Recent Policy Changes

Why it matters: The updated terms explicitly state that you are responsible for all actions taken by automated agents, bots, and APIs accessing your account on your behalf. This creates direct liability exposure for anyone using automation or buy-for-me services. The removal of regional term overrides consolidates enforcement under a single global framework, eliminating previously available carve-outs in the UK, EU, Japan, and South Korea, which may affect dispute resolution, liability limitations, or data processing protections that were previously region-specific.

Why it matters: The updated terms establish a new operational basis for refund eligibility tied to course content access. Learners who begin engaging with course materials before requesting refunds may find themselves ineligible, regardless of other circumstances, which affects the practical timeline and conditions under which refunds are available. Organizations that allocate Coursera courses to employees or learners should account for this new access-based threshold when setting expectations around refund availability.

Why it matters: The updated terms establish a new AI-assisted application feature that may affect the quality and customization of job applications submitted by job seekers. The explicit disclosure that job seekers must review and approve AI-drafted content clarifies responsibility for accuracy and appropriateness, which is operationally significant because job application quality directly affects hiring outcomes. The removal of the bot-verification disclosure indicates that program is no longer available as an option for certain job seekers.

Why it matters: The updated terms establish a contractual obligation requiring express permission before deploying AI Agents on Comcast services, which affects any user, developer, or business using automation tools, bots, APIs, or scraping workflows to interact with Comcast infrastructure. The definition is broad enough to cover common automation practices, making this operationally significant for organizations relying on automated integrations.

Why it matters: The updated policy formalizes email engagement tracking as an explicit data collection practice, which affects how HubSpot customers' email campaigns are monitored and how email recipient data is processed. Simultaneously, the removal of the data removal process language eliminates a stated user pathway for requesting data deletion, which may create ambiguity about compliance with GDPR erasure rights and CCPA/CPRA deletion rights unless HubSpot has provided an alternative mechanism.

Why it matters: The updated terms establish explicit disclosure and authorization for AI model training on customer data, a material shift from prior language that addressed data use only in general terms. This formalization of AI practices may require organizations using HubSpot to update their own privacy notices, data processing agreements, and internal AI governance policies, particularly in jurisdictions with emerging AI-specific regulatory frameworks such as the EU AI Act.

Why it matters: The updated terms establish binding restrictions on a common and growing use case: training AI models on platform data. By requiring prior authorization, Unity now gates a development practice that was previously unaddressed in its terms, meaning organizations that plan to use Unity data for AI training must now explicitly request permission before proceeding. This also reflects a broader industry trend of platforms establishing control over AI training on their data and services, which affects how development teams integrate with third-party platforms.

Why it matters: The updated terms establish a formal transition structure for a corporate rebranding and ownership change. Users have 30 days to review and decide whether to accept the new Cognition Platform terms; after that period, continued use constitutes binding acceptance. Organizations that depend on the service should confirm that the shift from Exafunction to Cognition does not materially alter data processing terms, service level agreements, or compliance obligations.

Why it matters: The updated terms operationally restrict how users can access the platform (VPN prohibition), change age eligibility requirements for two states (adding Illinois, removing Virginia grandfather), and establish that DraftKings can move user funds across its multiple business lines without explicit per-transaction authorization. These changes affect account access enforcement, user eligibility, and fund custody practices.

Why it matters: The updated privacy notice expands disclosure of how data flows through third-party integrations and explicitly warns of security risks associated with custom app connections. These changes materially affect user understanding of data exposure and control, particularly for users who connect external tools or services to Gemini, and may influence vendor risk assessment for organizations incorporating Gemini into their technology stacks.

Why it matters: The updated terms establish explicit recognition that statutory consumer protection laws in UK, EU, and EEA jurisdictions cannot be overridden by the agreement, clarifying the legal hierarchy for users in those regions. The mUSD clarification operationally establishes that Consensys is not the issuer or administrator of that asset, limiting Consensys' liability for mUSD-related losses or service failures.

Why it matters: The updated terms establish for the first time a binding contractual framework governing AWS Bedrock's free exploration services, shifting these offerings from informal arrangements to formal terms with explicit responsibility allocations. The terms authorize AWS to discontinue these services without notice and to develop competing products based on customer work, while placing sole responsibility for legal compliance, testing, and production deployment on customers. This clarifies operational boundaries but introduces discontinuation risk for organizations relying on free consulting availability.

Why it matters: The removal of explicit supersession language eliminates contractual clarity about which governing document takes precedence when a customer has both a signed agreement and posted master terms. For customers with pre-existing written agreements, this change creates potential ambiguity that may require review to confirm their agreements remain binding and enforceable absent explicit master-terms recognition.

Why it matters: The updated terms establish that refund eligibility is no longer automatic upon cancellation and that annual renewal charges are entirely non-refundable. This modifies the practical process for obtaining a refund and limits refund eligibility for recurring charges, which may affect budget planning for individuals and organizations that use Coursera subscriptions.

Why it matters: The updated terms establish new operational procedures for autopay failure handling that directly affect revenue collection reliability for subscription and recurring billing businesses. Organizations relying on Mercury for recurring payments must understand that authorizations will auto-terminate after 2 consecutive failures and will not be re-attempted by Mercury except once for Mercury-caused system delays, requiring manual re-enrollment or collections for failed series.

Why it matters: The updated help section no longer discloses that user-AI interactions are used to improve Meta's AI systems. Under regulations like GDPR and the EU AI Act, transparency about data processing for AI training is required; removal of this disclosure from a user-facing help section may create compliance gaps if equivalent notice does not appear in Threads' privacy policy or other binding terms. The removal also simplifies the help section and reduces guidance on account recovery options, though these may be documented elsewhere.

Why it matters: The updated terms establish mandatory arbitration as the exclusive dispute resolution mechanism for influencers, removing the ability to pursue claims through California courts or jury trials. This fundamentally changes the procedural framework and forum for resolving disagreements between influencers and Whatnot, consolidating dispute handling under the platform's main Terms of Service rather than terms specific to the influencer relationship.

Why it matters: The updated terms eliminate influencers' ability to pursue disputes in court and require all disagreements with Whatnot to proceed through arbitration with a class action waiver. This materially changes the dispute resolution mechanism available to creators and reduces their practical remedies in cases involving payment disputes, account termination, or contract interpretation.

Why it matters: The updated terms shift how Google classifies and restricts certain application categories. Developers can no longer rely on the prior enumerated list to determine whether their applications fall under high-risk restrictions; they must now evaluate their use cases against a broader principle-based standard. This change affects compliance assessment, contract terms, and indemnification obligations for organizations embedding Google Maps into autonomous systems, emergency services, defense, or similar mission-critical applications.

Why it matters: The updated document establishes formal security commitments previously absent from public Windsurf documentation. By disclosing SOC 2 Type II certification, encryption practices, access controls, and employee security requirements, Windsurf creates a documented baseline against which procurement teams and compliance officers can evaluate the platform's data protection measures. This materialization of security practices may reduce vendor assessment friction for organizations subject to GDPR, CCPA, or internal data protection governance.

Why it matters: The updated terms establish clear procedural pathways for users to file data protection complaints and explicitly confirm rights to escalate to regulatory authorities. This clarifies dispute resolution procedures and regulatory recourse that apply under UK and EU data protection law, potentially reducing ambiguity around how Eventbrite handles privacy complaints.

Why it matters: The updated language reserves WhatsApp's operational flexibility to introduce ad formats in Status and Channels in the future, conditional only on updating the privacy policy. This revision weakens the prior unconditional commitment and may be material in jurisdictions where consumer reliance on WhatsApp's ad-free status affects the service's competitive positioning or regulatory treatment.

Why it matters: The removal of a direct, labeled footer link to CCPA opt-out controls may reduce consumer awareness and ease of access to statutory privacy rights. Under CCPA, opt-out mechanisms must remain conspicuous and accessible; the removal of a prominent footer link could complicate user discovery and exercise of these rights if the functionality is not equally accessible elsewhere on the site.

Why it matters: The updated notice materially changes Chime's stated data-sharing practice by explicitly authorizing sharing of customer financial information with other financial companies for joint marketing. This reverses the prior 2017 notice, which stated Chime did not engage in this sharing. The change is operationally significant because it creates a new disclosure obligation and may require downstream organizations that rely on Chime's data handling practices to update their own privacy notices, vendor agreements, or customer disclosures.

Why it matters: The updated terms restructure how users access privacy controls and opt-out rights. Rather than providing an explicit button dedicated to opting out of data sales and targeted advertising, the revised language embeds consent management within a general cookie framework. This change affects the accessibility and prominence of privacy choices, and may impact compliance with statutory privacy law requirements in California and the EU that mandate clear, accessible opt-out mechanisms. Organizations relying on AI21's services should verify that the revised framework remains adequate for their vendor compliance obligations.

Why it matters: The updated terms establish explicit transparency about AI-powered processing and feature development, which strengthens disclosure compliance and clarifies how personal health data may be used. The addition of user choice over partner data sharing provides a concrete control mechanism within the AI feature ecosystem.

Why it matters: The updated terms eliminate court access and jury trial rights for Australian sellers, consolidating all disputes under mandatory individual arbitration. This materially changes the dispute resolution mechanism available to sellers and may affect how they evaluate risk and enforce claims against Whatnot.

Why it matters: This change materially alters how disputes between Australian sellers and Whatnot will be resolved, shifting from court-based proceedings with defined venue to mandatory individual arbitration. The change consolidates dispute governance into cross-referenced provisions, meaning sellers must now review the main Terms of Service arbitration sections to understand their rights, creating additional complexity for dispute resolution.

Why it matters: The updated terms establish explicit authorization for AWS to share request metadata with Anthropic for usage tracking, which modifies the data-processing relationship and may require organizations to update their privacy notices and data-processing agreements if they handle regulated data. The introduction of AWS WAF AI traffic monetization formalizes a new optional payment-facilitation service that involves sharing user configuration and payment information with third parties, requiring organizations to understand their own vendor relationships and liability frameworks.

Why it matters: The updated policy establishes explicit authorization for collection of voice, audio, and location data, moving beyond the previously disclosed text-based input model. This expansion affects the scope of personal data Inflection AI may process and requires users and organizations relying on the service to understand the full range of data collection practices now authorized under the policy.