Recent policy changes

Why it matters: The updated privacy notice expands disclosure of how data flows through third-party integrations and explicitly warns of security risks associated with custom app connections. These changes materially affect user understanding of data exposure and control, particularly for users who connect external tools or services to Gemini, and may influence vendor risk assessment for organizations incorporating Gemini into their technology stacks.

Why it matters: The updated terms establish explicit recognition that statutory consumer protection laws in UK, EU, and EEA jurisdictions cannot be overridden by the agreement, clarifying the legal hierarchy for users in those regions. The mUSD clarification operationally establishes that Consensys is not the issuer or administrator of that asset, limiting Consensys' liability for mUSD-related losses or service failures.

Why it matters: The updated policy discloses a new securities lending program that shares customer account and personal information with a third-party processor (Apex Clearing), which represents a material change to how customer data is handled if customers participate. The revision also clarifies that AI service providers are contractually bound not to use personal information for model training, addressing a growing regulatory and consumer concern about AI vendor practices. The removal of prior language about AI processing of support communications creates ambiguity that warrants clarification.

Why it matters: The updated terms introduce a new product feature (MCP Beta) that permits AI agents to automate certain Upwork tasks while establishing clear boundaries around autonomous action (money movement and contract finalization remain user-authenticated) and transparency (mandatory disclosure labels on all agent-generated communications). This reflects a governance approach balancing AI automation with human oversight, and signals Upwork's operational and regulatory posture on AI-assisted workplace tools; organizations using Upwork should monitor adoption rates among their vendors and may need to update internal AI governance policies to address agent-assisted job posting, proposal submission, or recruitment workflows.

Why it matters: The updated terms establish operational guardrails for a new AI agent integration feature on Upwork's marketplace platform. The terms define what agents can and cannot do (read data, draft communications, but no autonomous contract or money movement) and require disclosure labeling for agent-generated content visible to other marketplace users. This shapes how freelancers and clients using AI tools can automate Upwork workflow tasks while preserving user control over binding decisions.

Why it matters: The updated terms establish for the first time a binding contractual framework governing AWS Bedrock's free exploration services, shifting these offerings from informal arrangements to formal terms with explicit responsibility allocations. The terms authorize AWS to discontinue these services without notice and to develop competing products based on customer work, while placing sole responsibility for legal compliance, testing, and production deployment on customers. This clarifies operational boundaries but introduces discontinuation risk for organizations relying on free consulting availability.

Why it matters: The removal of explicit supersession language eliminates contractual clarity about which governing document takes precedence when a customer has both a signed agreement and posted master terms. For customers with pre-existing written agreements, this change creates potential ambiguity that may require review to confirm their agreements remain binding and enforceable absent explicit master-terms recognition.

Why it matters: The updated terms establish that refund eligibility is no longer automatic upon cancellation and that annual renewal charges are entirely non-refundable. This modifies the practical process for obtaining a refund and limits refund eligibility for recurring charges, which may affect budget planning for individuals and organizations that use Coursera subscriptions.

Why it matters: The updated terms establish a flat $1 fee for all Paper Money Deposit transactions, eliminating the incentive structure that previously rewarded high account activity with fee relief. This change directly increases the cost of paper currency deposits for customers who previously qualified for waivers, and affects the value proposition of the Cash App Green tier by removing one of its published benefits.

Why it matters: The updated terms establish new operational procedures for autopay failure handling that directly affect revenue collection reliability for subscription and recurring billing businesses. Organizations relying on Mercury for recurring payments must understand that authorizations will auto-terminate after 2 consecutive failures and will not be re-attempted by Mercury except once for Mercury-caused system delays, requiring manual re-enrollment or collections for failed series.

Why it matters: The updated help section no longer discloses that user-AI interactions are used to improve Meta's AI systems. Under regulations like GDPR and the EU AI Act, transparency about data processing for AI training is required; removal of this disclosure from a user-facing help section may create compliance gaps if equivalent notice does not appear in Threads' privacy policy or other binding terms. The removal also simplifies the help section and reduces guidance on account recovery options, though these may be documented elsewhere.

Why it matters: The updated privacy statement removes specific disclosures about third-party sources from which Microsoft collects data (such as data brokers, public social media posts, and location service providers) and consolidates them into general language. This change affects the transparency users receive about how Microsoft supplements internally-collected data with outside sources, and may require organizations that rely on Microsoft's privacy disclosures for their own vendor assessment or customer transparency obligations to conduct additional due diligence.

Why it matters: The updated terms remove contractual protections users previously relied on (warranty of reasonable care, reasonableness standard for content removal) and replace them with broad disclaimers that limit Google's liability and user recourse. The change also modifies how Google may remove user-generated content, shifting from a documented belief standard to a potential harm standard that may result in more aggressive content removal with fewer procedural safeguards.

Why it matters: The updated terms establish mandatory arbitration as the exclusive dispute resolution mechanism for influencers, removing the ability to pursue claims through California courts or jury trials. This fundamentally changes the procedural framework and forum for resolving disagreements between influencers and Whatnot, consolidating dispute handling under the platform's main Terms of Service rather than terms specific to the influencer relationship.

Why it matters: The updated terms eliminate influencers' ability to pursue disputes in court and require all disagreements with Whatnot to proceed through arbitration with a class action waiver. This materially changes the dispute resolution mechanism available to creators and reduces their practical remedies in cases involving payment disputes, account termination, or contract interpretation.

Why it matters: The updated terms shift how Google classifies and restricts certain application categories. Developers can no longer rely on the prior enumerated list to determine whether their applications fall under high-risk restrictions; they must now evaluate their use cases against a broader principle-based standard. This change affects compliance assessment, contract terms, and indemnification obligations for organizations embedding Google Maps into autonomous systems, emergency services, defense, or similar mission-critical applications.

Why it matters: The updated terms restructure tax obligations to apply service-wide and explicitly authorize the company to charge Indirect Taxes on purchases, shifting from prior Virtual Currency-specific language. This change clarifies the company's authority to collect taxes on behalf of governmental authorities and formalizes tax reporting practices. The Foreign Transaction Fee reduction to 3% provides a material reduction for international users. For remittance and Virtual Currency users, the updated terms add explicit statements that taxes and fees may reduce amounts received and the company disclaims liability, which clarifies cost allocation but may impact service economics.

Why it matters: The updated terms formally and explicitly establish that Virtual Content purchased on Roblox does not confer enforceable legal ownership rights and has no real-world equivalent value. This clarification is operationally significant because it establishes Roblox's legal position on a core consumer transaction type, affects how virtual items may be marketed and resold, and may influence consumer protection enforcement or litigation involving virtual item purchases or disputes. The expanded definitions and scope language also standardize contractual terminology throughout the agreement.

Why it matters: The updated document establishes formal security commitments previously absent from public Windsurf documentation. By disclosing SOC 2 Type II certification, encryption practices, access controls, and employee security requirements, Windsurf creates a documented baseline against which procurement teams and compliance officers can evaluate the platform's data protection measures. This materialization of security practices may reduce vendor assessment friction for organizations subject to GDPR, CCPA, or internal data protection governance.

Why it matters: The updated terms establish clear procedural pathways for users to file data protection complaints and explicitly confirm rights to escalate to regulatory authorities. This clarifies dispute resolution procedures and regulatory recourse that apply under UK and EU data protection law, potentially reducing ambiguity around how Eventbrite handles privacy complaints.

Why it matters: The updated language reserves WhatsApp's operational flexibility to introduce ad formats in Status and Channels in the future, conditional only on updating the privacy policy. This revision weakens the prior unconditional commitment and may be material in jurisdictions where consumer reliance on WhatsApp's ad-free status affects the service's competitive positioning or regulatory treatment.

Why it matters: The removal of a direct, labeled footer link to CCPA opt-out controls may reduce consumer awareness and ease of access to statutory privacy rights. Under CCPA, opt-out mechanisms must remain conspicuous and accessible; the removal of a prominent footer link could complicate user discovery and exercise of these rights if the functionality is not equally accessible elsewhere on the site.

Why it matters: The updated notice materially changes Chime's stated data-sharing practice by explicitly authorizing sharing of customer financial information with other financial companies for joint marketing. This reverses the prior 2017 notice, which stated Chime did not engage in this sharing. The change is operationally significant because it creates a new disclosure obligation and may require downstream organizations that rely on Chime's data handling practices to update their own privacy notices, vendor agreements, or customer disclosures.

Why it matters: The updated policy formalizes complaint procedures and response timelines for UK and Australia users, establishing enforceable procedural standards that did not previously have explicit timelines. For merchants and businesses using Checkout, this creates a documented service standard for dispute handling that may need to be reflected in their own customer-facing policies and vendor documentation. The clarification of transaction data collection to include country information makes explicit what was previously implicit in the data types collected.

Why it matters: The updated terms establish explicit conduct prohibitions and user attestation requirements for trading certain assets. Users trading tokenized real-world assets must now affirmatively represent compliance with issuer restrictions and local legal eligibility, placing the compliance burden on users rather than the platform. The prohibition on circumventing access restrictions clarifies that users cannot work around geographic blocks or transfer limits, which may affect users in restricted jurisdictions or those seeking to bypass issuer controls.

Why it matters: The updated policy establishes explicit authorization for Medium's vendors to analyze user-generated content and AI interactions for machine learning model development. Previously, the policy limited vendor sharing to operational services; the revised language now permits vendors to scan and review your content for AI training purposes, representing a material expansion of the scope and purpose of data sharing.

Why it matters: The updated terms shift from blanket 'as-is' warranty disclaimers to an affirmative warranty of reasonable skill and care, establishing a baseline quality standard and a dispute resolution process. The liability cap increase from $200 to $500 or 125% of fees meaningfully expands potential remedies for users claiming service failures. The 'reasonable belief' standard for content removal creates a procedural gate before takedown, affecting how Google's content moderation operates. For business users, the carve-out of Google's own negligence from indemnification obligations creates more balanced risk allocation.

Why it matters: The new Australian Creator Program Terms establish the first binding legal framework for creator submissions on Whatnot in Australia, creating enforceable obligations around content licensing, advertising disclosure, and regulatory compliance. The broad, irrevocable license grant gives Whatnot significant rights to reuse creator videos across platforms for extended periods, while the disclosure and content accuracy requirements impose material compliance obligations on creators under Australian law.

Why it matters: The updated terms establish a formal framework for Australian creators to monetize content submissions while defining Whatnot's licensing rights and imposing advertising disclosure obligations aligned with Australian law. Creators should understand that submission of content grants Whatnot broad one-year usage rights across multiple channels, while promotional content requires explicit, verifiable disclosures of any benefits received from Whatnot.

Why it matters: The updated policy formalizes and centralizes U.S. state privacy law disclosures that were previously scattered or less explicit, making it operationally clearer how users can exercise rights under the CCPA, Washington My Health My Data Act, and Nevada SB 370. This reduces ambiguity around Google's data practices and user remedies, though it does not change the underlying technical data collection or use practices.