X-affiliated services, different privacy rules may apply to each, and your data may be handled differently across those products.
This means Microsoft can use things you post or upload — including photos, videos, text, and game clips — across its services without paying you or asking for additional permission each time.
This means Yelp can use your reviews and photos for advertising, partnerships, or other commercial purposes without paying you or asking permission each time.
This is a critical child safety protection, as interest-based ad profiling of minors raises significant legal and ethical concerns under COPPA and GDPR.
eBay can use any content you post — including photos and product descriptions — for its own purposes, including advertising and AI training, without paying you or asking again.
Understanding how your financial data is used within the platform helps you assess whether you are comfortable with Betterment's data practices as your financial services provider.
Users should understand that any content or data they provide to Coinbase may be used by the company for its own purposes within the scope of the license granted.
Content you create and share through the Lyft platform can be used by Lyft for marketing, product improvement, or other purposes without additional consent or compensation.
You may receive marketing from Salesforce based on data collected during website visits, event registrations, or other interactions, and should be aware of how to unsubscribe.
Using location data to set subscription prices means your geographic location directly affects what you pay for Strava — and this pricing use is in addition to the activity tracking and fitness purpo…
Content you create or share through Verizon's services may be used by the company for its own purposes, including marketing, without additional compensation to you.
The broad 'improving the service' purpose is common but poorly defined, and may encompass a wide range of secondary uses that are not individually disclosed.
Create a free account and watch the platforms that matter to you. We'll email you the moment something changes.