Recent policy changes

Why it matters: The updated policy introduces explicit disclosure of biometric data collection for age and identity verification, which triggers heightened privacy compliance obligations under GDPR, CCPA, and state biometric privacy laws. The clarification that enterprise customer data is excluded and governed separately may require organizations to review their customer agreements to ensure data handling terms are adequately documented. The expanded disclosure of model training use cases, even when users opt out, affects how users' data may be processed for AI model improvement.

Why it matters: The updated policy reverses WhatsApp's prior position on advertising, now explicitly disclosing that ads may appear in Status and Channels. This represents a material change to the user experience and the advertising model. The addition of a US privacy rights section signals WhatsApp's recognition of state-level privacy obligations and directs US residents to a separate notice describing their rights, which may include data access, deletion, or opt-out mechanisms under applicable law.

Why it matters: The updated terms expand Mixpanel's authority to classify and process individually identifiable data as Usage Data. This change affects how customer data may be retained, used, or shared within Mixpanel's platform, and may require organizations using Mixpanel to update their own privacy notices and data processing agreements to reflect the expanded scope.

Why it matters: The updated terms establish clearer boundaries on what users can and cannot do with Writer's platform, particularly around reverse engineering, competitive use, and healthcare data. The new requirement to disclose AI-generated output as such affects how users can present content to their own customers or end users. The explicit HIPAA prohibition creates a hard compliance line for healthcare organizations.

Why it matters: The updated policy clarifies ClickUp's compliance with GDPR and UK data protection law by explicitly enumerating data subject rights and providing supervisory authority contact information. This change improves transparency for EU, EEA, and UK residents regarding how to exercise their data protection rights and file complaints. The addition of SMS messaging disclosure addresses a new communication channel and associated data practices.

Why it matters: The updated policy discloses two material practices that affect how Wealthfront uses customer data: AI training on client information and collection of personal information about minors from account holders and custodians. These disclosures clarify the scope of data use and minor data collection, which may be relevant to customers evaluating their privacy exposure and to organizations assessing Wealthfront as a vendor.

Why it matters: The extended 60-day withholding period materially affects seller cash flow and working capital management. Sellers now face twice as long a potential hold on earnings during compliance disputes, which may impact their ability to fund operations, pay suppliers, or meet financial obligations.

Why it matters: The updated terms establish explicit operational parameters for how AWS handles content for abuse detection, moving from general language to specific retention duration (30 days) and procedural clarity. This clarification is operationally significant for organizations that need to document their data handling practices, particularly those subject to data protection regulations that require transparency about retention and processing.

Why it matters: The updated privacy notice expands the scope of Gusto's privacy practices to explicitly cover retirement account access and introduces disclosure of optional AI integrations that may share personal information with third-party providers. Organizations using Gusto should ensure their own privacy documentation and vendor contracts reflect these expanded service categories and third-party data sharing practices, particularly for GDPR-regulated entities or those subject to state privacy laws requiring vendor disclosure.

Why it matters: The updated agreement eliminates sellers' contractual right to litigate disputes in California courts and instead mandates arbitration (or alternative dispute resolution specified in Whatnot's main Terms of Service). This removes jury trial and class action rights for seller-platform disputes and makes dispute resolution more costly and time-consuming for individual sellers. The addition of an explicit material breach clause tied to content commitments also creates a new ground for immediate contract termination, increasing enforcement risk for sellers who miss programming deadlines.

Why it matters: The updated agreement eliminates sellers' ability to litigate disputes in court and mandates arbitration under Whatnot's standard Terms of Service, which includes class action waiver provisions. This materially changes the dispute resolution process and remedies available to sellers, and the incorporation by reference means dispute procedures may change if Whatnot updates its main Terms of Service. Additionally, the explicit material breach provision for 30-day non-performance of content commitments creates a clearer trigger for account suspension or termination.

Why it matters: The updated terms establish explicit operational requirements for database engine lifecycle management and third-party licensing compliance. Customers operating RDS instances on end-of-life engines now face the risk of automatic instance deletion after AWS notice, requiring proactive upgrade planning. For RDS Custom deployments with Microsoft software, the terms create a new verification requirement with Microsoft before deployment, affecting procurement and compliance workflows.

Why it matters: The updated terms establish that organizations deploying Amazon Connect Talent for employment decisions bear full legal responsibility for employment law compliance, bias assessment, applicant consent, and discrimination prevention. This creates material compliance obligations that affect vendor contracts, privacy notices, internal hiring processes, and regulatory exposure. Organizations must evaluate whether their current systems and processes can meet these requirements before deploying Connect Talent.

Why it matters: The updated terms establish a broader scope of operational authority for Mistral AI when users connect third-party services, explicitly authorizing data modification, deletion, and transmission in addition to retrieval and processing. This change affects how data flows through integrations and clarifies the allocation of responsibility between Mistral AI and users for actions performed on connected systems.

Why it matters: The updated terms establish that Uniswap no longer warrants the availability or legality of any digital asset in your jurisdiction, and places full responsibility on you to verify compliance with local laws and asset-specific restrictions. This is operationally significant because it means you cannot rely on Uniswap's platform access as confirmation that an asset is legal for you to trade, and you must independently verify eligibility before transacting.

Why it matters: The updated policy establishes a gatekeeping mechanism for child access to Figma by requiring institutional agreements, and explicitly prohibits a category of data use (AI training) that was not previously addressed in the children's section. This aligns Figma's practices with COPPA and GDPR child-protection requirements and signals a commitment to restricting commercial exploitation of child data. For schools, this creates a new contractual obligation; for parents, it narrows the circumstances under which they can invoke data-protection rights.

Why it matters: The updated terms reduce the interest income SoFi members earn on savings balances. Members holding savings accounts will receive lower annual returns on their deposits under the new rates, which affects the financial benefit of maintaining funds in SoFi savings accounts compared to other deposit products.

Why it matters: The updated terms establish a new program through which Midjourney can acquire user-generated translations with full intellectual property ownership and monetization rights. Users who participate assume warranty liability for third-party rights violations while receiving no compensation or attribution. Organizations should clarify whether employees or contractors may participate and assess potential IP or indemnification implications.

Why it matters: The updated terms establish that Cash App can now aggregate your account and card limits into a single combined limit across all your accounts and cards. This means your total spending, transfers, and withdrawals are subject to one aggregated cap rather than separate limits per account or card, which may affect how much you can transact if you maintain multiple accounts or cards.

Why it matters: The updated terms establish mandatory arbitration and class action waiver provisions that materially restrict consumer access to courts and class remedies for disputes with eBay. The agreement also expands eBay's unilateral authority to suspend or terminate accounts and clarifies seller performance obligations, creating new operational constraints for merchants using the platform.

Why it matters: The updated policy provides more explicit disclosure of data collection practices for signed-out users and expands the categories of activity disclosed as collected, which affects transparency about what data Google retains and how it is used. The reorganization of privacy controls into distinct history categories clarifies how users can manage their data retention preferences across different Google services.

Why it matters: The updated policy establishes detailed compliance obligations for sellers and expands Poshmark's enforcement authority to remove items, suspend accounts, withhold payment, and dispose of prohibited items at sole discretion. Sellers who fail to comply face immediate and permanent account suspension and payment withholding, making this change operationally significant for anyone selling electronics, cosmetics, mystery boxes, or undergarments on the platform.

Why it matters: The updated policy establishes a comprehensive framework for marketplace content moderation with explicit restrictions across multiple categories and reserves broad enforcement authority to Poshmark including item removal, sales cancellation, payment withholding, and account suspension. Sellers now bear affirmative responsibility for verifying compliance before listing, and face material risk of financial and account consequences for violations. The policy's scope and enforcement mechanisms may engage regulatory scrutiny regarding unfair or deceptive practices.

Why it matters: The updated policy now discloses that Duolingo collects audio from all users for product improvement, not only iOS users. This expands the scope of audio data collection to Android and web users, who were previously excluded from this practice according to the prior policy language.

Why it matters: The updated terms establish that RapidAPI will not be liable for abuse or misuse of APIs on its platform. This shifts responsibility for API security and proper use away from RapidAPI and toward API providers and consumers, which may affect how disputes over API harm are resolved and who bears the cost of remediation.

Why it matters: The updated policy clarifies Verizon's data practices and expands opt-out mechanisms to Frontier customers, addressing emerging regulatory scrutiny around AI training and marketing consent. The explicit LLM training restriction and revised consent model reflect evolving privacy expectations, though the shift from automatic opt-out to consent-seeking may require customers to take active steps to limit marketing-related data use.

Why it matters: The noncancellable reserved capacity obligation creates explicit financial liability that persists even if you terminate the service agreement, affecting cost planning and exit strategies. The expanded data retention for Kiro Free Tier users establishes a new practice of storing user inputs for 60 days, which may engage privacy compliance obligations depending on jurisdiction and the sensitivity of retained data.

Why it matters: The introduction of BYOC deployment provides customers with a new option to maintain data residency and infrastructure control, addressing a material governance concern for regulated organizations. The explicit LLM training restriction clarifies a critical data protection commitment in an environment where AI model training practices are increasingly subject to regulatory scrutiny and customer expectations. The expanded warranty disclaimer narrows the platform's implied reliability guarantees, which may affect how organizations assess vendor risk and structure their own service commitments.

Why it matters: The updated notice clarifies that Google's use of chats for anonymized service improvement operates independently of the Keep Activity setting, which may affect how users understand their data control options. The new disclosures about Gemini Spark automation and explicit warnings about automation mistakes provide transparency about capabilities and risks that users should understand before enabling these features.

Why it matters: The updated privacy statement makes explicit DocuSign's practice of sourcing marketing contact data from third-party data providers, which affects how personal information is collected and used for sales outreach. This disclosure is operationally significant for individuals in third-party marketing databases and for organizations using DocuSign that must disclose vendor practices in their own privacy notices and data processing agreements.