‘Terms and Conditions May Apply’: Did you just sell your privacy?

When you tap “I Agree” on an app update, you hand over more than a few device permissions. The 2013 documentary Terms and Conditions May Apply warned that dense policies let companies and governments harvest data long before AI agents, wearables, and settlement headlines turned the issue mainstream. A decade later, U.S. users still scroll past the same fine print, yet the stakes have grown with location fines, billion-dollar verdicts, and new state rules that rarely keep pace with code changes.

Policy length hides real stakes

Meta’s July 2026 update explicitly authorizes public posts and AI-chat logs for ad targeting and third-party model training. Most users never reach that clause, buried hundreds of lines below the summary screen. The language mirrors the vague wording the 2013 film flagged on early Facebook, now scaled to cover every post, voice note, and generated image.

Google’s March 2025 refresh keeps similar breadth for Web & App Activity and Location History. An Irish fine of €403 million in 2026 cited insufficient transparency around location logs, yet the policy text still lists “legitimate interests” as the catch-all justification. The gap between legal prose and everyday understanding has only widened.

TikTok’s January 2026 refresh drew viral backlash for listing clipboard data, keystroke patterns, and inferred details on health or orientation. The new language did not expand collection; it simply made existing practices explicit. Users who deleted the app cited the policy wording, not the underlying code, as the final trigger.

Settlements price the click

Projected 2026 U.S. privacy settlements total $1.4 billion, up 36 percent year-over-year. Meta pixel cases dominate the docket, followed by Google location and Microsoft cross-app tracking claims. Most defendants already maintained consent dashboards, yet courts found those tools inadequate once default settings and dark patterns entered the record.

New Mexico’s pending suit against Meta seeks between $35 billion and $40 billion after a jury found misleading statements about third-party sharing. The complaint cites the same Cambridge Analytica-era policies that the 2013 documentary spotlighted. Damage calculations now treat each daily user as a recurring data point rather than a one-time event.

Smaller actions against data broker Kochava and several wearable makers show regulators targeting niche segments that still feed the same ad ecosystem. These cases rarely generate headlines, but the cumulative cost gets passed along in higher device prices and ad-load increases.

Apple sets a narrower bar

Security.org’s January 2026 comparison gave Apple the highest privacy score, noting collection of roughly seven data types versus Meta’s twenty-five. The firm still gathers device serial numbers and usage metrics, and third-party apps on iOS maintain their own policies that users accept without review.

Recent AI features on macOS require explicit “Full Disk Access” toggles, a concession after researchers flagged risks of agentic tools scanning local files. Apple frames the change as user control, yet the toggle itself sits three menus deep for most non-technical owners.

Even limited collection feeds ambient data pools. Watch and phone sensors log movement, heart-rate variability, and sleep patterns that third-party developers can access once a user grants health permissions. Those datasets remain attractive to insurers and advertisers despite Apple’s narrower direct use.

AI training rewrites consent

Meta’s policy now lists “Develop and improve AI at Meta for Meta Products and for third parties” as an explicit purpose. Public posts, captions, and even deleted stories remain eligible unless users navigate a separate opt-out buried in account settings. The clause arrived quietly during a routine update cycle.

Google, Meta, Microsoft, and OpenAI each pledged clearer AI-training disclosures after UK ICO pressure in late 2026. The commitments focus on notice, not restriction; users can still object, but the objection path requires locating a form rather than a one-tap switch.

Researchers tracking OpenAI cookies on merchant sites found new tracking pixels that log purchase behavior for model fine-tuning. The pixels activate regardless of prior ad-preference settings, illustrating how AI development expands the definition of “service improvement” inside existing terms.

State laws lag code changes

California’s CPRA and newer statutes in Connecticut and Virginia require specific third-party lists and deletion rights that cover data brokers. Compliance dashboards exist, yet studies show fewer than one in five users complete the multi-step deletion flows. The administrative burden shifts to individuals rather than default settings.

Automated decision-making disclosures remain optional in most states. When Meta or Google flags a user for ad audiences derived from inferred traits, the policy text satisfies notice rules without revealing the model logic or appeal path.

Enforcement budgets have not scaled with new obligations. State attorneys general rely on outside counsel and settlement revenue, creating a cycle where fines fund future cases rather than preventive audits. Companies treat penalties as a predictable cost of data operations.

Wearables widen the net

Smart glasses and fitness bands top data-type rankings in Surfshark’s August 2026 study, often collecting thirty-plus categories including precise location, ambient audio snippets, and biometric baselines. The devices ship with terms that grant perpetual, sublicensable licenses to any content captured during use.

Users who enable health-sync features route data through third-party clouds whose policies sit outside the device maker’s control. Once records leave the hardware ecosystem, downstream brokers can repackage them for insurance scoring or targeted ads without fresh consent.

Ambient listening modes on recent AI glasses raise the same surveillance concerns the 2013 film raised about smartphone microphones. Rolling buffers and on-device processing offer technical safeguards, yet policy language still reserves the right to share anonymized snippets for product research.

Opt-out friction persists

Audits of Meta and Google post-opt-out behavior show continued cross-site tracking via pixels and SDKs. The mechanisms rely on probabilistic identifiers that survive browser resets and app reinstalls. Policy text frames these methods as necessary for “service functionality,” leaving users to prove otherwise in court.

Consent-management platforms adopted by most major sites still default to maximal collection. A Privado AI analysis found that companies facing litigation already deployed these tools, indicating that presence of an opt-out does not equate to effective choice under current case law.

Younger users on TikTok and Instagram have begun posting deletion screenshots as social currency. The trend echoes the GameStation “immortal soul” stunt highlighted in the 2013 documentary, except the stakes now involve location histories and AI-generated replicas rather than novelty clauses.

Next cycle of enforcement

State attorneys general continue to coordinate multi-district actions against the same handful of defendants. The legal theory has shifted from notice failures to unfair acts, increasing potential damages but also lengthening discovery timelines. Companies respond with incremental policy edits rather than structural changes.

Legislatures in additional states are drafting automated decision-making rules modeled on Colorado’s framework. Early drafts require impact assessments and appeal rights, yet lobbyists have already inserted safe-harbor language that preserves broad “legitimate interest” defenses.

Until default settings flip to minimal collection and enforcement budgets match penalty revenue, the click-through economy will continue to price user data in quarterly forecasts. The documentary’s core warning remains intact: the signature line still belongs to the platform, not the person reading it.

Forward path

Users who want practical leverage can start by auditing permissions on their most-used apps and routing health or location data through on-device options whenever available. Policy language will keep evolving, but consistent friction at the consent layer remains the clearest signal that companies still treat data rights as negotiable line items rather than fixed defaults.