Recent policy changes

Why it matters: The updated terms operationally restrict how users can access the platform (VPN prohibition), change age eligibility requirements for two states (adding Illinois, removing Virginia grandfather), and establish that DraftKings can move user funds across its multiple business lines without explicit per-transaction authorization. These changes affect account access enforcement, user eligibility, and fund custody practices.

Why it matters: The updated privacy notice expands disclosure of how data flows through third-party integrations and explicitly warns of security risks associated with custom app connections. These changes materially affect user understanding of data exposure and control, particularly for users who connect external tools or services to Gemini, and may influence vendor risk assessment for organizations incorporating Gemini into their technology stacks.

Why it matters: The updated terms establish explicit recognition that statutory consumer protection laws in UK, EU, and EEA jurisdictions cannot be overridden by the agreement, clarifying the legal hierarchy for users in those regions. The mUSD clarification operationally establishes that Consensys is not the issuer or administrator of that asset, limiting Consensys' liability for mUSD-related losses or service failures.

Why it matters: The updated policy discloses a new securities lending program that shares customer account and personal information with a third-party processor (Apex Clearing), which represents a material change to how customer data is handled if customers participate. The revision also clarifies that AI service providers are contractually bound not to use personal information for model training, addressing a growing regulatory and consumer concern about AI vendor practices. The removal of prior language about AI processing of support communications creates ambiguity that warrants clarification.

Why it matters: The updated terms establish operational guardrails for a new AI agent integration feature on Upwork's marketplace platform. The terms define what agents can and cannot do (read data, draft communications, but no autonomous contract or money movement) and require disclosure labeling for agent-generated content visible to other marketplace users. This shapes how freelancers and clients using AI tools can automate Upwork workflow tasks while preserving user control over binding decisions.

Why it matters: The updated terms establish for the first time a binding contractual framework governing AWS Bedrock's free exploration services, shifting these offerings from informal arrangements to formal terms with explicit responsibility allocations. The terms authorize AWS to discontinue these services without notice and to develop competing products based on customer work, while placing sole responsibility for legal compliance, testing, and production deployment on customers. This clarifies operational boundaries but introduces discontinuation risk for organizations relying on free consulting availability.

Why it matters: The removal of explicit supersession language eliminates contractual clarity about which governing document takes precedence when a customer has both a signed agreement and posted master terms. For customers with pre-existing written agreements, this change creates potential ambiguity that may require review to confirm their agreements remain binding and enforceable absent explicit master-terms recognition.

Why it matters: The updated terms establish that refund eligibility is no longer automatic upon cancellation and that annual renewal charges are entirely non-refundable. This modifies the practical process for obtaining a refund and limits refund eligibility for recurring charges, which may affect budget planning for individuals and organizations that use Coursera subscriptions.

Why it matters: The updated terms establish a flat $1 fee for all Paper Money Deposit transactions, eliminating the incentive structure that previously rewarded high account activity with fee relief. This change directly increases the cost of paper currency deposits for customers who previously qualified for waivers, and affects the value proposition of the Cash App Green tier by removing one of its published benefits.

Why it matters: The updated terms establish new operational procedures for autopay failure handling that directly affect revenue collection reliability for subscription and recurring billing businesses. Organizations relying on Mercury for recurring payments must understand that authorizations will auto-terminate after 2 consecutive failures and will not be re-attempted by Mercury except once for Mercury-caused system delays, requiring manual re-enrollment or collections for failed series.

Why it matters: The updated privacy statement removes specific disclosures about third-party sources from which Microsoft collects data (such as data brokers, public social media posts, and location service providers) and consolidates them into general language. This change affects the transparency users receive about how Microsoft supplements internally-collected data with outside sources, and may require organizations that rely on Microsoft's privacy disclosures for their own vendor assessment or customer transparency obligations to conduct additional due diligence.

Why it matters: The updated terms establish mandatory arbitration as the exclusive dispute resolution mechanism for influencers, removing the ability to pursue claims through California courts or jury trials. This fundamentally changes the procedural framework and forum for resolving disagreements between influencers and Whatnot, consolidating dispute handling under the platform's main Terms of Service rather than terms specific to the influencer relationship.

Why it matters: The updated terms eliminate influencers' ability to pursue disputes in court and require all disagreements with Whatnot to proceed through arbitration with a class action waiver. This materially changes the dispute resolution mechanism available to creators and reduces their practical remedies in cases involving payment disputes, account termination, or contract interpretation.

Why it matters: The updated terms shift how Google classifies and restricts certain application categories. Developers can no longer rely on the prior enumerated list to determine whether their applications fall under high-risk restrictions; they must now evaluate their use cases against a broader principle-based standard. This change affects compliance assessment, contract terms, and indemnification obligations for organizations embedding Google Maps into autonomous systems, emergency services, defense, or similar mission-critical applications.

Why it matters: The updated terms restructure tax obligations to apply service-wide and explicitly authorize the company to charge Indirect Taxes on purchases, shifting from prior Virtual Currency-specific language. This change clarifies the company's authority to collect taxes on behalf of governmental authorities and formalizes tax reporting practices. The Foreign Transaction Fee reduction to 3% provides a material reduction for international users. For remittance and Virtual Currency users, the updated terms add explicit statements that taxes and fees may reduce amounts received and the company disclaims liability, which clarifies cost allocation but may impact service economics.

Why it matters: The updated document establishes formal security commitments previously absent from public Windsurf documentation. By disclosing SOC 2 Type II certification, encryption practices, access controls, and employee security requirements, Windsurf creates a documented baseline against which procurement teams and compliance officers can evaluate the platform's data protection measures. This materialization of security practices may reduce vendor assessment friction for organizations subject to GDPR, CCPA, or internal data protection governance.

Why it matters: The updated terms establish clear procedural pathways for users to file data protection complaints and explicitly confirm rights to escalate to regulatory authorities. This clarifies dispute resolution procedures and regulatory recourse that apply under UK and EU data protection law, potentially reducing ambiguity around how Eventbrite handles privacy complaints.

Why it matters: The updated language reserves WhatsApp's operational flexibility to introduce ad formats in Status and Channels in the future, conditional only on updating the privacy policy. This revision weakens the prior unconditional commitment and may be material in jurisdictions where consumer reliance on WhatsApp's ad-free status affects the service's competitive positioning or regulatory treatment.

Why it matters: The removal of a direct, labeled footer link to CCPA opt-out controls may reduce consumer awareness and ease of access to statutory privacy rights. Under CCPA, opt-out mechanisms must remain conspicuous and accessible; the removal of a prominent footer link could complicate user discovery and exercise of these rights if the functionality is not equally accessible elsewhere on the site.

Why it matters: The updated notice materially changes Chime's stated data-sharing practice by explicitly authorizing sharing of customer financial information with other financial companies for joint marketing. This reverses the prior 2017 notice, which stated Chime did not engage in this sharing. The change is operationally significant because it creates a new disclosure obligation and may require downstream organizations that rely on Chime's data handling practices to update their own privacy notices, vendor agreements, or customer disclosures.

Why it matters: The updated policy formalizes complaint procedures and response timelines for UK and Australia users, establishing enforceable procedural standards that did not previously have explicit timelines. For merchants and businesses using Checkout, this creates a documented service standard for dispute handling that may need to be reflected in their own customer-facing policies and vendor documentation. The clarification of transaction data collection to include country information makes explicit what was previously implicit in the data types collected.

Why it matters: The updated terms establish explicit conduct prohibitions and user attestation requirements for trading certain assets. Users trading tokenized real-world assets must now affirmatively represent compliance with issuer restrictions and local legal eligibility, placing the compliance burden on users rather than the platform. The prohibition on circumventing access restrictions clarifies that users cannot work around geographic blocks or transfer limits, which may affect users in restricted jurisdictions or those seeking to bypass issuer controls.

Why it matters: The updated policy establishes explicit authorization for Medium's vendors to analyze user-generated content and AI interactions for machine learning model development. Previously, the policy limited vendor sharing to operational services; the revised language now permits vendors to scan and review your content for AI training purposes, representing a material expansion of the scope and purpose of data sharing.

Why it matters: The new Australian Creator Program Terms establish the first binding legal framework for creator submissions on Whatnot in Australia, creating enforceable obligations around content licensing, advertising disclosure, and regulatory compliance. The broad, irrevocable license grant gives Whatnot significant rights to reuse creator videos across platforms for extended periods, while the disclosure and content accuracy requirements impose material compliance obligations on creators under Australian law.

Why it matters: The updated terms establish a formal framework for Australian creators to monetize content submissions while defining Whatnot's licensing rights and imposing advertising disclosure obligations aligned with Australian law. Creators should understand that submission of content grants Whatnot broad one-year usage rights across multiple channels, while promotional content requires explicit, verifiable disclosures of any benefits received from Whatnot.

Why it matters: The narrowed definition of personal information affects what data GM must treat as subject to privacy protections under the statement, which may have downstream implications for CCPA compliance and state privacy law interpretations. The reorganized de-identification language and clarification of dealer data scope resolve prior ambiguities in the privacy statement but also indicate that de-identified data may be used more broadly than previously stated.

Why it matters: The updated terms materially alter how the BeePitched feature operates operationally and who bears responsibility for content legality and distribution. Users previously understood BeePitched as a collaborative pitch-sharing tool managed by Bumble; the revised terms establish it as a standalone content generation tool where users control distribution and bear full liability for content compliance. This shift places content responsibility and distribution logistics on users rather than on Bumble, and establishes that Bumble's involvement is limited to generation, moderation, and brief retention for those purposes.

Why it matters: The updated terms establish substantive new restrictions on how referrers can communicate about SoFi products and create administrative limits on earnings, requiring participants to navigate stricter disclosure and claim-substantiation rules or face potential bonus clawback. The introduction of a $10,000 annual cap directly limits referrer compensation regardless of referral volume, and the expansion of prohibited activities (mass email, paid search, outcome guarantees, rate-specific claims) narrows the promotional tactics available to referrers. These changes materially reshape the economic and operational model of the program, particularly for high-volume affiliate marketers or social media promoters.

Why it matters: The updated terms restructure how users access privacy controls and opt-out rights. Rather than providing an explicit button dedicated to opting out of data sales and targeted advertising, the revised language embeds consent management within a general cookie framework. This change affects the accessibility and prominence of privacy choices, and may impact compliance with statutory privacy law requirements in California and the EU that mandate clear, accessible opt-out mechanisms. Organizations relying on AI21's services should verify that the revised framework remains adequate for their vendor compliance obligations.

Why it matters: The updated terms establish explicit transparency about AI-powered processing and feature development, which strengthens disclosure compliance and clarifies how personal health data may be used. The addition of user choice over partner data sharing provides a concrete control mechanism within the AI feature ecosystem.