Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
This cybersecurity news tracker publishes a weekly diff of AI vendors' terms of service. Vendors quietly change data-training clauses and liability terms — the diff shows exactly what moved each week.
Each weekly edition documents verified changes to AI vendors' terms — new AI-training opt-outs, shifted liability caps, changed data-retention windows. Week 1 covered whether ChatGPT trains on your data. Diffs are checked against the live terms pages, so you see the exact wording that changed.
Does ChatGPT train on your data? Here's what actually changed in AI vendor terms this week. We fetch the real pages, we cite the real sources, and when we can't verify a change, we say so — an honest short edition beats a fabricated long one.
anthropic.com/legal/aup), OpenAI's usage & ad policies, Google's Gemini Apps privacy hub, Meta's commercial terms, and xAI's terms of service — plus vendor changelogs where published.Anthropic announced a 2026 usage policy update on October 8, 2026, effective November 12, 2026. The headline addition: a ban on "sustained and needless abusive or cruel behavior toward our models" — a first-of-its-kind rule we verified as live on Anthropic's policy page today. The update also consolidates deceptive-campaign rules into one section, expands the weapons restriction to explicitly cover weaponizing drones and autonomous vehicles, clarifies surveillance restrictions, and requires a human in the loop plus AI-use labeling for consequential recommendations in legal, medical, finance, and other high-risk areas. Anthropic describes most of it as clarification of existing rules; the anti-abuse clause and the drone-weaponization language are the genuinely new parts.
Sources: TechCrunch, Oct 8, 2026 · Anthropic Usage Policy (live page, fetched Oct 17, 2026) · Anthropic's announcement
Meta published updated commercial terms taking effect October 30, 2026, that authorize Meta to use scrapers, bots, and crawlers to access, collect, and analyze content from websites "associated with" businesses using its platforms — and to use that content to train, develop, and improve its products, including AI. The changes were first reported by Nieman Lab and covered by The Verge on October 16, 2026. Meta says the update consolidates existing permissions and doesn't change how it currently crawls; businesses that disagree have no opt-out — the stated alternative is to stop using Meta's products for business. If you run a website linked to a Meta business presence, the clause that binds you is the terms text, not the reassurance.
Sources: tech-insider.org (citing The Verge, Nieman Lab, Oct 16, 2026) · Latestly (Oct 16–17, 2026 coverage)
Vendors change the rules under your feet — sometimes without a changelog, sometimes effective before you've read it. Get each week's Terms Diff in your inbox, and let TermsWatch monitor your vendors automatically.
Subscribe to the Ingenious AI newsletter
Want automated monitoring of your vendors' terms? Get TermsWatch early access on WhatsApp
Informational only — not legal advice. Always read the vendor's actual terms before acting on a change we flag.
It depends on the vendor's current terms and your plan's settings — and terms change weekly, which is why this series exists. Week 1 found two real changes (Anthropic, Meta); always verify against the current policy.
Use your account's data-controls or opt-out settings, prefer tiers that contractually exclude training, and keep sensitive content out of consumer chatbots. Then follow this weekly diff — policies move.
Training and data-use rights, retention, deletion on request, liability and indemnity, subprocessor lists, and unilateral change rights. Every weekly diff flags exactly these clauses.