Recent policy changes

Why it matters: The updated terms establish a new service allowing automatic Bitcoin-to-USD conversion, which introduces market-dependent pricing, irreversibility once initiated, and geographic limitations. This affects how users who receive bitcoin payments will experience currency conversion and may have implications for tax reporting, payment processing workflows, and regulatory compliance depending on the user's jurisdiction and business model.

Why it matters: The updated terms establish new governance structures for organizational use, introduce prepaid credit expiration and nonrefundability provisions that affect payment obligations, and raise the minimum age requirement to 18, which restricts access for users aged 13-17. The new API management provisions authorize Pika to establish rate limits, throttle usage, and revoke API keys, which affects developers' operational continuity. Organizations using Pika now bear explicit liability for all authorized user acts and omissions, which may require changes to internal compliance procedures and vendor contracts.

Why it matters: The updated policy establishes clear data handling practices for Voice services, including retention periods and speaker matching mechanics. This transparency allows users and organizations to understand how audio data is processed during real-time translation and how long transcripts are retained, which is operationally significant for organizations managing sensitive conversations or compliance obligations around audio data.

Why it matters: The updated terms establish explicit authorization for data sharing within merchant groups, which may affect how customer and employee data flows across locations. Organizations operating multiple Square merchant accounts should confirm whether this data-sharing practice aligns with their own privacy policies and customer commitments, particularly if they have represented data isolation across locations.

Why it matters: The updated terms establish a new substantive restriction on AI model training using Apple's services and content, which may affect organizations and individuals using Apple services in AI development workflows. The clarification of subscription commitment refund terms narrows refund eligibility and may affect subscriber expectations around cancellation rights. The expansion of Apple Bundle restrictions to all bundles (not just Apple One) affects how free trial stacking rules apply across Apple's subscription ecosystem.

Why it matters: The updated terms establish explicit, documented procedures for how Cohere handles enterprise customer data on its SaaS Platform, including opt-out controls, automatic retention limits, and monitoring practices. This expanded disclosure allows enterprise customers to understand and control their data use, and provides compliance teams with specific procedures to reference in vendor assessments and privacy documentation.

Why it matters: The updated terms establish mandatory arbitration for substantially all disputes, including those arising before or after the agreement, and eliminate access to class actions and jury trials. This change materially restricts the remedies available to users and shifts dispute resolution from courts to arbitration, which typically offers less discovery, limited appeal rights, and individual-only relief.

Why it matters: The updated terms establish new contractual restrictions that directly affect how developers can distribute, resell, or integrate Llama API access. The explicit prohibition on providing access through model aggregators, gateways, or proxies without written authorization narrows the permissible business models for API integration and may require organizations to renegotiate terms or restructure their technical architecture to remain compliant.

Why it matters: The updated terms establish formal procedural protections for EU users that align with Digital Services Act requirements, including mandatory transparency about enforcement decisions and internal appeal rights. For all users, the shift from a fixed three-strike rule to graduated enforcement means account actions will now depend on violation severity and context rather than a predetermined penalty schedule, potentially allowing more proportionate responses but also permitting immediate permanent termination for severe violations.

Why it matters: The updated terms establish explicit disclosures of personal data collection and overseas transfer practices for Korean residents, which may affect how individuals understand Anthropic's data handling and whether they choose to use the service. The addition of an opt-out mechanism for overseas transfer provides a procedural right, though the stated consequence of service limitations creates a practical constraint on exercising that right.

Why it matters: The restructuring establishes separate supplemental notices for different jurisdictions, which may affect how users understand their rights and how organizations assess vendor compliance. The explicit disclosure that marketing activities may constitute a 'sale' or 'targeted advertising' under privacy laws clarifies Anyscale's data practices, while the removal of retention and international transfer language from the main policy relocates (rather than eliminates) those obligations to supplemental notices. Organizations using Anyscale should verify that their data processing agreements and vendor assessments account for the new policy structure.

Why it matters: The updated terms establish a contractual non-compete restriction that may limit sellers' ability to develop competing services using Square's platform, and they expand Square's rights to collect and use seller business branding for AI training and product development without per-use consent. The revised payment procedures establish a primary payment method framework with fallback authorization to collect from transaction proceeds or account balance, which affects how fees are collected and may impact cash flow management for sellers.

Why it matters: The updated policy adds explicit disclosure of behavioral data collection (ads history and interests) for Free and Go users, clarifying a data category that was previously referenced only generically. This change affects how users understand what data OpenAI collects about their ad engagement and how that data is used to improve ad targeting and measurement.

Why it matters: The updated terms establish that Cash App may use third-party verification services to obtain and verify your identity information, and that identity verification does not guarantee access to all account types or services. This means your identity information may be shared with external verification companies, and you may be required to provide additional documentation even after initial verification, which affects the timeline and certainty of account access.

Why it matters: The updated privacy statement clarifies the scope of data Microsoft Copilot collects and how it uses that data for personalization across multiple Microsoft services. This affects how users' conversations and interactions are processed and shared within the Microsoft ecosystem, and may influence decisions about using Copilot features.

Why it matters: The updated policy provides substantially more detailed disclosure of what personal data Midjourney collects and how it uses that data, including explicit coverage of prompts, device information, and AI training practices. This expanded transparency affects how users understand their data rights and may influence decisions about what information to provide to the service.

Why it matters: The updated policy establishes contractual restrictions on how advertising partners can use personal information in certain states, operationally limiting cross-context behavioral advertising and profile building. The expansion of appeal rights to 17 states provides additional recourse for consumers whose information requests are denied, and the clarification of opt-out procedures ensures users understand how to exercise their choices across multiple devices.

Why it matters: The updated terms establish new legal and operational requirements for minors to use Suno's service and create a mandatory 30-day decision window for all existing users. The explicit arbitration and class action waivers narrow the legal remedies available to users in disputes with Suno. Organizations that serve minors or integrate Suno into their services must evaluate COPPA compliance and update parental consent procedures by the September 3, 2026 effective date.

Why it matters: The updated privacy statement now discloses five additional personal data categories that Hilton collects and may share with third parties. This expanded disclosure affects the transparency of Hilton's data practices and may require organizations that process Hilton customer data to update their own privacy notices and vendor documentation to maintain compliance with privacy laws requiring disclosure of collected data categories.

Why it matters: The updated terms expand Coinbase's unilateral authority to liquidate customer assets without notice to cover losses from circumstances partially outside customer control, such as failed or reversed inbound transfers. This increases the risk that customer assets may be liquidated to cover CCM losses even when the customer did not initiate a payment or delivery failure, potentially affecting settlement and liquidity for active traders.

Why it matters: The updated terms expand what advertisements Premium subscribers may encounter, moving beyond the prior language that referenced only 'live read advertisements.' Premium subscribers now face a broader range of ad formats, including host-read sponsorships and native placements, which may affect the value proposition of the Premium tier. The change clarifies Rumble's advertising practices but does not specify frequency, placement rules, or consumer controls for these expanded ad types.

Why it matters: This change fundamentally restructures how disputes between Amazon and its users are resolved. The updated terms eliminate access to courts and jury trials, prohibit class actions, and require individual arbitration through a private process. For consumers and merchants, this means disputes over account suspension, payment disputes, product liability, or contract interpretation must proceed through arbitration rather than litigation, with no opportunity to join coordinated claims. The mandatory 60-day pre-arbitration negotiation requirement adds a procedural step before arbitration can commence. For organizations with Amazon in their vendor or marketplace ecosystem, this change may require updates to dispute resolution policies and vendor agreements.

Why it matters: The updated policy documents a new Files API feature that allows persistent file storage and specifies how those files are encrypted, retained, and transmitted to model providers. The age requirement increase from 13 to 18 removes service eligibility for minors and eliminates COPPA compliance obligations, which may affect organizations serving younger users or relying on OpenRouter for age-compliant services.

Why it matters: The age increase to 18 and elimination of parental consent materially restricts who can use OpenRouter's Service. The new file-handling procedures establish automated content screening and potential law enforcement reporting, which affects users uploading files and organizations that transmit files to OpenRouter on behalf of their users. The DMCA takedown procedure and repeat infringer policy create new account termination risks for content creators and developers.

Why it matters: The updated policy provides explicit disclosure of how Hilton properties use SMS and WhatsApp to communicate with guests during their stay, clarifying a practice that may not have been previously transparent. The addition of WeChat account linking details and the expansion of U.S. state privacy law applicability may affect how Hilton processes and protects guest data in those jurisdictions. The one-day increase in CCTV retention has minimal operational significance but reflects a minor expansion of video surveillance data retention.

Why it matters: The updated terms establish clearer contractual boundaries around competitive AI model training, now requiring written approval for any use of outputs to develop or improve competing AI systems. This materially restricts how developers and researchers can use Stability AI outputs and may affect product development roadmaps. The lowering of the audio services minimum age to 13 expands access to younger users but imposes new parental consent and supervision obligations that may trigger COPPA compliance considerations. The prohibition on removing AI-generated watermarks establishes a contractual enforcement mechanism for output provenance. The narrowing of arbitration to US users only removes mandatory arbitration for Canadian users, creating a jurisdictional gap in dispute resolution.

Why it matters: The updated policy formalizes Gusto's disclosure of data sharing practices under state privacy law definitions. This affects how personal data flows from Gusto to third-party advertising and business partners, and establishes an opt-out right for users who wish to limit such sharing. Organizations using Gusto should verify their own privacy compliance reflects these practices.

Why it matters: The updated policy materially expands the scope of personal information Mercury collects and processes for business customers, now explicitly including investment profile information, demographic data, and information about employees, contractors, and dependents. Organizations using Mercury for payroll or benefits administration should review their data processing agreements and privacy notices to ensure they accurately reflect these expanded collection practices and comply with GDPR and state privacy law requirements.

Why it matters: The updated policy explicitly authorizes Verizon to collect and use voice recordings and biometric identifiers for training and personalization, and expands the stated purposes for which customer data is used to include eligibility determination for employment discounts and rewards programs. These changes formalize and broaden the scope of data uses that customers should understand when evaluating their privacy under Verizon's service.

Why it matters: The removal of email engagement data collection reduces a category of behavioral tracking previously disclosed in HubSpot's privacy policy, potentially lowering privacy compliance obligations for organizations using the platform. The addition of an explicit data removal mechanism creates a new pathway for individuals to request deletion from HubSpot's commercial dataset, operationalizing data subject rights that may be required under GDPR and CCPA.