Recent policy changes

Why it matters: The updated policy discloses a new data-sharing arrangement with Glance that may collect personal and sensitive information from participating customers for interest-based advertising. This expands the categories of third parties with access to Verizon customer data and requires explicit consent, which affects transparency and user control over data use in a rewards program context.

Why it matters: The updated guidelines establish new compliance obligations for developers submitting apps to the App Store, particularly around regulatory documentation, content moderation for AI content creation platforms, and creative asset accuracy. These changes increase the procedural and substantive requirements for app review and create new enforcement mechanisms (Developer Code of Conduct violations) that may result in app removal or account termination for non-compliance.

Why it matters: The updated policy establishes a new opt-in mechanism that expands the data Google may use for personalization and advertising. Previously, Google's policy explicitly stated it did not show personalized ads based on content from Drive, Gmail, or Photos; the revised language now permits this when users authorize cross-service data sharing. This represents a material change in how Google processes personal data across its service ecosystem and affects the transparency and control users have over their information.

Why it matters: The updated terms establish strict operational and legal requirements for Prompt-to-Voice, a feature that generates synthetic speech. The exclusion of OpenAI indemnification is the most material change: customers now bear full legal risk if generated speech infringes third-party voice rights or violates consent requirements, which may expose them to state right-of-publicity claims, GDPR violations, or emerging AI voice regulation. Organizations using Prompt-to-Voice must implement consent and disclosure infrastructure or face legal liability.

Why it matters: The updated terms establish explicit disclosure of what data Impact collects from website visitors (IP addresses, browser information, location data, and cookies) and clarify what it does not collect (personally identifying information). This formalization of data practices affects how visitors understand their privacy when interacting with websites using Impact's platform, and it may require Impact's clients to update their own privacy notices to reflect these disclosed practices.

Why it matters: The updated policy establishes explicit, legally binding commitments regarding how LlamaIndex handles sensitive Google Workspace data, including restrictions on AI training use and data broker sales. These commitments reduce data governance risk for organizations using LlamaIndex to process Google Workspace content and provide clarity on data encryption, access controls, and retention practices.

Why it matters: The updated Privacy Notice now explicitly establishes Google Cloud's compliance framework under Turkish data protection law, specifying data controller role, processing legal grounds, retention schedules, and enforceable user rights. This provides Turkish data subjects and organizations using Google Cloud with clear disclosure of how their data is handled under KVKK and establishes transparent procedures for exercising data protection rights.

Why it matters: The updated Terms and Conditions remove detailed privacy disclosures and preference controls that were previously available inline, consolidating them into a separate privacy policy. This change affects how users access information about cookie usage, data sharing practices, and opt-out mechanisms, and may impact compliance verification for organizations that relied on the terms themselves as evidence of privacy disclosures.

Why it matters: The updated terms establish mandatory dispute resolution in Texas courts with a class action waiver, which eliminates the ability to pursue class actions or sue in home jurisdictions. The automatic transfer of X credential data (previously opt-in) expands data sharing without affirmative user election. These changes materially affect consumer rights, dispute resolution options, and data handling practices.

Why it matters: The updated terms establish Walmart's explicit right to use any content you submit for AI training and machine learning development, while simultaneously prohibiting third parties from scraping Walmart.com data for AI purposes. This creates an asymmetry in AI rights: Walmart can use your content for AI, but you cannot use Walmart's data for AI. Additionally, the Rewards Program timing change may result in your card being charged the full order amount before Rewards are applied, and new delivery liability disclaimers limit Walmart's responsibility for late or failed deliveries.

Why it matters: The updated notice establishes explicit transparency regarding voice data collection practices, clarifying that voice interactions are converted to text but not analyzed for biometric purposes. This disclosure addresses growing consumer and regulatory attention to voice data handling and expands privacy rights for Connecticut residents to match those in Oregon and Minnesota.

Why it matters: The updated privacy notice provides more explicit disclosure of personal data categories Booking.com collects during trip reservations, including sensitive information such as date of birth, current location, and travel companion details. This expanded transparency helps users understand what data is collected and how it is used, which is operationally significant for compliance with privacy regulations that require clear disclosure of data collection practices.

Why it matters: The updated terms establish that premium content is a revocable license rather than a purchase, meaning subscribers lose access upon cancellation or non-payment, including downloaded content. The new AI feature sections authorize Calm to process user inputs and sensitive wellness information through AI systems, with Calm retaining ownership of generated outputs and the right to use them for service development and testing. These changes materially affect what premium subscribers own, how their data is processed, and what rights Calm reserves regarding content and AI-generated materials.

Why it matters: The updated policy establishes explicit protections for minors' data in AI training and clarifies that audio processing will not be used for identification, reducing privacy risks associated with AI-powered features. The removal of keystroke capture from AI functions narrows the scope of data collection during AI interactions. The consolidation of Busuu terms into the main policy simplifies governance but requires verification that prior Busuu-specific protections remain in effect.

Why it matters: The updated terms establish a meaningful carve-out from mandatory arbitration for sexual assault and harassment claims, which may provide affected users with access to court proceedings rather than arbitration. The expanded export compliance certification requirement and geographic restrictions may limit service availability or impose new compliance obligations on users in certain jurisdictions. The clarification of AI-Assisted Features licensing terms explicitly states that user inputs remain subject to Chegg's content license and training use rights, which has implications for how user-generated content and personal information submitted to AI services may be used.

Why it matters: The updated notice provides less granular disclosure about how SoFi uses tracking technologies and shares data with third parties. While the full privacy policy remains available, the streamlined notice removes explicit descriptions of cookie types, data sharing practices, and opt-out options that were previously disclosed, which may affect user understanding of tracking practices and available choices.

Why it matters: The updated policy explicitly discloses collection of sensitive personal information categories including geolocation, driver's license numbers, and behavioral inferences that were not previously enumerated. The policy also clarifies that third parties acting on Stash's behalf may access customer data, and expands applicability to all users of Stash services, not just registered customers. These changes affect what personal data Stash collects, how it is used, and who may access it.

Why it matters: The updated policy establishes explicit transparency regarding how Ro records and analyzes conversations with its AI patient support agent. This disclosure clarifies a data processing practice that was not previously described, which is operationally significant for users who interact with the AI agent and for organizations that use Ro as a vendor and must document how patient communications are handled.

Why it matters: The updated terms establish a new optional mechanism for automatic Virtual Currency conversion to cover ACH debits, which introduces price exposure and removes per-transaction notice requirements. This change affects how users with Virtual Currency holdings manage payment coverage and exposes them to conversion-rate risk between the time a debit is requested and when the sale is executed.

Why it matters: The updated policy discloses that Bumble now collects and processes new categories of personal data (handle, search activity, vote history, verification status) in connection with a new feature that allows users to be discovered by other members. This expanded data collection affects what personal information Bumble processes and how user activity is tracked, which is material to users' understanding of their privacy posture on the platform.

Why it matters: The updated policy expands Calm's authority to process health-related inferred data from user-provided information, which may trigger additional compliance obligations under state health privacy frameworks. Simultaneously, the policy adds explicit protections for minors and detailed privacy rights for residents of 20+ U.S. states, establishing new opt-out mechanisms and agent-designation rights that organizations using Calm's services must support operationally and disclose in their own privacy notices.

Why it matters: The updated policy discloses new categories of personal data collection (business contact data from third-party sources, voice transcription in messaging) and expands the use of personal data to include marketing of affiliate products. These changes affect how Coursera processes personal data and may trigger compliance obligations under GDPR, CCPA, and state privacy laws for organizations that use Coursera or process Coursera data.

Why it matters: The updated terms establish explicit transparency about algorithmic and data-driven factors (predicted risk scores, credit ratings) used in retailer credit assessments, and create a formal mechanism for retailers to challenge or request human review of credit decisions. This addresses fair lending and algorithmic transparency expectations, particularly under FCRA and GDPR frameworks, and may reduce disputes over credit limit decisions by providing a documented appeal process.

Why it matters: The updated terms now authorize payment data collection for any payment initiation, not just access to specific paid products. This expands the scope of payment information Cursor may collect and process, which affects what personal financial data the company gathers and how it may be used or retained.

Why it matters: The updated terms establish clearer tax compliance procedures that shift responsibility to Company for self-assessment and withholding tax obligations in certain jurisdictions, which may increase administrative burden and cost. The new Generated Content ownership framework clarifies that Company owns AI-generated output but assumes full responsibility for reviewing it for legal and rights compliance before use, creating a new operational and legal review requirement. The Stablecoin Card Addendum introduces a separate governance layer for stablecoin-funded cards that may have different terms and controls.

Why it matters: The updated policy clarifies Anthropic's enforcement scope and introduces new pathways for authorized dual-use research through verification programs. The expanded weapons development prohibitions and clarified enforcement procedures (including warnings and throttling) establish more granular control over how the platform is used. Organizations using Anthropic's services should verify compliance with the new weapons restrictions and determine whether their use cases qualify for verification program enrollment.

Why it matters: The updated terms formally establish that Beta Releases are provided without warranties, support, or liability for data loss, and that Supabase may delete Customer Data from Beta Releases without notice. This materially affects how organizations should treat Beta Releases in their data governance and backup strategies. The clarification of contracting entity based on purchase method may affect jurisdiction, applicable law, and dispute resolution, requiring organizations to confirm which Supabase entity they contract with.

Why it matters: The updated terms establish transparent content moderation procedures with human review and user notification, creating accountability mechanisms that align with regulatory expectations under GDPR and the EU Digital Services Act. The addition of indirect tax collection beginning December 1, 2026, will increase subscription costs for users in jurisdictions where Substack's service provider operates, affecting pricing and revenue calculations for subscription-based businesses using the platform.

Why it matters: The updated policy now explicitly discloses that Delta uses AI and machine learning in processing your personal data, including for fraud prevention, marketing segmentation, and customer identification. This clarification strengthens transparency regarding automated decision-making and AI use, which is increasingly relevant under emerging AI governance frameworks and privacy regulations that require explicit disclosure of automated processing.