Recent policy changes

Why it matters: The updated terms establish that Coinbase can automatically transfer your digital assets to a newer protocol version at its sole discretion, without advance notice, and Coinbase bears no liability for losses resulting from the transfer or the protocol upgrade itself. This materially shifts control over your assets from you to Coinbase and eliminates Coinbase's responsibility for execution failures or adverse outcomes, which is operationally significant for anyone holding digital assets on the platform.

Why it matters: The updated privacy statement now explicitly discloses what personal data the Wyze Watch and Band collect and for what purpose. This transparency clarifies the data handling practices tied to these devices' core notification features and may address privacy compliance obligations to provide clear notice of personal data collection.

Why it matters: The updated policy expands Samsung's authorization to collect financial data (payment card and transaction information) from a new category of users, and removes a prior transparency commitment regarding data deletion during device repair and analysis. These changes materially affect what personal data Samsung may collect and how it may handle data during device servicing, with potential implications for consumer privacy and regulatory compliance under state consumer protection laws and the FTC Act.

Why it matters: The updated policy discloses a new third-party analytics service (PostHog) and establishes explicit consent requirements for users in the EEA, UK, and Switzerland. This change affects how Fly.io collects and processes analytics data on public pages and clarifies user rights to withdraw consent. Organizations using Fly.io should verify that their own privacy notices and data processing agreements reflect these new analytics practices and consent mechanisms.

Why it matters: The updated policy now explicitly discloses phone number collection as device information, a personal data category that was not previously itemized. The expanded legitimate interest basis allows Indeed to use collected data for a broader range of purposes, including service improvement. These changes affect the scope of data collection and processing purposes disclosed to users and may require organizations using Indeed's services to update their own privacy documentation.

Why it matters: The updated terms restrict how customers can manage and monetize EC2 reservations, eliminating secondary market flexibility and creating enforcement risk through cancellation and instance termination. The extended Capacity Block termination window increases operational unpredictability for time-sensitive ML workloads, requiring customers to adjust infrastructure planning and failover strategies.

Why it matters: The updated terms establish separate contractual frameworks for UK and EU customers through regional schedules, meaning the governing Ramp entity and applicable terms now depend on company domicile. The expanded sanctions compliance framework now covers Canada, the EU, and the UK in addition to US OFAC, materially broadening the scope of prohibited entities and requiring organizations to screen against multiple jurisdictional sanctions lists.

Why it matters: The updated terms formalize tax reporting and verification requirements for sole proprietors using personal Cash App accounts to receive business payments, creating explicit compliance obligations tied to IRS reporting thresholds and backup withholding rules. This change establishes a structured service pathway with defined eligibility criteria, payment designation rules, and enforcement mechanisms that were previously informal or undisclosed.

Why it matters: The updated terms establish formal dispute resolution procedures and explicit DPF certification commitments that affect how personal data from EU, UK, and Swiss residents is handled and what remedies are available if disputes arise. The addition of binding arbitration and TRUSTe alternative dispute resolution creates new pathways for complaint resolution beyond direct contact with Mailchimp, and the clarified consent requirements for new data uses provide additional transparency and control for affected residents.

Why it matters: The updated terms establish a new geographic restriction that eliminates FanDuel Fantasy availability in Alberta, Canada. This change affects the eligibility of Alberta residents to participate in contests and may require account suspension or closure for existing users in that province. Organizations that promote or integrate FanDuel services must update their geographic targeting and customer eligibility verification to comply with the restriction.

Why it matters: The updated policy clarifies and expands the scope of personal information collection across financial services and restructures SMS consent into two distinct categories, which affects how users manage their communication preferences and how organizations using Squarespace must represent data practices to their own customers. The explicit inclusion of Balance Services and Capital Services signals Squarespace's expansion of financial product offerings, which may require organizations to update their own privacy disclosures and vendor agreements.

Why it matters: The updated terms formalize that audio files are processed through machine learning infrastructure, which may have implications for organizations subject to data protection regulations or those with specific requirements around how their data is processed. The new Model Context Protocol endpoint establishes a third-party access pathway that organizations should evaluate if they plan to integrate DeepL through AI assistant applications, as usage through this method counts toward existing subscription limits.

Why it matters: The updated terms establish a higher age barrier for Florida residents, reflecting potential state-level regulatory requirements around youth social media use. The addition of explicit sanctions compliance language and the expansion of liability exemptions to cover account suspension clarify TikTok's enforcement authority and limit user recourse for service interruptions.

Why it matters: The removal of the price-lock protection for promotional customers is operationally significant because it eliminates an explicit contractual guarantee that monthly charges would not increase except per promotion terms. The updated language now permits T-Mobile to charge for new technologies or services not expressly covered by the original promotion, which may result in unexpected price increases for customers who believed their promotional rate was locked. The expanded service termination grounds and restructured account authorization procedures also materially change how T-Mobile can manage accounts and terminate service.

Why it matters: The updated policy provides more explicit disclosure of data practices, particularly around AI training uses and data sharing with educational institutions and employers, which may reduce regulatory risk and give users clearer information about how their data is used. The prominent direction to region-specific privacy disclosures ensures users in regulated jurisdictions can access jurisdiction-specific rights and protections.

Why it matters: The updated terms establish explicit consent for automated communications and call recording as a condition of using Zillow services. This formalizes practices that may already occur but now requires affirmative user acknowledgment; users should be aware that by accepting these terms, they consent to receive marketing calls and texts via automated systems and agree that their calls with Zillow staff may be recorded.

Why it matters: The updated agreement now leads with explicit disclosure of arbitration and class action waiver provisions, making these dispute resolution mechanisms immediately visible to account holders. This reorganization may improve transparency regarding how disputes will be handled, but does not alter the substantive rights or obligations established by the arbitration and class action waiver provisions themselves.

Why it matters: The updated terms establish explicit billing and usage control mechanisms for consumable resources that were previously not clearly itemized. Organizations using Box APIs or AI features must now budget for potential overage charges and account for Box's discretionary right to implement service throttling or suspension. The restriction of notice delivery to electronic channels only may affect how organizations handle disputes or escalations with Box.

Why it matters: The updated policy explicitly authorizes sale of personal data to data brokers and advertising partners, a material expansion of the prior 'share' language. This change affects how user data flows to third parties and may trigger consumer rights under CCPA (opt-out of sale) and require legal basis documentation under GDPR. The addition of new seller categories expands the scope of data recipients when users transact on the platform.

Why it matters: The updated policy establishes explicit disclosure of call recording practices and clarifies the scope of data processing for both merchants and their customers. This change affects how organizations using Checkout.com must represent these practices in their own privacy notices and data processing agreements, particularly in regulated jurisdictions like the EU and UK where lawful basis and consent requirements apply.

Why it matters: The updated terms establish mandatory individual arbitration as the exclusive dispute resolution mechanism for all users, including for claims that arose before you agreed to these terms. This change removes access to court proceedings and class action remedies unless you affirmatively opt out within the window specified in Section 16.

Why it matters: The updated policy establishes explicit disclosure of model provider data practices and biometric processing, which materially affects how user data is handled and used. Users can now make informed choices about which model providers to use based on their data handling practices, and the policy clarifies OpenRouter's role as an intermediary that does not independently process biometric data. For organizations using OpenRouter, the expanded disclosures create obligations to update their own privacy notices and data processing agreements to reflect these practices.

Why it matters: The updated terms establish explicit commercial licensing rights over anonymized user content when prompt logging is enabled, clarifying that OpenRouter may sell or license this content for business purposes. The new warranty obligations also create potential liability exposure for users who provide inputs they do not own or that infringe third-party rights. These changes materially affect how user data and content are handled and commercialized.

Why it matters: This change fundamentally alters how Windsurf handles customer data for AI model training. The shift from opt-in to opt-out means users must take affirmative action to prevent their data from being used for training, whereas previously the company required explicit permission. For Enterprise customers, the new requirement for express written consent creates a higher procedural bar but also establishes a clear consent mechanism where none existed before.

Why it matters: The updated notice provides more granular transparency about what data Perplexity collects through different services and the legal bases for that collection. This expanded disclosure affects how users and organizations can assess Perplexity's data practices and may influence compliance assessments under GDPR, CCPA, and similar privacy frameworks.

Why it matters: The updated terms establish a new, discretionary refund denial ground based on content access. This affects refund eligibility for learners who have already engaged with course material and may create disputes over what constitutes a 'significant portion.' Organizations that offer Coursera courses should ensure their own refund policies and learner communications reflect this change.

Why it matters: The updated terms establish explicit authorization for Indeed to use job seeker profile data to generate AI-drafted applications, which engages AI governance and data-protection frameworks. This change affects how job seekers' personal information is processed and may implicate GDPR transparency requirements, CCPA automated-processing disclosures, and emerging AI regulation. The removal of the voluntary bot-validation process eliminates a previously documented data-handling procedure that some job seekers may have relied on.

Why it matters: The updated terms establish a new contractual restriction on automated access to Comcast Services, requiring express permission before deploying any AI Agent or programmatic tool. This affects developers, businesses, and organizations that currently use bots, scrapers, API integrations, or automated workflows to interact with Comcast Services, and may require them to seek explicit permission or modify their current practices.

Why it matters: The updated terms explicitly establish that AI model training is foundational to HubSpot's platform and clarify the jurisdictions to which personal data may be transferred. Organizations using HubSpot to manage customer data should verify that their own privacy notices, Data Processing Agreements, and vendor contracts accurately reflect these practices, particularly if they have made specific commitments to their customers regarding data residency or AI use restrictions.

Why it matters: The updated terms establish explicit restrictions on AI and machine learning model training using Unity platform data, requiring prior authorization and limiting automated access to Unity-designated frameworks. This materially affects how developers and organizations can use Unity data for AI/ML purposes and clarifies Unity's rights to use End User data for AI training and validation, which may require updates to vendor contracts, privacy notices, and internal AI governance policies.