Recent policy changes

Why it matters: The updated terms eliminate court access and jury trial rights for Australian sellers, consolidating all disputes under mandatory individual arbitration. This materially changes the dispute resolution mechanism available to sellers and may affect how they evaluate risk and enforce claims against Whatnot.

Why it matters: This change materially alters how disputes between Australian sellers and Whatnot will be resolved, shifting from court-based proceedings with defined venue to mandatory individual arbitration. The change consolidates dispute governance into cross-referenced provisions, meaning sellers must now review the main Terms of Service arbitration sections to understand their rights, creating additional complexity for dispute resolution.

Why it matters: The updated terms establish explicit authorization for AWS to share request metadata with Anthropic for usage tracking, which modifies the data-processing relationship and may require organizations to update their privacy notices and data-processing agreements if they handle regulated data. The introduction of AWS WAF AI traffic monetization formalizes a new optional payment-facilitation service that involves sharing user configuration and payment information with third parties, requiring organizations to understand their own vendor relationships and liability frameworks.

Why it matters: The updated policy establishes explicit authorization for collection of voice, audio, and location data, moving beyond the previously disclosed text-based input model. This expansion affects the scope of personal data Inflection AI may process and requires users and organizations relying on the service to understand the full range of data collection practices now authorized under the policy.

Why it matters: The updated terms shift fee disclosure from the published schedule to point-of-transaction, affecting how users encounter pricing information before committing to a transaction. This change alters cost predictability and comparison, as users can no longer review the exact fee in advance through the published schedule.

Why it matters: The updated privacy statement removes substantive governance disclosures that organizations typically rely on for vendor due diligence, DPA compliance, and regulatory transparency. The removal of certification confirmations, cross-border privacy framework adherence, data processing descriptions, and individual rights contact procedures reduces publicly available evidence of Dun & Bradstreet's privacy governance posture and may affect downstream compliance obligations for organizations that depend on Dun & Bradstreet as a data processor or vendor. Organizations in regulated jurisdictions may need to confirm these commitments through alternative documentation.

Why it matters: The removal of cookie and tracking technology disclosures from NVIDIA's Privacy Policy eliminates explicit user notice about data collection practices that were previously stated. Privacy regulations in the EU, UK, and California require transparent disclosure of tracking technologies before data collection. If NVIDIA continues to deploy cookies and tracking tools without updated disclosure language, the company may lack compliant notice mechanisms to satisfy legal requirements or obtain user consent.

Why it matters: The updated policy establishes explicit authorization and disclosure for biometric data collection and event photography practices that were not previously detailed. These additions create transparency regarding sensitive data practices and establish objection mechanisms, but also signal that Ticketmaster may implement these practices at events. Organizations that use Ticketmaster for customer data should evaluate whether these disclosed practices require updates to their own privacy notices or data processing agreements.

Why it matters: The updated Privacy Notice clarifies SoFi's tracking and data-sharing practices with explicit disclosure that user information is shared with advertising and analytics partners. The revised language establishes that continued site use constitutes acceptance of these practices unless users take action to opt out, which changes the operational default from prior implied choice language to explicit consent-on-continued-use.

Why it matters: The updated policy explicitly discloses that OpenAI receives data from advertisers and personalizes ads for Free and Go users. This clarification affects how users understand their data flows and makes available controls more transparent; users can now explicitly manage ad personalization through documented settings rather than relying on general cookie controls.

Why it matters: The updated terms establish explicit user control over tracking and data collection on SoFi's website, replacing a prior model where non-selection of preferences implied consent. This shift reflects regulatory alignment with GDPR and CCPA requirements for affirmative consent to non-essential tracking. For users, it creates actionable control over what data is collected and shared; for SoFi, it establishes a documented consent mechanism that may reduce privacy liability.

Why it matters: The updated terms introduce a material change in data flow governance: abuse detection on Anthropic models now requires explicit user consent and involves third-party data transfer, rather than remaining an implicit AWS-internal function. This operationally requires organizations to implement consent collection, disclose Anthropic's involvement in user agreements, and review third-party processing addenda. For compliance teams, this expands third-party risk governance and may trigger DPA amendment requirements.

Why it matters: The updated Privacy Statement establishes a new third-party data-sharing and contact pathway for promotional code partners. This expands the disclosed recipients of customer personal data beyond Palantir's previously disclosed third-party categories, creating a new contact vector that users should understand before signing up via promotional offers.

Why it matters: The updated policy clarifies Cursor's data handling practices by explicitly disclosing that abuse detection systems may store data for investigation, even under Privacy Mode. This represents a more specific articulation of actual data handling practices compared to the previous blanket statement, but signals that absolute zero retention is qualified by abuse detection exceptions.

Why it matters: Target's comprehensive revision of 899 sentences in its Terms and Conditions on June 10, 2026 materially affects the legal framework governing website use, account management, service access, and dispute resolution for all users. The scope of changes (442 added, 216 removed, 241 modified) suggests substantive policy revisions beyond routine updates; users should review the complete updated terms to understand how modified provisions affect their rights regarding account termination, service access, arbitration obligations, and other material terms.

Why it matters: The removal of the explicit 18+ age eligibility statement eliminates a clearly stated contractual requirement that served as a foundational eligibility criterion for both booking and hosting. This change creates regulatory uncertainty under child protection frameworks and leaves users without clear contractual notice of age restrictions, which may complicate platform enforcement and expose Airbnb to regulatory challenge.

Why it matters: The updated terms reduce the stated commitment to notify users before Personal Information disclosure, shifting from an intent to attempt notification to a discretionary option. This change affects operational clarity around when and whether users will receive advance notice of data sharing and may have implications for organizations that rely on Rumble's practices as part of their own data governance or vendor management frameworks.

Why it matters: The updated guidelines establish explicit, enforceable content moderation obligations for developers and introduce app removal as a direct consequence of non-compliance. This clarifies Apple's enforcement authority and creates a formal escalation pathway (notice, plan, removal) that developers must respond to operationally. For developers with user-generated content features or child-focused apps, this change requires proactive content governance infrastructure and compliance response processes.

Why it matters: The updated terms establish a material shift in Ford's obligation to notify you of privacy policy changes. The prior language created a standalone contractual commitment to provide advance notice; the revised language conditions Ford's notice obligation on legal requirements. This change affects how and when you will be informed of future modifications to Ford's data practices, particularly regarding connected vehicle data collection and use.

Why it matters: The updated policy adds explicit documentation of a commercial data processing practice (advertiser partnerships and ad targeting) that directly affects Free and Go users' data use. This change establishes a clear, disclosed legal basis for processing user data for advertising purposes and introduces user controls, which aligns the policy with actual operational practice and meets transparency expectations under privacy regulations like GDPR and CCPA.

Why it matters: The updated terms establish a reduced disclosure posture regarding cookie and data collection methods on the American Airlines website. Previously, the terms explicitly stated that certain cookies are essential and cannot be rejected, explained how performance cookies track site usage, and described how functional cookies store user preferences. The removal of these disclosures narrows the transparency available to users in the public-facing terms, which may create compliance questions under CCPA, GDPR, and FTC standards that require clear, accessible disclosure of data collection practices.

Why it matters: The updated policy establishes more explicit, structured disclosure of which personal information categories are collected and shared with specific recipient types. This shifts from a referential approach requiring readers to locate information across multiple sections to a consolidated table format, which may strengthen compliance with state privacy law transparency requirements and provides users clearer visibility into data sharing practices.

Why it matters: The updated Terms footer removes a direct navigation link to CCPA 'do not sell or share' disclosures, which may affect how readily California residents can locate and exercise their statutory privacy rights. California law requires covered businesses to provide an accessible mechanism for such requests; removing a prominent footer link could complicate that access and create regulatory compliance questions.

Why it matters: The updated terms establish automatic enrollment in asset staking for eligible tokens, shifting from the prior language that stated staking was optional and required explicit user designation. This change means users must take affirmative action (opt out) to prevent their assets from being moved into staking arrangements, and it introduces a July 1, 2026 deadline for users to take that action. The 14-day advance notice requirement for material changes starting July 1, 2026 also creates a new notification window for future policy modifications, though the scope and enforceability of that requirement will depend on applicable state and federal regulations.

Why it matters: The updated policy narrows the stated scope of Data Privacy Framework participation, which may affect the legal mechanisms available for transferring personal data from regulated regions to Smartsheet. Organizations processing EU, UK, or Swiss data through Smartsheet should verify whether this change introduces gaps in documented lawful transfer mechanisms, particularly if non-U.S. affiliates are involved in data handling.

Why it matters: The updated terms expand the category of data Mixpanel may classify and use as Usage Data by removing the prior contractual exclusion of individually identifiable information. Organizations that relied on this exclusion to limit how Mixpanel could use personal data must now reassess their vendor agreements and privacy controls. Under privacy regulations like GDPR and CCPA, the reclassification of individually identifiable data may trigger new obligations if the organization lacks a lawful basis for such expanded use.

Why it matters: The updated terms eliminate a prior commitment against advertising in Status and Channels, signaling that these features may be subject to future monetization. This shifts the company's stated position from 'no intention' to 'possible if policy is updated,' which materially changes the expected user experience of these features.

Why it matters: The removal of the Arbitration Agreement from the primary Terms acceptance language creates ambiguity about whether new users are explicitly bound to resolve disputes through arbitration rather than court litigation. This change affects the clarity and enforceability of SoFi's dispute resolution terms and may trigger regulatory review regarding how prominently arbitration is disclosed at onboarding.

Why it matters: The updated terms shift authorization for teen payment products from per-action parental approval to blanket delegation at account creation. This changes the operational friction for teens accessing Cards and Tags, which may increase usage of Cash App's payment and wearable products among minors. Parents should understand that authorizing a Sponsored Account now constitutes consent for teens to independently request and activate these products. The introduction of Cash App Tag fees also creates a new cost consideration for parents evaluating whether to allow teens to use the wearable payment service.

Why it matters: The updated policy establishes that Affirm qualifies as a financial institution under federal banking law, which may limit the applicability of state privacy laws to Affirm's core lending operations. The policy also newly discloses sharing of personal information with fraud prevention and identity verification providers, expanding transparency about third parties that receive consumer data.