Live feed · updated daily
Recent policy changes
426 policy changes
detected across 343 platforms. Most platforms don't announce policy changes — these updates were detected automatically.
October 17, 2026
Adds disclosure of data sharing for EU in-region API request routing to privacy policy's data disclosure circumstances.
Why it matters: The updated policy now explicitly discloses that OpenRouter may share customer data to facilitate EU in-region API request routing on its Business tier. This clarifies an operational practice in the policy's data-sharing section, ensuring users and organizations relying on EU in-region routing understand how their data is handled for that service.
Adds four AI service subprocessors and Portugal affiliate to vendor disclosure list
Why it matters: The updated Sub-Processors list expands the disclosed third parties that may access customer data, which affects data controllers' compliance obligations under GDPR, CCPA, and similar regulations. Organizations using Datadog must update their vendor management records and may need to notify their own customers or obtain consent depending on contract terms and jurisdiction.
Added disclosure of Verizon Dollars program partnership with Glance lockscreen app, which may collect personal and sensitive data for interest-based advertising with user consent.
Why it matters: The updated policy discloses a new data-sharing arrangement with Glance that may collect personal and sensitive information from participating customers for interest-based advertising. This expands the categories of third parties with access to Verizon customer data and requires explicit consent, which affects transparency and user control over data use in a rewards program context.
Expanded App Store Review Guidelines to require regulatory documentation, add AI content creation safeguards, and establish creative asset standards for developers.
Why it matters: The updated guidelines establish new compliance obligations for developers submitting apps to the App Store, particularly around regulatory documentation, content moderation for AI content creation platforms, and creative asset accuracy. These changes increase the procedural and substantive requirements for app review and create new enforcement mechanisms (Developer Code of Conduct violations) that may result in app removal or account termination for non-compliance.
Expands personalized ad targeting to include cross-service data sharing when users opt in; permits Search to use Gmail and Photos data for personalization.
Why it matters: The updated policy establishes a new opt-in mechanism that expands the data Google may use for personalization and advertising. Previously, Google's policy explicitly stated it did not show personalized ads based on content from Drive, Gmail, or Photos; the revised language now permits this when users authorize cross-service data sharing. This represents a material change in how Google processes personal data across its service ecosystem and affects the transparency and control users have over their information.
Stay ahead of the changes
You're seeing a fraction of what's changing
ConductAtlas monitors every tracked platform and captures every policy update.
Adds Prompt-to-Voice terms requiring voice consent, AI-generated disclosure, and excludes feature from indemnification coverage.
Why it matters: The updated terms establish strict operational and legal requirements for Prompt-to-Voice, a feature that generates synthetic speech. The exclusion of OpenAI indemnification is the most material change: customers now bear full legal risk if generated speech infringes third-party voice rights or violates consent requirements, which may expose them to state right-of-publicity claims, GDPR violations, or emerging AI voice regulation. Organizations using Prompt-to-Voice must implement consent and disclosure infrastructure or face legal liability.
October 16, 2026
Expanded data collection disclosures for visitor tracking, location information, and cookies; clarifies personally identifying information is not collected.
Why it matters: The updated terms establish explicit disclosure of what data Impact collects from website visitors (IP addresses, browser information, location data, and cookies) and clarify what it does not collect (personally identifying information). This formalization of data practices affects how visitors understand their privacy when interacting with websites using Impact's platform, and it may require Impact's clients to update their own privacy notices to reflect these disclosed practices.
Added Google Workspace API data handling disclosures including AI training restrictions and encryption requirements.
Why it matters: The updated policy establishes explicit, legally binding commitments regarding how LlamaIndex handles sensitive Google Workspace data, including restrictions on AI training use and data broker sales. These commitments reduce data governance risk for organizations using LlamaIndex to process Google Workspace content and provide clarity on data encryption, access controls, and retention practices.
Changed privacy policy contact method from specific email address to generic placeholder label.
Why it matters: The updated policy makes the privacy contact method less direct by replacing a specific email address with a generic label. Users seeking to submit privacy requests or data access inquiries will need to locate the actual email through alternative means, potentially delaying their ability to exercise privacy rights.
Updated support contact email across dispute resolution, arbitration opt-out, and general support sections.
Why it matters: Users who need to contact Kick to resolve disputes, decline arbitration, ask questions about the terms, or request support must now use the updated email address. Using the old email address may result in delayed or missed responses.
Added Turkish data protection law compliance section specifying data controller role, processing grounds, retention periods, and user rights under KVKK
Why it matters: The updated Privacy Notice now explicitly establishes Google Cloud's compliance framework under Turkish data protection law, specifying data controller role, processing legal grounds, retention schedules, and enforceable user rights. This provides Turkish data subjects and organizations using Google Cloud with clear disclosure of how their data is handled under KVKK and establishes transparent procedures for exercising data protection rights.
Stay ahead of the changes
You're seeing a fraction of what's changing
ConductAtlas monitors every tracked platform and captures every policy update.
Updated contact and notice address from San Francisco to Delran, New Jersey.
Why it matters: The updated terms establish a new physical location for formal notice delivery and customer support contact. Users who need to send legal notices or reach RunPod by mail should use the new New Jersey address to ensure proper delivery.
Clarified arbitration scope to 'most disputes'; added website guest ordering without account; introduced Arch Card stored value feature with transaction and balance limits.
Why it matters: The updated terms establish clearer operational procedures for ordering, payments, and dispute resolution. The narrowed arbitration scope may reduce the range of disputes subject to mandatory arbitration, though the specific carve-outs are not detailed. The addition of guest ordering on the website removes a barrier to purchase for users who prefer not to create an account, while the new Arch Card feature provides an alternative payment method subject to stated limits.
Removed cookie consent disclosures and preference controls from Terms and Conditions; redirects to separate privacy policy.
Why it matters: The updated Terms and Conditions remove detailed privacy disclosures and preference controls that were previously available inline, consolidating them into a separate privacy policy. This change affects how users access information about cookie usage, data sharing practices, and opt-out mechanisms, and may impact compliance verification for organizations that relied on the terms themselves as evidence of privacy disclosures.
Added explicit Kids and Teens Privacy Notice reference and clarified children's data request procedures in privacy policy effective April 23, 2026.
Why it matters: The updated policy establishes a clearer, more structured framework for children's privacy by separating children's data handling into a dedicated notice and streamlining the parental request process. This change reflects compliance with COPPA and state children's privacy laws, which require transparent disclosure of children's data practices and accessible mechanisms for parental access and deletion rights.
Updated support and legal contact email addresses in Terms of Service.
Why it matters: The updated terms provide new contact addresses for support and legal communications. Users should use the new email addresses when contacting Monday.com for support or sending formal legal notices.
Added Hugging Face Meta Muse-Spark model license reference to Third-Party Notices section.
Why it matters: The updated terms clarify which third-party model licenses apply to Together AI's services by adding an explicit reference to the Meta Muse-Spark model license. Users and organizations deploying models through Together AI should review all referenced third-party licenses to ensure compliance with their own use cases and customer agreements.
Restructured enterprise terms to rebrand service provider as SpaceXAI LLC and clarify API integration, end-user liability, and affiliate access rules.
Why it matters: The updated terms clarify the legal entity providing services (SpaceXAI LLC) and formalize the scope of API integration rights and end-user liability allocation. Enterprise customers should update vendor records and ensure their own customer agreements align with the stated liability framework.
Rebrands to SpaceXSI, adds mandatory Texas arbitration and class action waiver, shifts X login data transfer from opt-in to automatic.
Why it matters: The updated terms establish mandatory dispute resolution in Texas courts with a class action waiver, which eliminates the ability to pursue class actions or sue in home jurisdictions. The automatic transfer of X credential data (previously opt-in) expands data sharing without affirmative user election. These changes materially affect consumer rights, dispute resolution options, and data handling practices.
Prohibits scraping Walmart.com data to train AI models; expands Walmart's rights to use user content for AI development; clarifies payment and delivery procedures.
Why it matters: The updated terms establish Walmart's explicit right to use any content you submit for AI training and machine learning development, while simultaneously prohibiting third parties from scraping Walmart.com data for AI purposes. This creates an asymmetry in AI rights: Walmart can use your content for AI, but you cannot use Walmart's data for AI. Additionally, the Rewards Program timing change may result in your card being charged the full order amount before Rewards are applied, and new delivery liability disclaimers limit Walmart's responsibility for late or failed deliveries.
Added disclosure of voice transcription collection for voice search and Sparky AI interactions; expanded state-specific privacy rights to include Connecticut.
Why it matters: The updated notice establishes explicit transparency regarding voice data collection practices, clarifying that voice interactions are converted to text but not analyzed for biometric purposes. This disclosure addresses growing consumer and regulatory attention to voice data handling and expands privacy rights for Connecticut residents to match those in Oregon and Minnesota.
Expanded personal data collection disclosures to explicitly include date of birth, current location, travel companion details, dietary preferences, and passport information.
Why it matters: The updated privacy notice provides more explicit disclosure of personal data categories Booking.com collects during trip reservations, including sensitive information such as date of birth, current location, and travel companion details. This expanded transparency helps users understand what data is collected and how it is used, which is operationally significant for compliance with privacy regulations that require clear disclosure of data collection practices.
Adds paid content licensing terms, AI feature data processing disclosures, and health/emergency disclaimers; expands license scope for service development and testing.
Why it matters: The updated terms establish that premium content is a revocable license rather than a purchase, meaning subscribers lose access upon cancellation or non-payment, including downloaded content. The new AI feature sections authorize Calm to process user inputs and sensitive wellness information through AI systems, with Calm retaining ownership of generated outputs and the right to use them for service development and testing. These changes materially affect what premium subscribers own, how their data is processed, and what rights Calm reserves regarding content and AI-generated materials.
Expanded data processing purposes to include support requests, service delivery, and certification programs; added compliance framework references and revised dispute resolution language.
Why it matters: The updated Privacy Statement clarifies and expands the stated purposes for which Salesforce processes personal data, affecting how organizations using Salesforce must disclose data handling practices to their own customers. The removal of the specific TRUSTe dispute resolution mechanism and replacement with general language may affect dispute resolution procedures for users in certain jurisdictions.
Removed keystroke capture from AI functions; added protections for minors' content in AI training; consolidated Busuu privacy terms into main policy.
Why it matters: The updated policy establishes explicit protections for minors' data in AI training and clarifies that audio processing will not be used for identification, reducing privacy risks associated with AI-powered features. The removal of keystroke capture from AI functions narrows the scope of data collection during AI interactions. The consolidation of Busuu terms into the main policy simplifies governance but requires verification that prior Busuu-specific protections remain in effect.
Added sexual assault and harassment exemption to mandatory arbitration; expanded export compliance certification requirement; clarified AI-Assisted Features licensing terms.
Why it matters: The updated terms establish a meaningful carve-out from mandatory arbitration for sexual assault and harassment claims, which may provide affected users with access to court proceedings rather than arbitration. The expanded export compliance certification requirement and geographic restrictions may limit service availability or impose new compliance obligations on users in certain jurisdictions. The clarification of AI-Assisted Features licensing terms explicitly states that user inputs remain subject to Chegg's content license and training use rights, which has implications for how user-generated content and personal information submitted to AI services may be used.
Removed detailed cookie consent disclosures and tracking technology explanations from privacy notice.
Why it matters: The updated notice provides less granular disclosure about how SoFi uses tracking technologies and shares data with third parties. While the full privacy policy remains available, the streamlined notice removes explicit descriptions of cookie types, data sharing practices, and opt-out options that were previously disclosed, which may affect user understanding of tracking practices and available choices.
Restructured privacy policy to US-specific notice with explicit GLBA compliance, federal AML/KYC procedures, and state-specific privacy references.
Why it matters: The updated policy explicitly incorporates federal financial privacy (GLBA) and anti-money laundering compliance requirements into Kraken's privacy notice, clarifying the regulatory basis for identity verification and personal data collection. This restructuring establishes that US privacy terms take precedence over global terms and references state-specific privacy protections, which may affect how users understand their privacy rights and Kraken's data handling obligations.
Expands personal data collection to include geolocation, driver's license numbers, call recordings, and behavioral inferences; broadens user scope and third-party disclosure
Why it matters: The updated policy explicitly discloses collection of sensitive personal information categories including geolocation, driver's license numbers, and behavioral inferences that were not previously enumerated. The policy also clarifies that third parties acting on Stash's behalf may access customer data, and expands applicability to all users of Stash services, not just registered customers. These changes affect what personal data Stash collects, how it is used, and who may access it.
Updated daily. New changes added as detected.