Recent policy changes

Why it matters: The updated terms now explicitly disclose that personal data is used for machine learning and generative AI model development, establishing transparency around a significant data processing activity. This disclosure affects how customer data flows through Amazon's systems and aligns with emerging regulatory requirements around AI transparency in the EU and other jurisdictions.

Why it matters: The updated policy removes explicit documentation of how user data and AI interactions are used, and removes FAQ guidance on critical account control functions. This reduces transparency in the policy document itself, though the underlying data practices may not change. For users seeking to understand AI training use or locate instructions on account deletion, these removals mean the information is no longer in the privacy policy footer.

Why it matters: The restructured training framework directly affects how and when Mistral can use customer data, which is material for organizations subject to GDPR, CCPA, or internal data governance policies. The narrowed liability cap reduces recourse for confidentiality breaches and may shift risk allocation unfavorably in vendor relationships. These changes require review by compliance and legal teams to assess alignment with privacy obligations and risk tolerance.

Why it matters: The updated terms establish that Mistral AI's API and Studio products are no longer available to consumers on personal accounts. This is operationally significant because it eliminates a previously available service tier, requiring consumers who depend on these features to either convert to a business account or switch to alternative providers.

Why it matters: The updated terms establish that Hims & Hers can determine billing frequency (monthly or multi-month) and that refunds for partially used membership or medication periods are discretionary rather than contractually guaranteed. This materially shifts financial predictability and refund eligibility from fixed, contractual terms to company discretion, which may affect how subscribers budget for the service and plan cancellations.

Why it matters: The updated policy separates fraud-prevention data collection from analytics, establishes it as mandatory and non-optional, and identifies it as a distinct legal basis (legitimate interest in platform protection). This clarifies that users creating or accessing Fly.io accounts will have device and browser data processed by third-party services with no opt-out available, materially different from the previous implicit statement that non-analytics third-party collection was not permitted.

Why it matters: The updated terms establish explicit authority for Snap to require age verification as a condition of service use and clarify that account suspension and content removal decisions are made in Snap's sole discretion rather than under codified procedural guarantees. This creates material changes to how account disputes are processed and shifts responsibility for understanding appeal rights to external documents, which may affect how users can contest restrictions or challenge compliance decisions, particularly in jurisdictions with online platform safety laws.

Why it matters: The updated terms establish a new product feature (Bitcoin Auto-Withdrawal) that expands the functionality of Cash App's virtual currency services by enabling scheduled automated transfers, while also codifying hold periods that previously were described only in vague terms. This provides users with greater control over bitcoin transfers but also introduces operational requirements (address verification) and explicit timeframes (7-60 day holds) that users should understand before using the feature.

Why it matters: The updated terms shift primary responsibility for AI transparency compliance to developers deploying Meta's models in their own products, requiring them to implement disclosure and labeling obligations where applicable law mandates such measures. The expanded definition of Inputs also broadens what content Meta claims the right to process for product safety and improvement, which may affect organizations that submit proprietary code, databases, or sensitive data through API integrations.

Why it matters: The updated terms materially narrow dispute resolution options and limit Meta's financial accountability. The consolidation of all disputes to exclusive California jurisdiction removes a material protection for non-US users who previously could pursue claims in their home countries. The removal of the 30-day advance notice requirement for term changes reduces opportunity for users to review and respond to material modifications before enforcement. The explicit $100 liability cap means Meta's maximum exposure for service failures, data loss, or other harms is capped at a fixed amount regardless of actual injury. These changes together reduce the practical remedies available to users in the event of disputes, service failures, or alleged violations.

Why it matters: The updated terms clarify operational responsibilities and limits that directly affect how developers manage API access and how promotional credits function. The API credential provisions establish user responsibility for account security and unauthorized activity, while the promotional credit restrictions establish non-refundability and expiration rules that affect how credits can be used and retained. Organizations offering or using promotional credits should ensure their customer communications and contracts reflect these restrictions to avoid disputes.

Why it matters: The updated terms establish mandatory individual arbitration as the sole mechanism for resolving any dispute with Replit, eliminating access to court and class action remedies that users previously could have pursued. The agreement also imposes explicit statutory compliance obligations on developers who publish content collecting personal data, creating new privacy law exposure and shifting responsibility upstream from Replit to the developer. The lowered minimum age to 13 with explicit parental consent requirements creates new parental liability and governance considerations for families and schools using the platform.

Why it matters: The removal of the explicit Data Processing Agreement reference creates a documentation gap for organizations subject to GDPR Article 28, which requires a written contract establishing the data controller-processor relationship. The reorganized data categories improve transparency for all users but do not materially expand collection scope. The explicit location consent requirement provides clarity but may not reflect a substantive operational change if Replit already practiced consent-based collection.

Why it matters: The updated terms clarify actual FDIC deposit insurance protections available to Acorns Checking customers by specifying that deposits are held at and insured by member banks up to $250,000 per depositor, rather than the prior ambiguous statement that the product itself is not FDIC-insured. This clarification affects how customers understand the safety and insurance coverage of their deposits.

Why it matters: The ten-fold increase in the deposit requirement materially reduces the accessibility of the referral bonus, requiring new account holders to commit significantly more capital within the same timeframe. The added payment processing validation for SoFi Plus adds a specific technical requirement beyond subscription enrollment, potentially creating scenarios where subscribers miss the bonus despite subscribing within the deadline.

Why it matters: The updated terms materially change the financial activation cost for referral bonuses, raising the minimum deposit requirement tenfold while keeping the bonus amount at $50. This significantly affects the promotional value proposition and return on deposit for new account holders. The addition of explicit payment validation requirements for SoFi Plus subscribers also creates a more stringent eligibility condition than previously stated.

Why it matters: The updated terms establish clearer boundaries around multi-account use by permitting legitimate separate business accounts while explicitly targeting enforcement against evasion and identity concealment. This change affects how users operating multiple brands can structure their presence on Gumroad and introduces verification requirements that Gumroad may invoke during account reviews or enforcement actions.

Why it matters: The updated terms now explicitly authorize Perplexity to remove any user content at any time without notice and clarify that while the Company does not own user-submitted content, it retains ownership of the platform and underlying technology. This establishes clear operational authority for content moderation and defines the intellectual property boundary between user contributions and platform infrastructure, which affects how users should understand their data persistence and modification rights on the platform.

Why it matters: The fund-hold provision materially alters the finality and timing of seller payouts. Previously, the agreement specified conditions under which accounts could be suspended (25% refund rate) but did not explicitly authorize holds on earned funds pending settlement. The new language establishes broad discretion to withhold payouts indefinitely based on subjective factors (suspected violations, chargeback risk, misleading marketing, incomplete verification), creating potential cash-flow disruption for suppliers and impacting the operational reliability of Gumroad as a payment partner.

Why it matters: The updated terms establish automatic renewal as the default state for paid plans, meaning users must take affirmative action to prevent recurring charges. This shifts the burden from Ford to affirmatively charge to the user to affirmatively cancel, which is material to how subscribers manage their accounts and budgets. The explicit pricing variability clause also signals that subscription fees are not guaranteed to remain static, which may affect long-term cost planning for subscribers.

Why it matters: The revised language introduces an explicit contingency on Shein's return offer: returns are now 'subject to our Fair Use Policy,' which is referenced but not detailed in the policy text. This means return eligibility may depend on criteria defined outside the visible return policy, which could affect customer expectations if returns are denied based on Fair Use grounds not previously disclosed.

Why it matters: This change clarifies which legal entity merchants contract with and which courts have exclusive jurisdiction to resolve disputes, based on the store's billing region. The reorganized format makes the regional assignments more transparent and reduces ambiguity about the correct contracting party and dispute forum for each geographic market. For merchants involved in disputes or those managing contracts referencing Shopify as a counterparty, confirming the correct entity and jurisdiction under the updated table is operationally important.

Why it matters: The compressed referral timeline reduces the effective promotion window by over five months, materially narrowing the window for both referrers and referees to complete the required activities and earn bonuses. The automatic Overdraft Protection enrollment at SoFi Plus subscription represents a material shift in default account behavior: instead of opting into overdraft coverage, SoFi Plus members now have it enabled automatically at subscription, which affects how overdraft fees and account linking operate unless the user takes action to disable it.

Why it matters: The updated terms impose a hard deadline of August 4, 2026, for referral program participation and new account opening, and require deposits to settle within 21 days of both account opening and user registration, creating a tighter compliance window than previously stated. For SoFi Plus members, automatic Overdraft Protection enrollment represents a material change to default account behavior; while fee-free and disableable, it affects how checking accounts interact with savings without explicit per-transaction consent.

Why it matters: The updated terms materially increase financial obligations and reduce advance notice for subscription users. The 48-hour pre-charge window and explicit liability for failed-payment retry attempts mean users have less time to manage their payment methods before charges occur. The new explicit liability for background data fees from system services significantly expands what users may owe if their devices are actively updating or communicating without active user interaction, a cost that may be substantial in regions with expensive mobile data. The backup payment method authorization without explicit prior consent may violate consumer protection standards in several jurisdictions, increasing risk of chargebacks and regulatory scrutiny.

Why it matters: The updated terms establish explicit use-case boundaries for AWS IoT SiteWise Scenario Discovery in safety-critical contexts, particularly vehicle systems, and clarify that AWS assumes no liability for uses that violate these boundaries. This change directly affects organizations developing vehicle systems, autonomous features, or regulatory-compliance tools that rely on AWS IoT services; they must now confirm that their architecture includes independent human review and does not treat AWS outputs as autonomous safety validators.

Why it matters: The updated terms materially alter dispute resolution for consumers by replacing universal California jurisdiction with a consumer-favorable approach where consumers can use their home country's courts and laws. This change affects how complaints are filed and resolved. Additionally, the introduction of separate Automated Data Collection Terms with revocable permission creates new compliance obligations for users employing bots or crawlers, and the 30-day advance notice requirement provides greater transparency into future Terms modifications.

Why it matters: The removal of explicit training exclusions for paid services may affect vendor contracts and Data Processing Addenda that organizations relied on to satisfy their own privacy commitments. The expanded definition of Input data to include third-party integration data means Mistral now processes a broader scope of user information for its stated business purposes. Together, these changes may require organizations to renegotiate vendor agreements and revise customer-facing privacy disclosures to reflect the updated scope of data collection and processing.

Why it matters: The extended 120-day error-reporting window gives account holders significantly more time to identify transaction discrepancies before the dispute window closes. Under Wise's prior terms, an error discovered after 60 days would be outside the reporting period; under the revised terms, the same error reported within 120 days can be escalated to Wise Support.

Why it matters: The removal of detailed cookie disclosures and an interactive privacy preference center reduces transparency regarding how Snowflake uses cookies and eliminates a granular consent mechanism. In jurisdictions with strict cookie consent requirements (EU, UK, California), this change may affect Snowflake's ability to demonstrate compliant cookie consent and may create compliance gaps for organizations relying on Snowflake's transparency practices. Verification that alternative consent mechanisms remain in place is necessary to assess regulatory exposure.