Recent policy changes

Why it matters: The updated terms remove a standardized trial guarantee and replace it with variable, subscription-specific trials disclosed only at checkout. This shifts the burden of discovering trial terms to the point of purchase and creates operational uncertainty about trial length, which may affect consumer decision-making and compliance with negative-option regulations that require clear advance disclosure of trial terms.

Why it matters: The updated terms establish explicit Data Privacy Framework certification and clarify Twilio's liability for third-party data processors, which directly affects how personal data from EU, UK, and Swiss residents is protected and transferred to the US. The addition of specific opt-out rights and complaint handling procedures creates new mechanisms for users to control data sharing and secondary uses, and establishes a formal escalation pathway to regulatory authorities for UK residents.

Why it matters: The updated terms establish clearer procedures for account deletion and verification, introduce a new communication feature with consent and geographic restrictions, and narrow the scope of content licensing. These changes affect how users interact with account management, identity verification, and content sharing on the platform. The explicit Washington State restriction on BeePitched may reflect state-specific privacy or harassment law compliance.

Why it matters: The updated terms establish SoFi's explicit contractual authority to modify subscription fees and billing intervals upon advance notice, which materially changes the pricing stability members previously had under the prior language. The removal of the crypto match benefit and introduction of travel rewards represents a significant change to the value proposition of the SoFi Plus subscription, affecting members who relied on crypto rewards as part of their membership benefits.

Why it matters: The updated terms establish a no-warranty, user-verification-required model for GenAI Features, shifting responsibility for output accuracy and compliance entirely to users. This creates operational and compliance considerations for organizations that integrate these features into their own products or services, particularly regarding how they disclose limitations to their own customers and whether they can operationally enforce the personal data prohibition.

Why it matters: The updated policy establishes explicit disclosure of third-party data sourcing and combination practices, which affects how user data is processed and supplemented on the platform. This transparency change is operationally significant for users who want to understand the full scope of data sources Substack uses, and for organizations that need to account for Substack's data practices in their own privacy and vendor management frameworks.

Why it matters: The updated terms establish new cryptocurrency conversion services and clarify that users never own stablecoins transferred through Cash App, with Cash App retaining full title and custody. The terms place sole responsibility on users for blockchain address accuracy and explicitly state that errors result in permanent, irreversible loss of funds with no recovery available, which materially affects how users must approach these features and the risks they assume.

Why it matters: The updated policy introduces new data collection and processing practices that affect how Ancestry handles your information. The explicit disclosure of AI-powered support interactions and the new photo face-grouping feature with consent requirements clarify practices that may not have been previously disclosed; the policy also adds SMS messaging as a communication channel, which requires your express opt-in. These changes establish new consent and disclosure obligations that may affect how you interact with Ancestry's services and how your data is processed.

Why it matters: The updated terms establish a new multi-party data processing arrangement in which user content is transferred to and processed by Anthropic outside AWS infrastructure. Organizations adopting Claude Platform on AWS must evaluate whether this cross-border data transfer and Anthropic's separate terms align with their data protection obligations, vendor management policies, and any data residency commitments they have made.

Why it matters: The updated terms establish clearer ownership rules for avatars and introduce formal governance for third-party integrations, which affects how users can leverage Runway's platform and what responsibility they bear for external tools. The expanded liability carve-outs provide additional protections for users in cases of gross negligence or intentional misconduct, while the new Non-Runway Services section clarifies that third-party integrations operate outside Runway's warranty and support framework.

Why it matters: The updated policy clarifies that audio, transcripts, and screen recordings generated through Runway are treated as user content subject to Runway's data processing terms, and extends formal recognition of privacy rights to residents of Japan and three additional US states. This affects how users' voice and screen data may be retained, used, and disclosed, and establishes a clearer mechanism for residents of these jurisdictions to request access, deletion, or portability of their personal information.

Why it matters: The updated privacy notice now explicitly discloses voice and audio transcription practices and clarifies that personal data may be shared with Coursera's affiliates and subsidiaries. This expanded transparency and recipient disclosure affects how personal data flows through Coursera's corporate structure and may require organizations using Coursera to update their own data processing agreements and privacy notices.

Why it matters: The updated terms establish automatic 7% annual fee increases at renewal, shifting the default from fixed pricing to automatic escalation. This change affects how customers budget for Mixpanel costs and requires active negotiation or written agreement to maintain pricing stability across renewal cycles.

Why it matters: The updated terms establish a new service for developers to build AI agent payment solutions while explicitly disclaiming AWS's role as a financial services provider or fund custodian. This clarifies the liability and compliance boundary: developers bear full responsibility for regulatory compliance, safeguards, and transaction liability, while AWS acts only as a message-routing intermediary. Organizations considering this service must evaluate whether their use case requires financial services licensing and whether they can operationally and legally accept sole liability for payment disputes and transaction accuracy.

Why it matters: The updated policy establishes new transparency about how Substack uses account identifiers for child safety purposes and creates enforceable rights for users to object to personalization processing and receive timely responses to privacy requests. These changes align Substack's practices with GDPR and UK GDPR requirements and give users concrete mechanisms to control how their data is processed.

Why it matters: The updated policy establishes explicit data retention timelines and deletion procedures that affect how organizations can rely on Cohere's platform for data processing. The 30-day retention period for Enterprise Users clarifies the data lifecycle, and the formalized deletion request process provides a mechanism for addressing inadvertently included personal information. The expanded language on international transfers and sub-processor arrangements provides greater transparency on how data flows across jurisdictions, which is operationally significant for organizations subject to GDPR, UK GDPR, or other data protection frameworks.

Why it matters: The updated policy reverses a prior explicit statement that OpenAI does not engage in targeted advertising or cross-contextual behavioral advertising. The change now authorizes sharing limited personal data with marketing partners for these purposes, subject to opt-out controls. This represents a material shift in OpenAI's stated data handling practices and may affect how users' data is used for advertising on third-party properties.

Why it matters: The updated terms establish explicit opt-out mechanisms for personal data sale and targeted advertising, with specific Colorado Privacy Act compliance language. This change operationalizes consumer privacy rights by providing functional controls (toggle, legal contact) to exercise those rights, and discloses third-party data collection practices that were previously not explicitly addressed in the cookie policy.

Why it matters: The updated terms expand the scope of chat-based personalization to users in jurisdictions that were previously excluded, which may affect how organizations document lawful basis for processing, structure consent mechanisms, and represent data handling practices to their own users. The explicit listing of Memory as a consent-required feature clarifies that affirmative user agreement is required, which may necessitate updates to existing consent flows and privacy notices.

Why it matters: The updated terms establish formal governance for GitHub's AI features and explicitly reserve GitHub's right to use Input data for model development and improvement. This clarifies what data GitHub may process when users interact with Copilot and other AI tools, which is operationally significant for organizations that process sensitive or personal data through these features and may trigger updates to privacy policies and data processing agreements.

Why it matters: The updated policy establishes explicit, enforceable data subject rights for EU, UK, and Swiss individuals whose personal information Glassdoor transfers to the United States under the Data Privacy Framework. The addition of a formal complaint escalation pathway through BBB National Programs and binding arbitration creates a structured mechanism for resolving privacy disputes, and the new opt-out/opt-in requirements for third-party data sharing provide individuals with control over how their data is used beyond its original purpose.

Why it matters: The updated Developer Policy establishes formal, mandatory access control and monitoring obligations that create new operational and compliance requirements for organizations using Plaid's services. Developers must now implement role-based access management, document business justification for access, and conduct regular access reviews, shifting responsibility for access governance from Plaid to the developer. Plaid's new monitoring capabilities and liability disclaimers also mean that developers bear full responsibility for unauthorized access or data loss resulting from access control failures.

Why it matters: The updated policy introduces two new data collection and processing practices: Session Replay activity logging and Math Tutor audio/transcript handling with third-party sharing. These changes expand the scope of user activity monitoring and AI vendor access to user data, which may affect privacy expectations and require updates to organizational data governance if Duolingo is used in an enterprise or educational context.

Why it matters: The updated terms establish a material shift in dispute resolution for non-US consumers, who can now sue Meta in their home country courts rather than being required to litigate in California. This change affects the practical cost, accessibility, and applicable law for resolving disputes. The 30-day notice requirement also gives users advance opportunity to review and respond to term changes before they take effect, rather than accepting changes upon continued use.

Why it matters: The updated privacy statement expands transparency around data collection practices by explicitly disclosing voice input collection (transcripts and recordings), inferences about user ad preferences, and advertiser data collection. These disclosures clarify what data Netflix collects and how it uses that data for advertising and service personalization, which affects how users understand their privacy exposure and may inform decisions about feature use and account settings.

Why it matters: The updated terms introduce a new direct-to-consumer monitoring service and clarify how Plaid shares account data with third-party applications. This affects what information Plaid may collect about your account activity, what notifications you may receive, and how your account information may be shared with third-party apps when you request services from them.

Why it matters: The payment method restriction creates a procedural change for high-volume customers that may affect cash flow management and billing workflows. The removal of the service functionality guarantee shifts risk to customers by eliminating Twilio's prior commitment to maintain overall service capability, allowing the company to reduce features or functionality without contractual constraint. The establishment of regional entities for Mexico and Brazil may affect dispute resolution, liability allocation, and regulatory compliance in those jurisdictions.

Why it matters: The updated policy expands Nintendo's disclosed uses of location data and explicitly discloses collection of persistent identifiers from child accounts for operational and advertising purposes, supported by contractual restrictions on service provider use. These changes affect how parents understand what data Nintendo collects from their children and what uses are permitted, and enhance parental visibility into which third-party apps have access to child account information.

Why it matters: The updated terms establish mandatory arbitration and class action waivers that fundamentally change how users can resolve disputes with Noom, and clarify that Noom can terminate your account at any time without cause. These changes affect your legal rights and remedies, and the arbitration requirement means disputes will be resolved in a private process rather than in court. The automatic renewal and price change language clarifies Noom's authority to charge you for paid subscriptions and adjust pricing, which affects your financial obligations.