Recent policy changes

Why it matters: The change converts zelle.com from a marketing destination into a legally binding privacy notice that requires your consent to data collection merely by visiting. This means Zelle is now asserting broad authority to collect and use your personal information on the basis of your presence on the site, and the notice warns that you should not visit if you disagree.

Why it matters: The revision scale indicates material changes to GitHub's service terms. The removal of 40 sentences and modification of 54 others suggests changes to core provisions governing acceptable use, intellectual property handling, liability, dispute resolution, or data processing. Users and organizations with GitHub in their vendor stack should identify the specific provisions that changed to assess operational and contractual implications.

Why it matters: The addition of Mexico and Brazil service entities creates distinct legal contracting relationships with regional companies, potentially affecting dispute venue, applicable law, and regulatory compliance for customers in those jurisdictions. The removal of the functionality protection clause broadens Twilio's contractual authority to modify service features without the prior constraint that changes be non-material to overall functionality, shifting risk to customers who may have relied on that commitment for service stability planning.

Why it matters: The expanded privacy notice provides substantially more detail about what data Booking.com collects from travelers, how it uses that data (including for AI-driven decisions), who it shares data with, and what rights travelers have. For travelers considering booking through Booking.com, the additional transparency allows more informed decisions about data privacy before committing to a reservation.

Why it matters: Transparency about server locations is a key privacy disclosure that affects where your data is stored and what data protection laws apply. Removing UK from the list changes what the policy tells you about data handling and may indicate a shift in infrastructure that affects your rights under UK and EU data protection law.

Why it matters: The updated terms make explicit that Noom is not a substitute for medical care and that its coaching and food features may be inaccurate, which is critical for users who might rely on it for health decisions. The new language also reserves Noom's right to terminate your account at any time without stated cause or process, expanding the company's unilateral control over your access.

Why it matters: Nintendo now explicitly discloses that it collects and permits service providers to collect persistent identifiers from child users for specific operational purposes, and parents can see exactly which apps are authorized to access their child's account, providing clearer visibility into data practices affecting children. The shift from ESRB to CARU oversight represents a change in the third-party body conducting independent audits and enforcement of the company's child privacy compliance.

Why it matters: Microsoft disclosed a new marketing contact method (AI-generated voice calls) that consumers may not expect, requiring them to verify their consent preferences. Simultaneously, the company made its data retention commitments less specific and more operationally broad, which reduces consumer clarity about how long their data is kept and may complicate vendor compliance verification.

Why it matters: The removal of response timelines for privacy rights requests eliminates a compliance commitment that operationalized GDPR and UK DPA obligations, creating ambiguity about what timeline now applies when users exercise data subject rights. The removal of explicit child safety consortium disclosure eliminates transparency about a data processing practice, which may affect users' ability to understand what data is shared and for what purpose, and may create compliance questions under transparency-focused regulations like GDPR Article 14.

Why it matters: The updated terms establish that Plaid is now a direct service provider with its own account and monitoring platform, not just an intermediary for third-party apps. This means Plaid's use of your financial and identity data has expanded beyond facilitating third-party connections to include providing its own alerts and monitoring services, and organizations using Plaid need to verify their data processing agreements and customer disclosures reflect this expanded role.

Why it matters: The restructured terms expand Plaid's explicitly authorized scope to share your financial data for payment purposes and introduce a new direct service offering. This shift from Plaid as a connection intermediary to Plaid as a direct service provider with its own monitoring system means Plaid's role and data-handling authority is now broader and more direct than previously stated in the account terms.

Why it matters: The updated notice establishes new authority for Chime to share customer data for joint marketing with other financial companies, which expands the scope of permitted data sharing beyond the prior disclosed categories. This change materially affects who has access to customer financial information and for what purposes, which is operationally significant under GLBA disclosure requirements and affects consumers' ability to exercise data-sharing objections.

Why it matters: The updated terms establish that children under 13 may now use Cash App with parental authorization, replacing a prior blanket prohibition. This change expands Cash App's addressable market to include minors while creating specific COPPA compliance obligations around parental consent, data use restrictions, and security that organizations relying on Cash App services should understand and incorporate into their own compliance frameworks.

Why it matters: The updated policy establishes explicit authority to disclose user information to law enforcement and financial crime investigators, which operationalizes compliance with anti-money laundering and financial crime statutes but creates new transparency obligations under state privacy laws. The clarification regarding email-based cross-platform advertising expands Binance.US's stated use of identifiers beyond its own platforms, which may affect how users understand data use and which audiences are subject to targeted advertising.

Why it matters: The updated language establishes explicit risk disclosures that Connecticut regulations and similar state regimes likely require. These disclosures address irreversibility of transactions, absence of government protection, fraud risk, and market volatility, ensuring users understand fundamental characteristics of cryptocurrency before transacting. This change affects how Coinbase communicates the nature of its service and the risks users assume.

Why it matters: The updated statement brings Netflix's privacy disclosures into formal alignment with US state privacy law frameworks by adding explicit notice of voice recording collection and advertising preference inferences, and by establishing a modular disclosure structure for state-specific privacy rights. This change operationalizes Netflix's compliance infrastructure for emerging privacy statutes and clarifies data practices that were previously referenced in general terms.

Why it matters: The updated terms establish a mandatory arbitration framework for dispute resolution, which fundamentally changes how users can assert legal rights against Netflix. Under the revised language, users cannot pursue litigation or participate in class actions through court unless they affirmatively opt out within the window specified in Section 6; this has practical implications for the cost, scope, and outcome of any dispute with Netflix.

Why it matters: The updated terms establish broader grounds for retaining personal data, expanding from transaction and legal necessity to include business operations and product development. This change affects how long data may be retained and the purposes Microsoft may rely on to justify that retention, shifting retention decisions away from unified policy guidance into product-specific documentation that users must actively consult.

Why it matters: The updated terms establish that Google makes no contractual commitment to service quality or reliability except where specific services include their own warranties. This change affects how users can seek remedies for service failures and narrows the contractual protections that previously existed under the reasonable care warranty. For organizations relying on Google services, this warranty disclaimer may affect their own vendor risk management and customer-facing representations about service reliability.

Why it matters: The updated agreement eliminates explicit contractual notice that Steam Wallet funds will expire after six months for Japanese users, removing a transparency mechanism that previously informed users of a time-dependent financial obligation. Japanese law typically requires clear disclosure of stored value expiration terms, so the removal of this contractual language may create compliance risk unless Steam has implemented alternative disclosure mechanisms outside the agreement text.

Why it matters: The removal of published disclosures about third-party sign-in data handling eliminates transparency about a material data flow. Users can no longer reference the privacy policy to understand what information Apple or Google shares with Acorns or how Acorns uses that data. Regulators may scrutinize whether omission of these disclosures constitutes material unfairness or deception. Organizations relying on Acorns' transparency to satisfy their own privacy notice obligations will need to address the gap.

Why it matters: The removal of explicit language stating the Privacy Notice does not apply to Ollie App eliminates transparency about scope boundaries. Users previously had clear notice that Ollie was governed by separate privacy terms; that notice is now absent, creating ambiguity about whether Ollie's data handling is covered by the updated notice or remains subject to undisclosed separate terms. Additionally, removing 'affiliates' from the definition of covered entities narrows the perceived scope of the Privacy Notice, which may affect how users and regulators understand what parts of Coursera's business operations are subject to the stated privacy protections.

Why it matters: The updated terms establish explicit account creation age requirements (18+) and formalize support for out-of-household Extra Member accounts. These changes affect who can create Netflix accounts and how subscription sharing is legally structured, with potential compliance implications under COPPA and age-verification frameworks in regulated jurisdictions.

Why it matters: The updated policy clarifies that Google links your activity across multiple websites and apps through cookies and other technologies as part of its integrated ad and analytics services, not just within individual analytics dashboards. This expanded and more transparent description of cross-site and cross-app tracking is relevant to users concerned about the scope of their digital footprint and to organizations that must disclose Google's data practices to their own customers.

Why it matters: Target Circle members rely on understanding how their purchases earn rewards to assess program value and plan loyalty engagement. The removed language previously clarified how transactions across different channels and delivery methods contribute to bonus eligibility and when rewards appear, information that directly affects whether customers perceive the program as transparent and trustworthy.

Why it matters: The reframed service positioning changes how Plaid describes its role and relationship with you, moving from intermediary to direct service provider. The introduction of a new web-based monitoring and alerts service creates a new data access and usage pathway that may operate independently of third-party app integrations, and understanding its scope and data practices is important for users who choose to use it.

Why it matters: The narrowed third-party disclaimer may affect transparency about which companies have access to or share your data, particularly if Riot Games owns entities it does not fully control. For California residents, the restructured privacy notice may change how purposes for data collection are disclosed, potentially affecting clarity about how your information is used.

Why it matters: The regional entity restructuring creates distinct legal counterparties and governing frameworks for Mexico and Brazil customers, affecting dispute resolution and applicable law. The removal of Twilio's commitment to maintain service functionality weakens the operational warranty customers previously had and creates ambiguity about what service changes are permissible, which may affect how organizations that rely on Twilio's stability assess their own service guarantees to downstream customers.

Why it matters: This change establishes a lawful pathway for children under 13 to use Cash App services through parental authorization, replacing a prior absolute prohibition. This shift creates direct COPPA compliance obligations for Cash App, including requirements for verifiable parental consent, account tracking, and data deletion for unauthorized child accounts. Organizations that serve families or use Cash App must evaluate whether this new framework affects their own compliance posture or vendor disclosures.

Why it matters: Parents now have greater transparency into how Nintendo collects and uses their child's data, including which apps can access the account and the specific purposes for which Nintendo collects device identifiers. The expansion of location data use to include event check-ins represents a new type of location tracking beyond games, which parents should understand.