Redlinethe fine print, decoded

Contract trap · Privacy policy

Unrestricted cross-border transfer

Data may be stored or processed in the US or 'any country where we or our service providers operate' with weaker protection and you 'consent to the transfer' (in RU, foreign analytics/hosting equals трансграничная передача and possibly a localization breach); the operator may hand data to law enforcement, government bodies or 'any third party' whenever it 'believes in good faith' it is appropriate, in 'emergencies' or 'to protect our rights', without notifying you.

Severity
Serious
How often it turns up
Common
Holds up?
Depends where you are
Clause phrases
24

What it looks like in a contract

Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.

In English-language contracts

  • your information may be transferred to, and processed in, the United States
  • countries that may not have the same data protection laws
  • by using the Service you consent to the transfer
  • we may store your information anywhere in the world
  • standard contractual clauses
  • onward transfer
  • we may disclose your information to law enforcement or government authorities
  • when we believe in good faith that disclosure is necessary
  • to protect our rights, property or safety, or that of others
  • emergency requests
  • without notice to you
  • voluntary disclosure

In Russian-language contracts

  • трансграничная передача персональных данных
  • на территорию иностранного государства
  • серверы, расположенные за пределами Российской Федерации
  • Пользователь даёт согласие на трансграничную передачу
  • в страны, не обеспечивающие адекватную защиту
  • использование Google Analytics
  • с использованием облачных сервисов иностранных провайдеров
  • по запросам уполномоченных государственных органов
  • органам, осуществляющим оперативно-розыскную деятельность
  • без уведомления Пользователя
  • для защиты прав и законных интересов Оператора
  • по мотивированному запросу

Check your own contract

Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.

Run the full scan on this document

Why it bites

Your data becomes reachable by foreign surveillance and courts, out of reach of your regulator, and camera footage, messages and location go to police or private litigants on the company's say-so with no warrant and no notice (Ring gave police videos without consent at least 11 times in 2022); in RU the operator faces localization fines and RKN can prohibit the transfer, so the service may abruptly change or be blocked.

Is it enforceable where you are

The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.

In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.

United States

No restriction on outbound transfers; DOJ Bulk Data Rule (2025) restricts transfers of sensitive US data to 'countries of concern'; ECPA/SCA govern compelled disclosure but voluntary 'emergency' disclosures are permitted (18 U.S.C. §2702(b)(8)); Ring ended its police 'Request for Assistance' tool in Jan 2024.

  • Cited
  • 18 U.S.C. §2702

European Union

GDPR Chapter V: transfers only under adequacy (incl. EU-US DPF since July 2023), SCCs with a transfer impact assessment, or narrow Art 49 derogations — consent cannot be the routine basis; Meta €1.2B (May 2023, US surveillance access decisive), Uber €290M (Aug 2024), TikTok €530M (May 2025, China); disclosure to authorities must rest on EU/Member-State law (Art 6(1)(c)/(e), Art 23) — 'good faith' disclosure to private parties lacks a basis.

  • Cited
  • GDPR

United Kingdom

UK GDPR adequacy regulations, IDTA/Addendum, UK-US Data Bridge (2023); DPA 2018 Sch 2 crime/legal-proceedings exemptions; Investigatory Powers Act 2016 for compelled access; voluntary disclosure still needs a lawful basis.

  • Cited
  • GDPR
  • Investigatory Powers Act 2016

Russia

Ст. 12 152-ФЗ (266-ФЗ, с 1 марта 2023): оператор обязан уведомить РКН до начала трансграничной передачи, в страны без адекватной защиты РКН может запретить; ст. 18 ч. 5 — первичный сбор/хранение в базах на территории РФ, штраф за нелокализацию 1-6 млн ₽, повторно 6-18 млн ₽ (ч. 8-9 ст. 13.11 КоАП); disclosure to authorities is lawful and mandatory — 374-ФЗ (Яровая): хранение содержания сообщений до 6 мес. и метаданных 1-3 года с предоставлением ФСБ ключей, ст. 6 ч. 1 п. 2-4 152-ФЗ allow processing without consent by law, СОРМ — the trap is expecting confidentiality.

  • Cited
  • 152-ФЗ
  • 266-ФЗ
  • 374-ФЗ
  • ст. 13.11 КоАП
  • ст. 18 ч. 5
  • ст. 6 ч. 1 п. 2

Where this has actually happened

Regulator actions, court rulings and the contracts they were fought over.

  • DPC v. Meta Platforms Ireland (12 May 2023) — €1.2B and order to stop EU-US transfers under SCCs (Schrems II)
  • Autoriteit Persoonsgegevens v. Uber (Aug 2024) — €290M for transferring EU drivers' data to the US without transfer tools; DPC v. TikTok (May 2025) — €530M over transfers to China
  • Roskomnadzor localization proceedings against Facebook, Twitter and Google (2021) under ч. 8 ст. 13.11 КоАП
  • Ring/Amazon disclosure to Senator Markey (July 2022): footage released to police without user consent at least 11 times in 2022; 'Request for Assistance' tool discontinued Jan 2024
  • 374-ФЗ от 06.07.2016 («пакет Яровой») — mandatory storage of user communications by Russian operators

What to do

In order, from the thing that takes a minute to the thing that takes a letter.

  1. Look for the transfer mechanism (adequacy, SCCs/IDTA, DPF certification) and object in writing if the clause merely says 'you consent'
  2. Prefer services that promise notice of legal requests unless prohibited, publish transparency reports and require legal process, and disable voluntary police-sharing features
  3. RU: ask whether RKN was notified (ст. 12 152-ФЗ) and whether the primary database is in Russia (ст. 18 ч. 5), assume ОРД access to metadata and stored content by law and use end-to-end encrypted tools for sensitive matters
  4. Ask for the record of disclosures (GDPR Art 15, 152-ФЗ ст. 14).

Check your own document

Traps that travel with it

Drafters who use one of these usually use several.

79 traps · 1789 verbatim clause phrases