Recent policy changes

Why it matters: The updated terms establish explicit authorization for AWS to use customer configuration data for service improvement and related security services, with permission to store data outside the customer's configured region. This represents a material change in how AWS may process Config Content and requires organizations to evaluate whether existing data processing agreements, customer contracts, and privacy notices reflect this authorization.

Why it matters: The updated notice establishes explicit security limitations for third-party integrations that users should understand before connecting custom apps. The disclosure that Google does not monitor or secure these connections is material to users' ability to assess data risk when integrating third-party services. The introduction of temporary chats and clarification of Gemini Spark's local file access capabilities provide users with additional transparency about how their data is processed and retained.

Why it matters: The updated terms establish a new framework for AI agent access to Upwork accounts that creates mandatory disclosure obligations and restricts autonomous action to read-only and draft-confirm capabilities, with binding actions requiring direct user authentication. This affects how AI agents can be deployed on Upwork and creates compliance obligations for users to label all agent-generated communications, while also establishing that users will be charged for all agent actions regardless of approval status.

Why it matters: The updated terms establish explicit liability allocation and termination rights for AWS free exploration services, shifting responsibility for AI solution compliance, testing, and deployment entirely to users. This is operationally significant because organizations relying on AWS-assisted AI development must now independently verify compliance with applicable laws and assume full liability for any harm arising from deployment, particularly in regulated or critical systems.

Why it matters: The updated terms establish that subscription cancellation no longer automatically triggers refunds and that refunds must be requested separately, shifting the burden of initiating refunds to users. Additionally, the explicit exclusion of annual renewal charges from refund eligibility narrows the circumstances under which users can recover charges, which may affect user expectations around refund availability and cancellation procedures.

Why it matters: The updated terms establish a flat $1 fee for all Paper Money Deposits, eliminating the previous incentive structure that rewarded high-activity customers with fee waivers. This change affects how customers budget for deposits and may increase costs for users who previously qualified for the waiver by meeting spending or deposit thresholds.

Why it matters: The updated policy expands explicit disclosures of how T-Mobile uses personal data for marketing, analytics, and business needs, and introduces health data collection in specific contexts. These changes clarify T-Mobile's data practices and may affect how customers understand their data rights under state privacy laws, particularly regarding consent requirements and sensitive data handling.

Why it matters: The updated policy establishes transparency regarding AI-driven document processing in lending operations. This disclosure is operationally significant because it informs applicants that their submitted documents will be analyzed by automated tools, while clarifying that credit decisions remain human-reviewed and that vendors cannot retain or learn from their data.

Why it matters: The updated terms establish that recurring payment authorization automatically terminates after 2 consecutive failures and that Mercury does not guarantee recurring payments will process or re-attempt failed payments. This directly affects merchants' ability to collect recurring revenue and may require changes to customer communication and payment collection workflows. The liability limitation also affects merchants' recourse if Mercury system issues cause payment failures.

Why it matters: The updated terms eliminate influencers' ability to pursue disputes in court and mandate arbitration instead, which typically restricts access to class actions, jury trials, and appellate review. This is a material change to how disputes are resolved and affects the practical remedies available to influencers if they have disagreements with Whatnot over payment, content rights, account suspension, or other platform-related issues.

Why it matters: The updated terms establish that indirect taxes (sales, use, VAT, and similar) will be charged separately from stated prices and that Cash App will collect, verify, and report user tax information to authorities as required by law. This clarifies pricing transparency and expands Cash App's tax compliance obligations, which may affect how users budget for transactions and what tax information Cash App collects and shares with government authorities.

Why it matters: The updated notice changes how consumers can opt out of data sharing (now through Chime Privacy Hub rather than phone or website contact) and explicitly authorizes joint marketing with other financial institutions. These changes affect the practical mechanisms available to consumers to limit data sharing and clarify which third parties may receive their information for marketing purposes.

Why it matters: The updated policy establishes explicit protections for phone numbers collected through SMS opt-in, restricting their use to service delivery and prohibiting marketing-related sharing. This disclosure clarifies Mercury's practices and provides users with concrete opt-out mechanisms, reducing ambiguity about how their phone numbers will be handled.

Why it matters: The updated terms establish explicit contractual prohibitions on circumventing token access restrictions and shift compliance responsibility to users through representation clauses. This clarifies Uniswap's enforcement posture on issuer-level restrictions and geographic limitations, which may affect which tokenized assets are available to users in different jurisdictions and may increase the compliance burden on users to verify their eligibility before trading.

Why it matters: The updated policy explicitly discloses that vendors and service providers may analyze your posted content, messages, and AI interactions to train machine learning models. This represents a material expansion of the prior disclosure, which described vendor access only in terms of service delivery (hosting, analytics, payment processing) without mentioning content analysis or AI training. The change clarifies what third parties may do with your data and affects how Medium represents its data practices to users and to organizations that rely on Medium's privacy representations.

Why it matters: The updated terms establish a formal, binding framework for Australian creators to participate in Whatnot's content program, with explicit licensing rights, reward timelines, and regulatory compliance obligations. Creators and organizations engaging with the program should understand that Whatnot receives broad, irrevocable rights to use submitted content across multiple platforms for one year, and that participation requires compliance with Australian advertising standards and mandatory disclosure of material connections with Whatnot.

Why it matters: The updated terms establish a formal, binding framework for Australian creators to participate in Whatnot's Creator Program with clear licensing, compensation, and compliance obligations. The broad content licensing grant (non-exclusive, worldwide, irrevocable, sublicensable) and mandatory advertising disclosure requirements under Australian law create material operational implications for creators regarding content reuse and regulatory compliance.

Why it matters: The updated terms establish explicit disclosure and opt-out mechanisms for personal data sale and targeted advertising, which operationally means users can now control whether their data is shared with third parties for ads. This change reflects compliance with Colorado Privacy Act requirements and may signal that AI21 Labs is implementing privacy controls across its user base; organizations using AI21 Labs services should ensure their own privacy practices and notices align with these disclosures.

Why it matters: The updated terms establish detailed conduct and content standards that materially constrain how referral program participants can market SoFi products, requiring disclosure of material connection, prohibiting mass solicitation, and restricting claims to truthful statements based on personal experience. The introduction of a $10,000 annual cumulative cap on bonuses limits earning potential for active referrers, and the expanded reimbursement right increases SoFi's ability to reclaim bonuses for any program violation, creating financial risk for participants who do not comply with the new standards.

Why it matters: The updated policy establishes explicit, detailed definitions of 15+ personal data categories Sourcegraph collects, replacing previous generic descriptions. This change enhances transparency about data collection practices and clarifies Sourcegraph's role as both Data Controller (for direct users) and Data Processor (for customer data), which affects how organizations using Sourcegraph must describe data collection in their own privacy notices and whether they need to execute or update Data Processing Agreements.

Why it matters: The updated policy discloses new AI processing pathways (Oura Advisor and LLM provider integrations) that may process your health data beyond the core Oura service. The removal of Oura's prior commitment to notify users of government data requests reduces transparency about law enforcement access and may create compliance friction under GDPR Article 34 for EU residents and organizations that rely on Oura data.

Why it matters: The updated terms establish mandatory arbitration as the exclusive dispute resolution mechanism for Australian sellers, removing access to court-based remedies and jury trial rights. This change materially affects how sellers can pursue claims against Whatnot and may limit their legal options, as arbitration typically offers fewer appeal rights, no jury trial, and potentially higher costs than court proceedings.

Why it matters: The updated policy explicitly discloses collection of voice, audio, precise location, and emotional inferences from user interactions, and establishes indefinite retention of conversation outputs. This expands the categories of personal data Inflection AI collects and processes, and creates a material difference in data retention: outputs are kept permanently while inputs are deleted after 15 days (with exceptions). Organizations using Inflection AI and individuals subject to GDPR or CCPA should review whether this expanded collection and indefinite retention align with their own privacy obligations and customer commitments.

Why it matters: The updated terms remove upfront price transparency for instant unstaking by replacing a fixed 1% fee with a variable fee disclosed only at transaction time. This change affects how users can plan and budget for unstaking costs, as they will not know the exact fee until they initiate the transaction.

Why it matters: The updated terms establish a new data-sharing practice: when users access OpenAI Academy through organization-associated accounts, OpenAI may disclose their Academy activity to organization administrators. This creates a new data flow that organizations and users should understand, particularly in regulated industries or jurisdictions with strict data-sharing requirements. Organizations may need to update privacy notices and data processing agreements to reflect this practice.

Why it matters: The updated policy expands the categories of personal data Rumble collects and uses for advertising, including universal identifiers and sensitive information such as political opinions. The policy also clarifies that data previously treated as non-identifying may be combined to identify individuals, and introduces a flexible disclosure framework that permits Rumble to disclose personal information beyond the specific circumstances previously listed. These changes materially affect how user data is collected, combined, and shared across Rumble's expanded platform ecosystem.

Why it matters: The updated policy establishes explicit authorization for biometric data collection and event-based photography use in marketing, practices that were not previously disclosed in the policy language shown. This affects how Ticketmaster may process attendee data and use event content, and creates compliance considerations for organizations subject to biometric privacy laws or GDPR.

Why it matters: The updated policy provides explicit transparency about how OpenAI uses advertiser and partner data to personalize ads for Free and Go users, and clarifies that users have controls available in account settings. This change establishes clearer disclosure of a data practice that was previously less explicitly stated, which may affect how users understand their data use and what controls are available to them.

Why it matters: The updated terms clarify that Cursor's Privacy Mode provides training-data protection but does not guarantee zero storage by model providers when abuse detection systems are triggered. This distinction is operationally significant for organizations processing sensitive data, as it establishes that temporary retention for investigation purposes is permitted and expected. The removal of legacy Privacy Mode and requirement for admin opt-in to non-ZDR models changes how organizations must configure their workspace settings.

Why it matters: The updated policy discloses a new service offering and describes the categories of personal data collected to provision and manage that service. This expands the types of data Cash App processes beyond payment transactions to include phone plan and device information, which affects how users' personal information is handled and shared with the wireless partner.