Contract trap · Privacy policy
Excess data collection (contacts, mic, location)
The policy authorises reading your address book, clipboard, installed apps, microphone/voice, TV viewing (ACR), camera feeds, connected-car telemetry and data about non-users; collects precise GPS, Wi-Fi/Bluetooth beacon or cell location continuously or in the background with a history shared with 'partners' or embedded SDKs (a 'Location History' toggle may not stop other collection); and reserves the right to access, view or scan your content 'through automated and manual methods'.
- Severity
- Serious
- How often it turns up
- Common
- Holds up?
- Depends where you are
- Clause phrases
- 24
What it looks like in a contract
Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.
In English-language contracts
- access your contacts / address book
- information about other apps installed on your device
- we collect voice recordings
- automatic content recognition
- video and audio from your camera
- connected vehicle data
- information about people you communicate with, including non-users
- precise geolocation
- background location
- even when the app is not in use
- we share location data with our partners
- we may access, view, or listen to your Content through both automated and manual methods
In Russian-language contracts
- доступ к контактам (адресной книге)
- список установленных приложений
- данные с микрофона
- записи голоса
- данные о просматриваемом контенте
- телематические данные
- информация о лицах, не являющихся пользователями
- точные данные о местоположении
- в фоновом режиме
- история местоположений
- передача геоданных партнёрам
- вправе просматривать любой Контент Пользователя
Check your own contract
Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.
Why it bites
Third parties who never agreed (your contacts) get profiled; always-on microphones and cameras produce recordings employees can view (Ring); TVs and cars report second-by-second behaviour to brokers and insurers; location reveals home, clinics, worship and protests and a single 'off' toggle may not stop collection (Google $391.5M); confidential files may be reviewed by humans.
Is it enforceable where you are
The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.
In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.
United States
Disclosure-based; FTC unfairness for default ACR (Vizio 2017), employee video access (Ring $5.8M 2023), children's voice retention (Alexa $25M), driving data to CRAs (GM 2025) and sale of sensitive location data (X-Mode, InMarket, Kochava, Gravy, Mobilewalla); multistate Google settlement $391.5M (Nov 2022) over misleading Location History controls; CCPA treats precise geolocation as sensitive PI; CIPA/wiretap claims for recordings; state biometric laws for voice.
- Cited
- CCPA
- FTC
European Union
Data minimisation (GDPR Art 5(1)(c)) and Art 14 information to non-users (WhatsApp €225M, 2021); ePrivacy Art 5(3) for accessing device data and Art 9 for telecom location data; background tracking requires consent and a DPIA; GDPR applies to content review; German court struck Google's clause allowing removal of apps via direct device access (LG Berlin 2013).
- Cited
- GDPR Art 5(1)
United Kingdom
UK GDPR/PECR; ICO guidance on smart devices and connected vehicles; ICO age-appropriate design code requires geolocation off by default for children.
- Cited
- GDPR
- ICO
- PECR
Russia
Сбор данных третьих лиц (контактов) без их согласия нарушает ст. 6, 9, 18 152-ФЗ; ст. 5 ч. 5 — избыточные данные запрещены; геолокация — ПД, требующая согласия с конкретной целью (ст. 5, 9); тайна связи (ст. 63 126-ФЗ, ст. 23 Конституции) covers communications and metadata; условия о произвольном просмотре контента и ограничении работы устройства ущемляют права потребителя (ст. 16 ЗоЗПП).
- Cited
- 126-ФЗ
- 152-ФЗ
- ст. 16 ЗоЗПП
- ст. 23
- ст. 5 ч. 5
- ст. 6
- ст. 63
Where this has actually happened
Regulator actions, court rulings and the contracts they were fought over.
- FTC v. VIZIO (2017) — $2.2M, ACR viewing data on 11M TVs by default
- FTC v. Ring (May 2023) — $5.8M, employees and contractors could view customers' private videos
- Multistate AG settlement with Google (Nov 2022) — $391.5M over Location History vs Web & App Activity tracking
- FTC v. Kochava (filed Aug 2022) — sale of geolocation data from hundreds of millions of devices
- DPC v. WhatsApp (2021) — €225M, including processing of non-users' contact data without information
- Adobe General Terms, June 2024 — 'we may access, view, or listen to your Content through both automated and manual methods' (clarified after backlash)
What to do
In order, from the thing that takes a minute to the thing that takes a letter.
- Deny contacts/microphone/camera/background-location permissions unless essential and grant location only 'while using' and approximate
- Audit each location-related setting separately
- Disable ACR on smart TVs and 'Smart Driver'-type programs in cars
- Delete voice recordings and location history and request deletion from named partners
- Keep privileged material off services with manual-review rights
- EU/UK/RU: processing non-users' contact data and background tracking require a lawful basis and information (WhatsApp €225M) — object
- Report employee access or undisclosed collection to the FTC/DPA/РКН.
Traps that travel with it
Drafters who use one of these usually use several.