Recent policy changes

Why it matters: The updated terms formally establish subscription and billing procedures for a new Testosterone Membership product offering. This change clarifies how testosterone treatment users will be charged, when their subscriptions renew, and how they can cancel, reducing ambiguity around a new service line.

Why it matters: The updated policy establishes explicit disclosure of sensitive personal data collection that was not previously detailed in the privacy policy, including biometric data (facial recognition), supplemental identity verification data (full legal name, date of birth, tax ID, government ID), and tax identification numbers. This change affects how OpenSea processes and shares user data with third-party identity verification and onramp providers, and may trigger compliance review under GDPR (biometric data processing), CCPA (California residents' rights), and state biometric privacy laws. Users of onramp services should understand that their identity verification data will be transmitted to third-party providers, and users subject to identity verification for rewards should understand that facial biometric data may be processed and held by third parties for up to three years.

Why it matters: The updated terms establish new legal and operational requirements for minors to use OpenSea, which affects how parents, guardians, and the platform itself must manage access and oversight. The introduction of the embedded wallet feature with separate terms creates a distinct contractual relationship with a third-party provider, affecting how users' wallet data and private keys are governed. The expanded user conduct restrictions codify marketplace governance rules that may affect how users interact with usernames and other users on the platform.

Why it matters: The updated terms establish new operational constraints and shift responsibility for AI output verification to users. The introduction of AI Credits with monthly expiration and non-refundability creates a new usage model that differs from standard subscription-based access; users must actively consume credits within a monthly window or forfeit them. ActiveCampaign's reservation of unilateral rights to modify usage limits and implement enforcement controls without advance notice means users may experience service interruption or feature throttling at the company's discretion.

Why it matters: The updated terms establish a new account management framework that permits Vercel to suspend personal accounts and provision managed accounts for users with domain-verified work emails. This creates a bifurcated governance model where managed accounts are governed by separate terms between the employer and Vercel, not by the primary Terms of Service, which may affect how users' accounts are managed, what rights apply, and how disputes are resolved.

Why it matters: The updated sub-processor list discloses a change in Datadog's vendor ecosystem. Under GDPR and similar data protection regulations, organizations using Datadog are required to maintain current information about sub-processors that may access their data. The addition of Nebius, Inc. as an AI services vendor may require data controllers to update their own vendor management records, Data Processing Agreements, or privacy notices.

Why it matters: The updated policy establishes a new disclosed use of user data: AI interactions will be used to improve Meta's AI systems. This expands the scope of data uses disclosed in the privacy policy and creates a new condition (agreement to AI terms) for service use. Organizations relying on Threads should verify their own privacy notices and data processing agreements reflect this AI data use.

Why it matters: The updated language documents a self-service mechanism for account holders to correct personal data, reducing friction in exercising data rectification rights and providing transparency on available correction methods.

Why it matters: The updated policy now explicitly discloses that OpenRouter may share customer data to facilitate EU in-region API request routing on its Business tier. This clarifies an operational practice in the policy's data-sharing section, ensuring users and organizations relying on EU in-region routing understand how their data is handled for that service.

Why it matters: The updated Sub-Processors list expands the disclosed third parties that may access customer data, which affects data controllers' compliance obligations under GDPR, CCPA, and similar regulations. Organizations using Datadog must update their vendor management records and may need to notify their own customers or obtain consent depending on contract terms and jurisdiction.

Why it matters: The updated policy discloses a new data-sharing arrangement with Glance that may collect personal and sensitive information from participating customers for interest-based advertising. This expands the categories of third parties with access to Verizon customer data and requires explicit consent, which affects transparency and user control over data use in a rewards program context.

Why it matters: The updated guidelines establish new compliance obligations for developers submitting apps to the App Store, particularly around regulatory documentation, content moderation for AI content creation platforms, and creative asset accuracy. These changes increase the procedural and substantive requirements for app review and create new enforcement mechanisms (Developer Code of Conduct violations) that may result in app removal or account termination for non-compliance.

Why it matters: The updated policy establishes a new opt-in mechanism that expands the data Google may use for personalization and advertising. Previously, Google's policy explicitly stated it did not show personalized ads based on content from Drive, Gmail, or Photos; the revised language now permits this when users authorize cross-service data sharing. This represents a material change in how Google processes personal data across its service ecosystem and affects the transparency and control users have over their information.

Why it matters: The updated terms establish strict operational and legal requirements for Prompt-to-Voice, a feature that generates synthetic speech. The exclusion of OpenAI indemnification is the most material change: customers now bear full legal risk if generated speech infringes third-party voice rights or violates consent requirements, which may expose them to state right-of-publicity claims, GDPR violations, or emerging AI voice regulation. Organizations using Prompt-to-Voice must implement consent and disclosure infrastructure or face legal liability.

Why it matters: The updated terms establish explicit disclosure of what data Impact collects from website visitors (IP addresses, browser information, location data, and cookies) and clarify what it does not collect (personally identifying information). This formalization of data practices affects how visitors understand their privacy when interacting with websites using Impact's platform, and it may require Impact's clients to update their own privacy notices to reflect these disclosed practices.

Why it matters: The updated policy establishes explicit, legally binding commitments regarding how LlamaIndex handles sensitive Google Workspace data, including restrictions on AI training use and data broker sales. These commitments reduce data governance risk for organizations using LlamaIndex to process Google Workspace content and provide clarity on data encryption, access controls, and retention practices.

Why it matters: The updated policy makes the privacy contact method less direct by replacing a specific email address with a generic label. Users seeking to submit privacy requests or data access inquiries will need to locate the actual email through alternative means, potentially delaying their ability to exercise privacy rights.

Why it matters: Users who need to contact Kick to resolve disputes, decline arbitration, ask questions about the terms, or request support must now use the updated email address. Using the old email address may result in delayed or missed responses.

Why it matters: The updated Privacy Notice now explicitly establishes Google Cloud's compliance framework under Turkish data protection law, specifying data controller role, processing legal grounds, retention schedules, and enforceable user rights. This provides Turkish data subjects and organizations using Google Cloud with clear disclosure of how their data is handled under KVKK and establishes transparent procedures for exercising data protection rights.

Why it matters: The updated terms establish a new physical location for formal notice delivery and customer support contact. Users who need to send legal notices or reach RunPod by mail should use the new New Jersey address to ensure proper delivery.

Why it matters: The updated terms establish clearer operational procedures for ordering, payments, and dispute resolution. The narrowed arbitration scope may reduce the range of disputes subject to mandatory arbitration, though the specific carve-outs are not detailed. The addition of guest ordering on the website removes a barrier to purchase for users who prefer not to create an account, while the new Arch Card feature provides an alternative payment method subject to stated limits.

Why it matters: The updated Terms and Conditions remove detailed privacy disclosures and preference controls that were previously available inline, consolidating them into a separate privacy policy. This change affects how users access information about cookie usage, data sharing practices, and opt-out mechanisms, and may impact compliance verification for organizations that relied on the terms themselves as evidence of privacy disclosures.

Why it matters: The updated policy establishes a clearer, more structured framework for children's privacy by separating children's data handling into a dedicated notice and streamlining the parental request process. This change reflects compliance with COPPA and state children's privacy laws, which require transparent disclosure of children's data practices and accessible mechanisms for parental access and deletion rights.

Why it matters: The updated terms provide new contact addresses for support and legal communications. Users should use the new email addresses when contacting Monday.com for support or sending formal legal notices.

Why it matters: The updated terms clarify which third-party model licenses apply to Together AI's services by adding an explicit reference to the Meta Muse-Spark model license. Users and organizations deploying models through Together AI should review all referenced third-party licenses to ensure compliance with their own use cases and customer agreements.

Why it matters: The updated terms clarify the legal entity providing services (SpaceXAI LLC) and formalize the scope of API integration rights and end-user liability allocation. Enterprise customers should update vendor records and ensure their own customer agreements align with the stated liability framework.

Why it matters: The updated terms establish mandatory dispute resolution in Texas courts with a class action waiver, which eliminates the ability to pursue class actions or sue in home jurisdictions. The automatic transfer of X credential data (previously opt-in) expands data sharing without affirmative user election. These changes materially affect consumer rights, dispute resolution options, and data handling practices.

Why it matters: The updated terms establish Walmart's explicit right to use any content you submit for AI training and machine learning development, while simultaneously prohibiting third parties from scraping Walmart.com data for AI purposes. This creates an asymmetry in AI rights: Walmart can use your content for AI, but you cannot use Walmart's data for AI. Additionally, the Rewards Program timing change may result in your card being charged the full order amount before Rewards are applied, and new delivery liability disclaimers limit Walmart's responsibility for late or failed deliveries.

Why it matters: The updated notice establishes explicit transparency regarding voice data collection practices, clarifying that voice interactions are converted to text but not analyzed for biometric purposes. This disclosure addresses growing consumer and regulatory attention to voice data handling and expands privacy rights for Connecticut residents to match those in Oregon and Minnesota.

Why it matters: The updated privacy notice provides more explicit disclosure of personal data categories Booking.com collects during trip reservations, including sensitive information such as date of birth, current location, and travel companion details. This expanded transparency helps users understand what data is collected and how it is used, which is operationally significant for compliance with privacy regulations that require clear disclosure of data collection practices.