Events

DuckDuckGo changed two Duck.ai terms. Shared-chat links now expire after 48 hours by default, and you can set 1, 7 or 30 days; before, shared chats were deleted after 30 days. Duck.ai is now for people aged 18 or older, or younger with a parent's supervision; before, the minimum age was 13.

Wispr Flow now discloses that feedback can train its models. When you rate a dictation or send feedback, it collects data from that session — which can include audio recordings, transcripts and your edits — and uses it to "develop and train our AI models." Staff and service providers may review it. Sending feedback is optional. The page also says Enterprise accounts have data sharing turned off, with no option to turn it on.

SpaceXAI narrowed its no-sell statement. The Consumer FAQs said "We do not sell your data or share it with third parties for marketing or advertising purposes" and that there was nothing to opt out of. They now say only "We do not sell your data to third parties as defined by applicable laws." The promise not to share data for advertising is gone. The privacy policy lists targeted advertising among its uses.

PayPal updated its US Privacy Statement on September 28, 2026. Its sharing table now says PayPal does not share your information with its affiliates so they can market to you; it said yes before. PayPal still shares with non-affiliates for marketing, and you can limit that in Data and Privacy settings. The update also adds PayPal World payments, which use data from third-party wallets and payment networks, and crypto services from PayPal Digital.

Discord's data package now includes your age signals: your stated date of birth (anonymized), the method you used to confirm your age, the resulting age group, an age group a machine-learning model infers for you, and a separate predicted age used to power features.

Wispr Flow rewrote its account-deletion instructions. Deletion removes your dictionary, notes, preferences, transcripts, audio and usage history, locally and in the cloud. Some requests now have a waiting period before final deletion, and no purge timeline is stated. Wispr keeps organization records, privacy-request and audit records, and HIPAA agreements. Android still has no in-app deletion button; you file a support request.

Qwen replaced its Privacy Policy, effective 7 September 2026, and its Terms of Service, now a Service Agreement, effective 10 September 2026. The operating entity changed: the service is now provided by NTH POWER GLOBAL TECH SINGAPORE PTE. LTD., with Alibaba Cloud (Singapore) Private Limited named as technology provider that deletes user input data once generation is complete. Account deletion is now self-serve from the Settings page, and the policy states that raw input data will not be used to directly train AI models, while training on de-identified user content continues by default with no opt-out. The clause barring retrieval of your own content in an automated manner is gone from the Service Agreement.

Zoom narrowed its no-sell statement. It previously read "We do not sell your personal data in the conventional sense"; it now reads "We do not sell your personal data governed by this Privacy Statement in the conventional sense", followed by "Sales of business contact related data may occur through our Zoom Common Room offering." Zoom's own update note, dated 17 September 2026, states the change clarifies that this Privacy Statement does not cover sales of business contact data.

OpenAI expanded the advertising disclosures in its US privacy policy. It now states that for Free and Go users it collects information about your ads history and interests, such as the types of ad content you view or engage with — a category not previously named. The hedge also went: "We may receive information from advertisers and other data partners" became "We receive information from advertisers and other data partners". A sentence stating you can make choices about the use of your information to promote OpenAI products on third-party properties was removed. Separately, Sora references were removed throughout, and the Atlas browser is now described as the in-app browser, with the Atlas incognito browsing-history sentence dropped.

Microsoft updated its Privacy Statement from July 2026 to September 2026. Two sentences were removed from the Copilot section: that in some markets your data can help train Microsoft Copilot AI models unless you opt out, and that you can opt out of personalization at any time. The training opt-out itself remains documented in Microsoft's Copilot Privacy FAQ, which did not change. Personalization is now described as covering memories you save and your interactions with Bing, Edge and MSN, managed through Copilot settings. Microsoft 365 Copilot no longer appears in this section, so the statement that you can view, export and delete Copilot activity history from the privacy dashboard now names only Microsoft Copilot. The reference to relevant advertising was also dropped from the sentence describing what Copilot does with your prompts.

Apple now lets you opt in to having your data used to improve Siri and Apple Intelligence. Its foundation-models page, updated September 9, 2026, says your personal data and interactions are "never used to train our foundation models unless you explicitly choose to help improve them." Before, the page said only that Apple does not use your personal data or interactions to train them. Training stays off unless you opt in.

Granola published a new privacy policy, effective 8 September 2026. It adds a HIPAA program for enterprise accounts: those customers can sign a business associate agreement, and under it Granola will not use protected health information to train AI models without express consent. Enterprise training stays off by default, but enterprise users can now opt in.

Lyft now lets you delete your account inside the app, under Privacy then Account Security. Its stated response time for data requests dropped from 45 days to 30.

Mistral published a new privacy policy, effective 3 September 2026. The Memory feature becomes Knowledge Base, existing memories carry over, and Mistral now states Knowledge Base will not seek to store sensitive data from your input.

Pinterest will replace its privacy policy on 12 November 2026 and has published a preview. By its own summary, the new policy adds detail on how it trains its models, including generative AI, on how long it keeps your information, and on international transfers. For users outside the EEA, Switzerland and the UK it describes sharing data with partners so advertisers can reach you on other sites and apps.

Notion removed workspace PDF export, as it said it would by 31 August 2026. Export to HTML, Markdown and CSV remains, and single pages still export to PDF. Notion also documented starting a workspace export through its admin API, in beta on the Enterprise plan.

Microsoft shipped a new Copilot app with a new privacy FAQ. The locations excluded from model training changed: the old FAQ named the EEA, UK and Switzerland; the new one names Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam. Signed-out users and users under 18 are also excluded, and the training opt-out remains.

Uber added a promise to its US privacy notice: it will not sell or share your phone number with third parties for marketing text messages.

xAI renamed itself SpaceXAI and published a new privacy policy, effective August 24, 2026.

Telegram narrowed its no-ads principle. The policy ruled out using your data for ads; it now rules out only the contents of your chats and contact lists, and sponsored messages now also appear in bots and stories.

Robinhood’s privacy policy now names third-party AI services among the connected services that can send Robinhood information about you.

Booking.com replaced its California-only privacy rights section with one covering all US residents, and now states it derives your location from your IP address.

Meta’s deletion page now describes deleting a Facebook profile rather than an account: other profiles in the same Meta Account are not affected.