This Week in the Fine Print

This update to the cookie/ad-partner list adds five brand-new advertising companies that can collect and use your device and browsing data, expands what data several existing partners collect (including sign-in identifiers, user profiles, and browsing activity), lets one partner combine your data with other sources, and extends how long one partner keeps your tracking data from 1 year to 5 years. One previous partner ('ividence') was removed, and there were some minor renamings and a version-number bump with no real effect.

Read the full analysis

PlayStation restructured its Privacy Policy around region-specific legal entities and added several new data practices: screen-recording of gameplay and in-game actions, detailed device/anti-cheat scanning, use of personal data to train AI/machine-learning models, tracking of your activity on third-party services, and a new category letting other Sony Group companies use your data to market to you. Some changes are consumer-friendly, like dropping location tracking from the device-data list and adding passkey login support.

Read the full analysis

Dailymotion's privacy policy update expands AI-driven automated processing of your data and content, including allowing content to be automatically blocked without a human reviewing the initial decision (only appeals go to a human). It also broadens the geolocation data collected (adding GPS and user-declared location, not just IP address), clarifies that content metadata containing personal info may be shared with Data Partners for AI training, and reveals that some 'service providers' may actually act as independent data controllers over your data rather than just following Dailymotion's instructions. Most other edits are formatting fixes or added links to an existing service-provider list.

Read the full analysis

The main change is that iXBT.com now uses Google Analytics for website tracking, reversing its prior explicit promise not to use any foreign analytics service. The company says it anonymizes data through a Russian server proxy before any information reaches Google, and continues to avoid Liveinternet, Top.Mail.Ru and Rambler Top 100. Other changes (a new revision date and rotated browser opt-out links) are cosmetic.

Read the full analysis

Uber's Cookie Notice update mostly adds transparency and new consumer controls — cookie duration disclosure, in-app privacy settings, opt-in consent for EU/UK/Swiss users, an email-tracking opt-out, and a new promise to seek fresh consent before making material future changes. But it also expands third-party data sharing: at least nine new advertising/data-broker partners were added, those partners may now combine your data with other information they hold about you, and Uber disclosed that some partners act as independent controllers who may move your data outside the EEA/UK. Essential cookies (which you can't turn off) are now also used for fraud detection, and social media plugins may link your visit to your social account.

Read the full analysis

The IRS privacy policy was almost entirely rewritten and shortened. A short, generic intro replaces detailed explanations of what data is collected and why, and the document now has several section headers ('Privacy compliance programs', 'Privacy Act requests', 'Privacy complaints') with no content under them yet. Several consumer protections that used to be spelled out explicitly — your right to consent before your data is used for a new purpose, the explicit promise that the IRS 'does not sell' your information, the list of who your tax data can be shared with, the safeguards around AI use of your data, and the rules around recording meetings — have all been removed from the visible policy text.

Read the full analysis

Ekstra Bladet added one new advertising/tracking partner (Comcast International France SAS / FreeWheel Media) to its list of IAB-approved data vendors, alongside a routine vendor-count bump from 143 to 144. This partner collects device and browsing data, uses it (partly under 'legitimate interest' rather than consent) to measure ads and personalize advertising, and can retain some data for up to 547 days.

Read the full analysis

The IRS replaced its detailed privacy policy with a much shorter draft. Nearly all of the substantive content was deleted — including the explanation of who your tax data can be shared with, the AI oversight safeguards, security monitoring practices, meeting-recording consent rules, and privacy-complaint/oversight information — and replaced with a short intro plus four section headings ('Privacy compliance programs,' 'Privacy Act requests,' 'Privacy complaints,' etc.) that currently have no content under them.

Read the full analysis

This update mostly cleans up typos and formatting, but it also adds three changes worth knowing about: Viber will now keep your Dating chat messages on its servers for up to 3 months (previously all messages were deleted almost immediately after delivery), Viber Plus subscribers may have their name, photo, and subscription status shown to their own contacts as a promotion, and the marketing/advertising vendors Viber uses now have a much broader mandate covering sales, user acquisition, and engagement campaigns, not just ad measurement.

Read the full analysis

TradingView added a new monthly fee for popular invite-only scripts, expanded its rights to keep publishing your scripts (even to new users) after your account is gone, added missed-payment as a reason to suspend or terminate accounts, and formally folded its Script Publishing Rules and Vendor Requirements into the Terms of Use.

Read the full analysis

KU Leuven's cookie policy removed its entire detailed cookie inventory: the tables listing exactly which strictly-necessary, functional, performance, and advertising cookies are used, which subdomains set them, and which third parties (Google Analytics, Meta/Facebook, LinkedIn, DoubleClick, Hotjar, Studyportals, Keystone Education Group, QS, THE, etc.) receive tracking data. The general descriptive text about cookie categories stays the same, but the specific, checkable list is gone.

Read the full analysis

The IRS privacy policy was substantially rewritten and expanded. Most of the additions restate existing legal protections and disclosure rules (Privacy Act, Paperwork Reduction Act, Code section 6103) rather than granting the IRS new rights. However, three changes are worth knowing about: the IRS now explicitly discloses a long list of third parties and government agencies it can share your tax information with (courts, states, Congress, foreign governments under tax treaties, law enforcement/intelligence agencies); it discloses for the first time that it uses AI for fraud detection, compliance, and administrative functions; and it adds a policy for recording meetings where simply staying on the call counts as your consent to be recorded.

Read the full analysis

HBR's contributor guidelines were reworded and trimmed for clarity, with several editorial-process details changed. The most notable substantive changes: authors will now be asked to sign the copyright form earlier in the process (when a proposal is picked up, not before publication), and the previous explicit assurance that 'authors continue to own the underlying ideas in their articles' has been deleted. The document also dropped its stated commitment to diverse, unbiased content and removed language encouraging rejected authors to resubmit. Most other edits are stylistic tightening, criteria clarifications, and byline/date updates.

Read the full analysis

In Ekstra Bladet's cookie/consent vendor list, the consent expiry period for one data category was extended from 1 year to 5 years, meaning your cookie consent for that tracking will be treated as valid for much longer before you're asked again.

Read the full analysis

Most of the changes in this update are small formatting fixes and cleanup for discontinued products (Cortana, Microsoft Groove), plus a modest increase to Rewards point redemption limits. But three changes could affect you: Microsoft switched its arbitration provider from the American Arbitration Association (AAA) to JAMS and added a new clause emphasizing federal arbitration law controls the process; the Store terms now warn that refusing to install updates can get your apps cut off from access or support; and the separate reference to special terms for 'Copilot with commercial data protection' users was removed, folding everyone into one generic Copilot terms link.

Read the full analysis

KU Leuven's cookie policy went from mostly describing cookie categories in the abstract to publishing full tables of the actual cookies used across dozens of university subdomains. The most consumer-relevant addition is a new paragraph disclosing that 'doelgroepgerichte' (targeting/advertising) cookie data is shared with named advertising partners like Studyportals, Keystone Education Group, QS, and THE, plus platforms like Google, Meta, and LinkedIn. The rest of the changes are added navigation links and detailed, mostly informational cookie inventories (functional, performance, strictly-necessary cookies).

Read the full analysis

pixiv updated two documents: the main Creator/Master Terms now let a Creator optionally give pixiv joint ownership of the copyright in their posted work (so pixiv can enforce it against infringers), and the 'Pastela' drawing-app terms were rewritten to add a new 'Material File' (brush/settings file) system with new disclaimers, sale rules, and new company discretion over cloud storage and posting features.

Read the full analysis

Cookpad added a new eligibility requirement to its Partner Program tiers (Partner, Hero, and Fantasista): creators must now have posted at least 3 recipes in the last 90 days, in addition to the existing cooking-count thresholds. A footnote was also added clarifying that only public recipes that comply with the terms of use and posting guidelines count toward this new requirement. A revision date was also added.

Read the full analysis

This update mainly adds data flows and disclosures tied to a new 'PayPal World' cross-border payment feature and newly-covered cryptocurrency services, and adds a line admitting PayPal may sometimes be legally barred from telling you when it discloses your data to authorities. On the positive side, PayPal now says it will stop sharing your creditworthiness data with its corporate affiliates and stop letting those affiliates market to you.

Read the full analysis

In the Referral Program FAQ, one word changed in the sentence describing who receives the $15 discount promo code: it now says the referee (the new signed-up user) gets the code, instead of the referrer (the person who shared the link).

Read the full analysis

Intuit's Legal Hub page added a new "Risk of Loss" clause stating that once a physical item you ordered is handed to the shipping carrier, you — not Intuit — bear the risk if it's lost or damaged in transit. It also added new "Support" sections with contact links for general support, QuickBooks ProAdvisor, and Intuit Partner Platform inquiries, reformatted the copyright Designated Agent contact block without changing its content, and added an "EN-US" language tag at the top of the page.

Read the full analysis

DER SPIEGEL expanded the TikTok Retargeting section of its privacy policy: it now spells out more specific categories of data sent to TikTok and adds a new stated purpose (measuring ad campaign effectiveness), while removing the specific link that let users opt out of personalized TikTok advertising (replaced with a general link to TikTok's own privacy policy). A nearby ad-monetization section had its heading and a phrase reworded to add 'segment-based' targeting, but the surrounding text still says the underlying data is aggregated, so that change is minor.

Read the full analysis

The IRS replaced what was previously a short, AI-drafted placeholder page with a complete privacy policy. The new text adds a clear promise that the IRS does not sell your data, but it also newly discloses that AI systems are used on taxpayer information for compliance and fraud detection, spells out a long list of government bodies (and foreign countries) your tax data can legally be shared with, and adds new rules about recording meetings with the IRS.

Read the full analysis

Brave changed how Leo AI conversation history is described and stored. Previously, Leo chat history stayed only on your local device and Brave stated plainly "we do not save these conversations." Now, if you turn on Brave Sync, your Leo conversation history can also be synced (in encrypted form) to Brave's Sync servers so it's available across your devices — it's no longer strictly local-only. On the plus side, Brave also added the ability to delete individual conversations instead of only clearing all of them at once.

Read the full analysis

Rightmove updated the AI Conversational Search section of its privacy policy. It now says your AI search data may be used for 'profiling' (not just personalizing results), that your conversation logs may be used to test the AI model for bias and accuracy, and it removed the word 'only' from the sentence promising your data is used solely for service quality, safety, and improvement — slightly loosening that commitment.

Read the full analysis

Temu rewrote the part of its Dutch terms that explains order costs and import fees. The old text described a deposit system for estimated customs charges, with a written promise that if the estimate was too high the difference would be automatically refunded (confirmed by email). That explanation has been deleted and replaced with a shorter statement that all costs are shown at checkout and no extra payment is needed afterward.

Read the full analysis

TradingView added a new entry to its cookies table disclosing a specific advertising tracking technology (Floodlight tags, using IDE and DSID cookies) that measures ad campaign effectiveness and tracks ad conversions. This adds a named, more specific third-party ad-tracking mechanism to the existing advertising/remarketing cookie category.

Read the full analysis

Dailymotion updated its Terms of Use to remove a specific example about how long content is kept after being taken down for moderation reasons. The general rule that content may be kept longer if the law requires it is unchanged, but a concrete detail (a 12-month retention example for moderated content) was deleted.

Read the full analysis

This update only touches the privacy policy's section on cross-border data transfers (6.5) and the revision date. The company now explains in detail how it handles Google Analytics traffic: instead of your browser data going straight to Google, it now first passes through the company's own servers in Russia, which strip out your full IP address and other identifying details before any further processing. The company states this means no cross-border transfer of your personal data to Google Analytics occurs. No other rights, obligations, or data practices changed.

Read the full analysis

Ookla updated two hyperlinks in its Privacy Policy: the link to its Cookie Policy now points to an Accenture domain instead of Ookla's own speedtest.net site, and the link to the Simplified Chinese translation was moved from speedtest.net to ookla.com. No policy text describing data practices, sharing, retention, or your rights was changed.

Read the full analysis

TikTok refreshed its Community Guidelines mostly with formatting and version-metadata changes (a table-of-contents entry removed, update-notice text replaced with cleaner release/effective dates and a link to a version archive). The one substantive change tightens the Regulated Goods, Services, and Commercial Activities rule: it now bans 'providing access to' regulated items (not just trading, marketing, or promoting them), and only 'Verified' (not just 'Registered') business accounts can sell regulated items on TikTok Shop.

Read the full analysis

The only change in this update is that the redirect links pointing to Chrome, Internet Explorer, and Microsoft Edge cookie-management instructions were swapped out for new tracking-redirect URLs. The visible link text and destinations described are the same; only the underlying encoded redirect addresses changed.

Read the full analysis

DeepL updated its privacy policy to change the contact email for setting up a data processing agreement from sales@deepl.com to privacy@deepl.com in three places. No other substantive changes were made.

Read the full analysis

The only change in this update is a link URL fix for the 'Customize third-party cookies' link, updating it to a locale-specific path. No policy language, data practices, or consumer rights changed.

Read the full analysis

The only change in this update is that a link about Brave Sync privacy protections was broken (its web address was removed). No wording about data collection, sharing, or user rights changed.

Read the full analysis

The only change in this update is a technical re-encoding of the obfuscated email address in the contact table (a Cloudflare anti-spam encoding string). The visible email address and all other content remain the same. This is a cosmetic, non-material change.

Read the full analysis

The only change in this update is a technical encoding update to the obfuscated email address shown in the Contact Information section. The visible email address (dpo@eb.com) and all other content, including data collection, sharing, and consumer rights sections, remain unchanged.

Read the full analysis

The only change in this update is the effective date, which moved from September 29, 2026 to September 30, 2026. No other text, terms, or policies were changed.

Read the full analysis

The only change is the document's effective date, updated from September 29, 2026 to September 30, 2026. No actual terms were added, removed, or modified.

Read the full analysis

The only change in this update is the effective date, which moved from September 29, 2026 to September 30, 2026. No actual terms, rights, or obligations were changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 29, 2026 to September 30, 2026. No other terms, policies, or consumer rights were altered.

Read the full analysis

This update removes the $29.95/month "Technology Fee" that TradingView charged for popular invite-only scripts, narrows the license you grant over published scripts by dropping the right for TradingView to sub-license them, and simplifies some wording around account termination and House Rules. None of the changes in this diff take away rights or protections you previously had — most are neutral or in your favor.

Read the full analysis

The only change is a cosmetic update to the "last updated" timestamp label; no actual policy content, cookie tables, or practices changed.

Read the full analysis

MEGA updated the link to the EU's online dispute resolution platform in its Terms of Service. The old URL pointed to a retired page; the new one points to the European Commission's current consumer redress site. No rights, obligations, or procedures changed.

Read the full analysis

This update only changes the internal redirect links used for the Chrome, Internet Explorer, and Microsoft Edge cookie-management help links. The destination web pages (Google/Microsoft support pages) are unchanged, only the encoded tracking URL iXBT uses to redirect to them was regenerated. No policy text, rights, or data practices changed.

Read the full analysis

Verizon added one new instruction to its Return Policy: if your smartphone has a 'Safe to Ship' or similar battery-reduction mode, turn it on before returning or shipping the device. This is a practical shipping tip and does not change any consumer rights, fees, or obligations.

Read the full analysis

The only change in this diff is a URL path update for the 'Customize third-party cookies' link, from a locale-prefixed path to a shorter path. No wording, policy, or consumer rights changed.

Read the full analysis

The only change is a technical update to the obfuscated email-protection code for the DPO contact email in the table; the actual email address and all other contact and policy text remain unchanged.

Read the full analysis

The only change in this update is a technical encoding change to the obfuscated email address shown in the Contact Information table. The visible email address and all other content, rights, and disclosures remain the same.

Read the full analysis

MEGA added a section heading ('Copyright notice submission') above the existing DMCA notice text. No substantive wording changed.

Read the full analysis

MEGA updated the link to the EU's online dispute resolution platform after the European Commission moved it to a new web address. No rights, obligations, or procedures changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 28, 2026 to September 29, 2026. No other text in the terms changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 28, 2026 to September 29, 2026. Nothing else in the document changed.

Read the full analysis

The only change in this update is the effective date, which moved forward by one day (September 28 to September 29, 2026). No terms, policies, or consumer rights were altered.

Read the full analysis

The only change in this update is the effective date, which moved from September 28, 2026 to September 29, 2026. No other text in the terms changed.

Read the full analysis

The only change in this update is a technical update to the obfuscated email-protection code used to display the DPO's email address on the page. The visible email address, mailto link, and all other contact details remain the same. No policy language, consumer rights, or data practices changed.

Read the full analysis

The only change in this update is an internal encoding tweak to the obfuscated email address shown on the contact page (the actual email, dpo@eb.com, is unchanged). No substantive terms were altered.

Read the full analysis

The only change in this update is the effective date, which moved forward by one day (from September 27 to September 28, 2026). No other text, terms, or policies were modified.

Read the full analysis

The only change in this update is the effective date, which moved from September 27, 2026 to September 28, 2026. No other text in the agreement was changed.

Read the full analysis

The only change is an update to the document's effective date, from September 27, 2026 to September 28, 2026. No actual terms changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 27, 2026 to September 28, 2026. No other text, terms, or policies were modified.

Read the full analysis

The only change is the addition of a grievance officer's name, Sahil Mohan Gupta, under the 'Gadgets Now' contact section. This is a routine update to contact/staff information and does not affect any consumer rights or obligations.

Read the full analysis

This update only changes hyperlink URLs (adding trailing slashes) in a few places, such as the Korea Addendum link, the Cookie Notice link, and the content moderation transparency link. No wording, rights, data practices, or obligations were changed.

Read the full analysis

The only change in this diff is the removal of page header elements (the page title, a language selector, and the displayed 'Effective' date). No actual policy language was added, removed, or changed.

Read the full analysis

This update only changes the tracking-redirect URLs behind the Chrome, Internet Explorer, and Microsoft Edge browser-help links in the cookie policy. The visible link text and destinations are the same; only the internal encoded redirect link (api.ixbt.com/to/...) changed. No policy language, data practices, or user rights were altered.

Read the full analysis

The only change in this update is to an obfuscated email-protection code embedded in the contact table's HTML markup. The visible email address and all other contact details, and all substantive policy terms, are unchanged.

Read the full analysis

The only change in this update is a technical change to how the DPO email address is encoded on the page (an obfuscation code used to hide it from spam bots). The email address itself, dpo@eb.com, is unchanged, and no policy language was altered.

Read the full analysis

The only change is an update to the "Effective Date" from September 26, 2026 to September 27, 2026. No other text in the document was modified.

Read the full analysis

The only change is an update to the document's effective date. No actual terms, policies, or rights were modified.

Read the full analysis

The only change between these two versions is the effective date at the top of the document, updated from September 26, 2026 to September 27, 2026. No other text, terms, or policies were modified.

Read the full analysis

The only change in this update is the effective date at the top of the document, which moved from September 26, 2026 to September 27, 2026. No actual terms, policies, or consumer rights were altered.

Read the full analysis

The only change in this update is that the tracked redirect links pointing to browser cookie-management help pages (Chrome, Internet Explorer, Microsoft Edge) were swapped for new encoded URLs. The destinations and content of the policy are unchanged.

Read the full analysis

The only change in this update is a link update: the URL pointing to DeepL's Data Processing Agreement was changed from an old address to a new one. The actual terms and obligations stayed exactly the same.

Read the full analysis

The only change in this update is a re-encoding of the obfuscated email address shown in the Contact Information table (the actual email, dpo@eb.com, and all other contact details are unchanged). No terms affecting user rights, data practices, or obligations were altered.

Read the full analysis

The only change in this update is a technical update to an obfuscated email-protection code in the contact table. The actual email address (dpo@eb.com) and all other contact details are unchanged. No consumer rights, data practices, or terms were affected.

Read the full analysis

The only change in this update is the effective date, which moved from September 25, 2026 to September 26, 2026. No other terms were altered.

Read the full analysis

The only change in this update is the effective date, which moved from September 25, 2026 to September 26, 2026. No other text in the terms was modified.

Read the full analysis

The only change is an update to the document's effective date, from September 25, 2026 to September 26, 2026. No actual terms, policies, or consumer rights were changed.

Read the full analysis

This update only changes the list of grievance officer contacts for various Indiatimes properties. A new 'TOI-Tech' contact was added, the named officer for 'Gadgets Now' was removed (email unchanged), and the separate 'Gadgets Now Shop' contact entry was deleted entirely. No terms, rights, or obligations changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 25, 2026 to September 26, 2026. No other terms, policies, or consumer rights were changed.

Read the full analysis

The only change is that the tracking/redirect links behind the browser cookie-management instructions (Chrome, Internet Explorer, Microsoft Edge) were swapped for new encoded URLs. The visible link text and destinations described stay the same; this is a backend link update, not a change to any rights, data practices, or terms.

Read the full analysis

The only change in this diff is to internal HTML attribute identifiers (data-v-a729551d changed to data-v-e0f2faac) in the personal information disclosure and retention table. No text, terms, or policies changed.

Read the full analysis

The diff only changes internal HTML component hash attributes (data-v-a729551d to data-v-e0f2faac) used by the website's front-end framework. No policy text, data practices, or consumer terms changed.

Read the full analysis

The only change in this update is to Section 20 (Trademark Information), which now links to an online list of APA's trademarks instead of naming them directly in the text. This is a cosmetic wording change and does not affect your rights or obligations.

Read the full analysis

The only change in this update is a technical re-encoding of the obfuscated email address shown on the page (a Cloudflare anti-spam encoding). The actual email address, dpo@eb.com, is unchanged. No policy terms, rights, or practices were altered.

Read the full analysis

The only change in this update is a cosmetic one: the obfuscated email-encoding string for the DPO contact email was regenerated (this is an anti-spam encoding technique, not a change to the actual email address or any policy). No substantive privacy terms were altered.

Read the full analysis

The only change in this update is the effective date, which moved from September 24, 2026 to September 25, 2026. No other text in the terms was changed.

Read the full analysis

The only change in this update is the effective date, moved from September 24, 2026 to September 25, 2026. No other text in the terms changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 24, 2026 to September 25, 2026. No other text, terms, or policies were changed.

Read the full analysis

The only change in this update is the effective date, which moved from September 24, 2026 to September 25, 2026. No other text changed.

Read the full analysis

The only change in this update is the addition of a new table-of-contents entry, "Safety and Civility," linking to a section already covered by the guidelines. No rules, rights, or obligations for users appear to have changed.

Read the full analysis

This update only changes the web link to Ookla's Privacy Policy from the old speedtest.net address to the new ookla.com address. No rights, obligations, or terms of service actually changed.

Read the full analysis

The only change is the "Updated yesterday" timestamp label changing to "Updated this week." No actual policy content, cookie tables, or practices changed.

Read the full analysis

The only change in this update is that the redirect links pointing to Chrome, Internet Explorer, and Microsoft Edge cookie-management help pages were swapped for new tracking-redirect URLs. The actual destinations and instructions are unchanged.

Read the full analysis

The only change is a cosmetic update to the encoded email obfuscation string for the DPO contact email; the visible email address and all other content remain the same.

Read the full analysis

The only change in this update is a cosmetic one: the obfuscated email-encoding value used to display the contact email address in the Contact Information table was updated. The visible email address, contact details, and all other policy text remain unchanged.

Read the full analysis

This update only adds blank lines between bullet points for readability. No wording, rights, or obligations changed.

Read the full analysis

This update only changes the formatting of the privacy notice, adding blank lines between bullet points for readability. No policies, data practices, or user rights were changed.

Read the full analysis

The only change in this update is the effective date at the top of the document, which moved from September 23, 2026 to September 24, 2026. No other text, terms, or policies were altered.

Read the full analysis

The only change between these two versions is the effective date at the top of the document, which was updated from September 23, 2026 to September 24, 2026. No other text, terms, or policies were modified.

Read the full analysis

The only change in this update is the effective date at the top of the document, which moved from September 23, 2026 to September 24, 2026. No actual terms, policies, or consumer rights were altered.

Read the full analysis

The only change in this update is the effective date, which moved from September 23, 2026 to September 24, 2026. No other text in the document changed.

Read the full analysis

The only change in this update is the timestamp label at the top of the page, which now reads 'Updated yesterday' instead of 'Updated today'. No cookie tables, data practices, or policy language changed.

Read the full analysis