Recent policy changes

Why it matters: The updated terms now authorize the sale or commercial sharing of data collected through cookies from major ad platforms (Facebook, Bing, Google, Braze, LinkedIn). This expands how Mercury may use or share user data beyond advertising and analytics functions. Organizations relying on Mercury should update their own privacy disclosures to reflect this expanded data-sharing purpose.

Why it matters: The updated policy formalizes seller obligations that were previously implicit, reducing ambiguity around listing accuracy, pricing practices, and order fulfillment. More significantly, the policy establishes Poshmark's explicit authority to suspend or terminate seller accounts at sole discretion for violations, centralizing enforcement authority without defined appeal procedures. This creates operational and financial risk for sellers dependent on Poshmark as a sales channel.

Why it matters: The expanded Seller Policy explicitly codifies seller obligations that were previously implicit or scattered across multiple documents. By centralizing these requirements, Poshmark establishes clear expectations for product accuracy, fulfillment conduct, and pricing practices, while reserving the right to enforce compliance through account suspension or termination at its sole discretion. Sellers who fail to comply with these requirements may face account restrictions or permanent removal from the platform.

Why it matters: The removal of explicit consent and opt-out language from the user-facing registration interface affects how transparently Shein communicates privacy rights and marketing opt-out mechanisms to users. Under GDPR and UK GDPR, organizations are required to obtain affirmative, informed consent and to provide clear information about how users can withdraw consent or opt out of marketing. If these disclosures have been removed from the registration flow without being relocated elsewhere, users may not receive adequate notice of their rights, and Shein may face compliance challenges. The change is operationally significant because it alters the user's experience of privacy consent and opt-out communication at a critical point in the registration process.

Why it matters: The updated Privacy Notice now explicitly states that Perplexity does not sell personal data or share conversation content with advertisers, directly addressing a core privacy concern for users of AI services. This formalized disclosure provides clearer transparency about how user data is handled in relation to advertising, which is operationally significant given the prevalence of advertiser data practices in technology services.

Why it matters: The updated terms establish explicit authority to collect detailed Web3 wallet information and share pseudonymous wallet data with third parties. The removal of US-only data storage requirements affects how customer data may be processed and where it may be retained, which is operationally significant for organizations subject to international data protection frameworks.

Why it matters: The updated terms grant Coinbase explicit unilateral authority to conduct protocol upgrade migrations on customer assets without per-migration consent, while disclaiming liability for losses during these transfers. This expands Coinbase's operational control over customer assets and eliminates a potential avenue for customer recourse if migrations result in losses, making the terms of asset custody and migration procedures materially more favorable to Coinbase.

Why it matters: The removal of Samsung's prior commitment to delete personal information from defective devices before analysis represents a material shift in data handling for warranty service; the policy now permits analysis of returned devices without the pre-deletion protection customers may have expected. The expansion of repair-related data collection and the addition of state privacy rights disclosures clarifies Samsung's data practices and consumer opt-out rights, but the loss of the data-wiping guarantee may affect consumer confidence in repair processes.

Why it matters: The updated terms establish distinct contractual frameworks for different geographic regions, moving from a single global agreement to region-specific terms. This affects how disputes are resolved (mandatory arbitration rather than litigation), what legal responsibility users bear (new indemnification obligations), and what privacy rights apply (new Job Applicant Privacy Notice). The separation of terms by geography creates the operational need for users and recruiters to understand which version applies to them and what their specific rights and obligations are under that regional version.

Why it matters: The updated terms expand the categories of device information Indeed collects by explicitly including phone numbers, and broaden the stated justification for data processing to encompass service improvement. Organizations relying on Indeed must ensure their own privacy documentation accurately reflects these expanded data collection practices and processing purposes, particularly under GDPR and similar frameworks that require clear statement of lawful basis and processing scope.

Why it matters: The updated terms now explicitly authorize collection of phone numbers as part of device data and broaden the stated legitimate basis for processing to include service improvement. This expansion increases the scope of personal information Indeed may collect and the purposes for which it may be used under its privacy framework.

Why it matters: The updated terms establish clear operational mechanics for how multi-transaction payment sessions are recorded, authorized, and subject to dispute remedies. This clarification affects clients who regularly use bulk funding or release features, as each transaction now carries independent irrevocability and distinct dispute rights. The dormant ACH provision creates a practical maintenance obligation for users whose accounts have become inactive, requiring periodic use to avoid payment method deactivation.

Why it matters: The corporate entity change from Glassdoor LLC to Indeed, Inc. affects where legal claims must be directed and who holds contractual liability. The expanded DMCA procedures create a clear, statutory dispute mechanism for copyright claims, reducing ambiguity but also increasing procedural burden on claimants. The clarified arbitration opt-out process removes discretion about whether a waiver is valid, but the removal of login deadline language shifts enforcement timing from scheduled to discretionary, expanding Glassdoor's operational flexibility without user-facing transparency about when legacy authentication will end.

Why it matters: The updated terms establish explicit legal authority for AWS to police and enforce against resale of On-Demand Capacity Reservations, creating operational risk for organizations that may have treated reservations as tradeable assets. Additionally, the differentiated Capacity Block termination window (60 minutes for UltraServer versus 30 minutes for standard instances) affects workload scheduling and orchestration practices for ML customers, requiring updated runbook documentation and automation logic.

Why it matters: The introduction of UK and EU regional schedules creates a jurisdiction-dependent compliance framework that significantly affects how businesses in those regions operate under the agreement. The expansion of sanctions screening to four regimes instead of one materially increases transaction screening complexity and risk exposure for international payment operations. The removal of default monthly billing terms shifts the onus to customers to affirmatively select renewal periods, which may affect contract management and customer retention mechanics.

Why it matters: This change introduces a new compliance pathway for self-employed individuals accepting business payments, but activates automatic tax reporting, backup withholding, and account transition rights that materially affect how income is processed and taxed. The terms establish mandatory Social Security Number collection, penalty provisions for payment misdesignation, and cash flow impacts (24% withholding) tied to tax reporting thresholds, making this operationally significant for users who qualify and enroll.

Why it matters: The updated terms introduce conditional language around a stated commitment regarding workspace admin authority over data retention. This shift from direct control to optional control may affect how enterprise customers rely on admin-driven retention settings to fulfill their own data governance obligations. Organizations with data processing agreements or compliance requirements tied to specific retention controls should verify whether this change affects their operational capability.

Why it matters: The addition of mandatory binding arbitration with elimination of court access and class action rights represents a material change to dispute resolution procedures affecting all Eufy users. The updated terms also establish affirmative acceptance of privacy and cookie policies as a mandatory condition of service use, tightening consent requirements and potentially limiting user recourse in privacy disputes. Enforceability of the arbitration clause may be subject to challenge under state consumer protection laws, particularly in California, making this a significant compliance and litigation exposure item.

Why it matters: The updated policy establishes new procedural protections and operational requirements for international personal data transfers under the Data Privacy Frameworks. For EU, UK, and Swiss users, the change creates formal complaint and dispute resolution mechanisms, including TRUSTe referral and binding arbitration options. For all users, the updated terms introduce a new requirement that Mailchimp must offer opt-out or obtain opt-in consent before using personal data for materially new purposes or sharing with external parties outside its normal processor relationships.

Why it matters: The updated terms establish a new geographic participation restriction that prevents Alberta residents from registering or using FanDuel Fantasy services. This change directly affects the platform's Canadian service footprint and may reflect regulatory changes in Alberta's gaming framework.

Why it matters: The revised privacy policy expands disclosure of data collection practices, particularly AI interactions and clipboard content, and explicitly addresses state-level health privacy frameworks. For users, this means clearer disclosure of what data is collected when using AI features and sharing content. For organizations integrating TikTok into their vendor or partner ecosystem, the entity change to TikTok USDS Joint Venture LLC and expanded regulatory references may require verification of existing data processing agreements and privacy certifications.

Why it matters: The updated language introduces ambiguity about whether data retention control is a right or a capability, and broadens the scope of data subject to admin governance, which may affect how enterprise customers structure their internal data handling practices and how OpenAI's obligations map to data protection regulations.

Why it matters: The updated policy removes published descriptions of cookie preference controls that users could previously reference to understand their options. In GDPR and PECR jurisdictions, transparency about how users can manage cookie consent is a regulatory requirement; the removal of this documentation from the public policy may create compliance gaps unless the actual website interface maintains granular consent controls and they are documented elsewhere. Organizations relying on Dun & Bradstreet as a vendor or partner may need to reassess whether the simplified disclosure provides sufficient transparency for their own regulatory obligations.

Why it matters: The updated terms establish broader contractual grounds for service suspension and denial (theft, unlawful conduct) and clarify that promotional price locks do not automatically apply to new services T-Mobile may introduce, affecting both service continuity expectations and pricing predictability for existing customers. The removal of explicit promotional price protection language creates potential disputes about whether legacy promotional commitments remain binding after service changes.

Why it matters: The restructured policy creates explicit legal and operational clarity around how personal data flows from individual users to institutional customers and how AI systems access user-generated content. For educational institutions and employers, this clarification establishes direct data-sharing relationships that may not have been adequately disclosed in prior policy language, potentially requiring updates to institutional privacy practices and data processing agreements. For individual users, the policy consolidates previously scattered disclosures into region-specific documents and explicitly discloses AI model training, which may materially affect user expectations about content use.

Why it matters: The updated terms establish a time-limited referral program with new eligibility thresholds that may disqualify some current referrers and reduce bonus amounts, affecting the financial incentive for customer acquisition through referrals. The September 30, 2026 deadline creates an enforcement date that may affect pending or in-progress referrals and requires SoFi to verify asset and deposit status at the time of referral enrollment rather than at program signup.

Why it matters: The restructured program introduces a hard deadline (Sept 30, 2026) and new qualification thresholds that directly affect referrer compensation and referral strategy. The tiered bonus structure creates financial incentives that depend on account funding levels, making the program more selective and potentially reducing payouts for referrers who do not maintain the new asset or direct deposit requirements.

Why it matters: The updated policy expands its stated scope to cover all Ford digital properties and services rather than limiting itself to two named websites, which materially affects the breadth of Ford's asserted data governance authority. Organizations relying on Ford's privacy terms or processing Ford customer data should review the updated policy to understand what data practices are now covered and whether this affects their own compliance obligations.

Why it matters: The removal of Kindle Vella from the Terms of Use eliminates explicit contractual protections that previously governed a consumer service offering digital content purchases. Users with existing Token balances or Vella content purchases now operate without contractual terms defining what those holdings represent or what rights they confer, creating uncertainty about access, refunds, and Token status going forward.

Why it matters: The updated terms formalize Zillow's authority to conduct automated and telemarketing communications across multiple channels, which may trigger Telephone Consumer Protection Act compliance obligations for Zillow and potentially for downstream business partners. The addition of call recording language establishes a new monitoring and internal use practice that users consent to as a condition of using the platform.