I teach law and I practice it. One of the things that’s always bothered me is that companies can change the legal terms that bind their users — hundreds of millions of people — and nobody notices. The old version vanishes. No record, no diff, no way to prove what it used to say. Private lawmaking is everywhere, but it lacks the basic infrastructure we expect in public lawmaking — notice, stable publication, and an intelligible record of what changed and when.

So I built TOS Tracker. It monitors Terms of Service, Privacy Policies, and other legal documents from nearly a thousand companies, government agencies, and organizations. Every few hours it checks each one for changes, computes a SHA-256 hash for verification, archives each version to the Internet Archive, and extracts specific legal clauses for cross-company comparison.

I’m now sitting on a dataset of 32 types of legal clauses extracted across 969 active documents. Here’s what’s actually in all that fine print.

What We’re Looking At

TOS Tracker watches:

• 684 Terms of Service from tech companies, banks, hospitals, government agencies, and more
• 241 Privacy Policies from the same organizations
• 44 other documents — EULAs, Acceptable Use Policies, DMCA policies, cookie policies, community guidelines

The coverage spans Big Tech, finance, healthcare, retail, telecom, gaming, government, and SaaS. And none of these documents are static — every company in our database reserves the right to rewrite their terms whenever they want.

What “I Agree” Actually Means

When you click “I Agree,” you’re consenting to specific legal provisions — provisions that most people never read and wouldn’t understand if they did. Here’s what the clause extraction data shows.

Mandatory Arbitration Is Everywhere

66 companies in the dataset require mandatory arbitration. If you have a dispute with them, you don’t get to go to court. You go to a private arbitrator — with limited discovery, no jury, and restricted appeal.

Some are at least upfront about it:

CVS: “THIS AGREEMENT INCLUDES AN ARBITRATION PROVISION, JURY TRIAL WAIVER, AND A CLASS ACTION WAIVER THAT AFFECT YOUR RIGHTS. IN ARBITRATION, THERE IS NO JUDGE OR JURY, AND THERE IS LESS DISCOVERY AND APPELLATE REVIEW THAN IN COURT.”

Cloudflare: “THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS.”

Others bury it. Amazon puts it plainly enough — “Any dispute or claim relating in any way to your use of any Amazon Service will be resolved by binding arbitration, rather than in court” — but you’d have to scroll past thousands of words to find it. Bluesky at least puts a flag at the top: “Important Note: These Terms contain an agreement to resolve most disputes between us through arbitration.”

Sixty-six companies. Same basic clause. Billions of users bound by it.

32 Companies Block Class Actions

32 companies go further with explicit class action waivers. Even if a company does the same thing to millions of users, each one has to bring their claim alone.

The list includes Adobe, Microsoft, Netflix, Amazon, Discord, Dropbox, Epic Games, Etsy, Lyft, The New York Times, Coinbase, and CVS.

Dropbox is blunt about it:

“You may only resolve disputes with us on an individual basis, and may not bring a claim as a plaintiff or a class member in a class, consolidated, or representative action.”

Here’s one that caught my eye: Epic Games lets you opt out of arbitration within 30 days. But you cannot opt out of the class action waiver. Read that again. Even if you exercise your right to reject arbitration, you still can’t join a class action. The waiver survives.

The AI Training Land Grab

This is the one I’d tell my students to watch closely. A handful of major companies have written explicit AI training rights into their terms, and the approaches are all over the map.

Companies that say they’ll train on your stuff:

HubSpot doesn’t mince words:

“We may use Customer Data to develop, support, and improve HubSpot AI features and functionality. We may use Customer Data to train our AI models and similar products and services that rely on machine learning. You instruct us to use Customer Data to train HubSpot AI models.”

Catch that last sentence? “You instruct us.” By accepting their terms, you’re supposedly giving them an affirmative instruction to feed your data into their models.

Canva is training on your private uploads:

“We use content and media in user’s private accounts (such as photos, videos and audio) to train our models to apply machine learning to new unseen media.”

Meta frames it as a public good — using AI “so that people can use our Products safely regardless of physical ability or geographic location.” Their Instagram privacy policy is less diplomatic: “Develop and improve AI at Meta for Meta Products and for third parties.”

Snap and Shopify both describe using user data for machine learning, though with varying degrees of specificity about what that means.

Companies that say you can’t train on their stuff:

Microsoft:

“You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”

Anthropic:

“[You may not] develop any products or services that compete with our Services, including to develop or train any artificial intelligence or machine learning algorithms or models.”

So: they can train on your data. You can’t train on their outputs. I’ll leave it to the reader to decide how they feel about that arrangement.

One company worth noting: Zoom explicitly commits to not training on your content: “Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content to train Zoom or third-party artificial intelligence models.” That’s a meaningful commitment in a landscape where most companies are going the other direction.

They Can Change Everything, Anytime

58 companies include unilateral modification clauses — they can rewrite their terms whenever they want, and your continued use counts as agreement.

AT&T’s is typical:

“AT&T may change or modify the Terms from time-to-time without notice other than posting the amended Terms on the Site. The amended Terms will automatically be effective when posted on our Site.”

No email. No notification. They post it on a page nobody visits, and it takes effect immediately. That’s the standard approach across the industry.

This is exactly why I built the tracker. If every company reserves the right to change the rules at any time, somebody should be watching when they do.

Your Data Gets Around

187 companies have clauses about sharing your data with third parties. 110 address data sale or transfer. The language is worth reading carefully.

The American Bar Association — which represents lawyers — is at least honest about it:

“We may sell your general data and industry and business data with third parties to offer you products and services that may be of interest to you.”

Compare that with Anthropic:

“Anthropic does not ‘sell’ your personal data as that term is defined by applicable laws and regulations.”

See that phrase — “as that term is defined”? The legal definition of “sale” under the CCPA is specific enough that a lot of data-sharing arrangements don’t technically count. The word “sell” in a privacy policy and the word “sell” in ordinary English are doing different things.

Government Data Requests

22 companies spell out what happens when the government comes knocking. Dropbox makes one of the stronger commitments I’ve seen: “No matter how the Services change, we won’t share your content with others, including law enforcement, for any purpose unless you direct us to.”

Most companies just say they’ll comply with legal process. Few make affirmative promises about when they’ll push back.

California Runs the Table

Governing law clauses are dominated by California, followed by Washington (Amazon, Microsoft), New York (financial services), then Texas, Virginia, and Delaware. If you use the internet, there’s a good chance your legal rights are governed by California law, regardless of where you live.

Why I Built This

I got tired of having to take companies at their word about what their terms said last month. Every version in TOS Tracker gets a SHA-256 hash, an Internet Archive submission, and a permanent URL. If someone cites a specific version of Google’s privacy policy in a law review article, that citation should still work in ten years.

I also wanted to see the patterns. It’s one thing to know that Amazon has an arbitration clause. It’s another to see that 66 companies use essentially the same language, or that a growing number of companies are writing AI training rights into their terms while simultaneously prohibiting you from doing the same thing with their outputs.

This data should be public and it should be free. So it is.

See It Yourself

• Compare clauses across companies — Arbitration, data sharing, AI training, and 29 other clause types, side by side
• Browse recent changes — A running feed of document changes as they happen
• Search everything — Full-text search with boolean operators across every tracked document
• Trends — Aggregate data and patterns
• For researchers — Citation tools, methodology, and API access

If you work in this area — academic research, journalism, regulation, compliance — I’d like to hear from you. andrew@leahey.org.

All clause excerpts are verbatim from the companies’ own published legal documents, extracted by TOS Tracker’s automated clause analysis system. Data as of February 6, 2026. Nothing in this post is legal advice.

And yet, I feel empty inside. Or rather, I feel as though my new domain will soon feel empty inside. It joins dozens of others that I have only the vaguest of notions as to use: a blog, a personal site, a repository for my writing. A quasi-professional blog as against my quasi-personal one.

Meaningless distinctions in furtherance of justifying owning numerous little parcels of real estate on gTLDs when, in reality, my total output isn’t enough to justify even one.

These programs ensure, at least ostensibly, that legal practitioners stay updated on the latest developments in the law, legal ethics, and practice management. CLE requirements vary by state and jurisdiction, often mandating a specific number of credit hours to be completed within a set time frame.

Since the practice of law is not immune to hustle culture, every event is an opportunity for networking. During this particular CLE, held over Zoom, the folks putting the course on suggested that everyone could drop their LinkedIn profiles in the chat to connect with other users.

Quickly, as you might expect in a chatroom with ~500 folks, the chat become overrun with links and brief descriptions of individual practice areas.

Rather than scroll through the chat to pull out all of the links, I saved the chat as a text file and used a local LLM (for the sake of privacy) with a prompt asking for a list of all the LinkedIn links provided. After a few moments I had an easy list to work my way down from.

Had I wished to further narrow down which individuals I was interested in connecting with, I could have asked for a list of only those folks that indicated they were barred in New Jersey, or Pennsylvania, or practiced in an area relating to privacy and intellectual property.

These are the use cases for LLMs that excite me most.

You were probably taught the same basic lesson Jimmy Stewart delivers to mid-bank-run Bedford Falls residents. The bank gives you interest on money you keep in your savings account because they aggregate all the savings accounts together and use those to issue mortgages so folks can buy homes, auto loans for cars, and the like. Your interest is a portion of the interest they receive on your lent out money, and the cycle continues.

Except that’s almost exactly backwards.

Deposit accounts don’t create lending opportunities, lending creates deposit accounts. The It’s a Wonderful Life version of banking would cast banks as being little more than entities that connect people with extra money to lend with people looking for money to borrow. The reality is banks do most of the money creation in the modern economy. If you’re wondering why, then, you’ve never seen a giant minting machine churning out bills in the lobby of your local Wells Fargo, then perhaps we should begin at the beginning.

What is “money?”

The above-referenced cash is but one type of three: currency, central bank reserves and bank deposits. They all represent, in physical or abstract form, an amount owed from one individual or entity to another. So the very first thing we need to do in order to get our arms around how money actually works is dispense with the notion that “adding money” to the economy necessitates printing cash – it can, but needn’t, and usually doesn’t. The creation of a bank deposit, for instance, can be every bit the creation of money as printing a greenback.

The important takeaway is an understanding that, for every dollar in a deposit account somewhere, there needn’t be a physical dollar bill in the real world. “Money” in the economy includes currency, central bank reserves and bank deposits.

How is money “created?”

Now that we have decoupled the idea of “money” from physical bills and coins, we can explore how money can be created.

The Federal Reserve is the central bank of the United States and it is tasked with controlling the monetary system. By way of explaining its role, a quick earth science lesson digression: do you know why marshlands are especially ecologically important? They act as sponges, taking on additional water during periods of heavy rainfall and slowly releasing the water back into the surrounding environment during dry periods. Without them, during a heavy rainfall, much water would be lost to runoff as the ground became saturated and impermeable. Marshlands act as buffers, converting what would be wasted floodwaters into long term life-sustaining hydration.

The Fed is the marshland of the monetary system. When the Fed sees fit to increase the money supply, it buys Treasury bonds from commercial banks and deposits the cost of purchasing those bonds in the banks’ deposit accounts – no cash need be printed. They can also purchase other similar types of accounts on the open market to the same effect. But their actions are diffuse and rely on knock-on effects to achieve results. The same goes for their adjusting of the interest rate, it doesn’t mandate the rate a bank must charge on a loan to an individual, it just sets the interest rate one bank will pay another for borrowing from its reserve account.

But wait, that sounds like the Fed is doing the money creation – how can a bank do the same?

The piece of information that brings together the disparate threads we have discussed is: banks don’t only lend out the money they have reserves for, their reserves represent a mere fraction of their total debts. Put differently, if somewhat simplistically, if a bank has $10 in deposits, they’ll typically be free to lend out as much as $100. Their reserve accounts need only have 10% of their outstanding debts on hand.

So let’s look at a dollar traveling through the system. The Fed decides that $1, yes one more dollar, needs to be added to the economy and then everything will be dandy. The Fed purchases a Treasury bill from Bank X for $1, putting $1 on the deposit side of X’s ledger (remember, no physical currency is involved here). Bank X, subject to a 10% reserve requirement, is then free to lend out, that is create deposits, representing up to $10. The Fed “created” $1 but the commercial bank, X, “created” $9.

The picture becomes much clearer when one imagines an actual transaction. First, imagine a bank with no debts and no credits – a newborn baby bank. Jane Borrower takes out a mortgage with the bank to buy a house, the mortgage is for $100,000. The bank makes a deposit into the seller’s account for the purchase price, $100,000, and marks in their ledger that they have a $100,000 outstanding debt. At the end of the day, they need only have $10,000 cash on hand, which represents the 10% reserve amount they require. But where has the other $90,000 come from? It is tied up in the value of the house, which is the collateral for that loan. The bank has just converted a house, wood and nails and siding and dirt, into money.

Why don’t banks just create money infinitely, then?

Here the Fed steps in again, but not in the way you might think. The Fed also sets the interest rate banks can expect to see as a return on their money placed in reserve accounts in the central bank. This represents the amount of money one bank needs to pay another bank for borrowed reserve funds, overnight. Thus, when a bank has more liabilities than assets to a point below the required reserve percentage, 10%, it can borrow reserves from another bank and pay the interest rate set by the Fed for the benefit of doing so.

Banks would like to have assets to represent every liability, and they try to do so – at the retail level this looks like selling customers on deposit accounts – but the market realities are that much borrowing and lending must occur overnight between banks. The Fed-set interest rate, thus, is quite impactful. A bank that lends too much may run the risk of said lending being rendered unprofitable by the interest paid to other banks to meet reserve requirements.

Thus, the Fed only indirectly sets the amount of lending commercial banks will do – by setting the “cost” of their borrowed reserve money.

Concluding Thoughts

If you’re getting a vaguely nauseated feeling in the pit of your stomach, like you suddenly awoke to find you live in a house of cards – take heart! The realization that there isn’t a dollar bill representing every dollar in deposit accounts and central bank reserves is only alarming because you believe the physical dollar bill to be something more than an IOU. It isn’t.

Since the United States came off the gold standard formally in 1971 – that is to say, after that there was not gold bullion worth one dollar backing every dollar bill. Again, you may feel the room beginning to spin and a slight queasiness in your stomach, as that means the dollar bill is not backed by anything representing real value. But expand your mind one more level of abstraction up and ask yourself, how is a piece of gold any more truly valuable than a dollar bill? They both derive value from the perception of others that they are valuable, not from any physically real “value” attribute. There may not even be any such thing as true value.

So the dollar is only worth something because people agree it is. The Fed doesn’t create most of the money in the economy, commercial banks do, and deposit accounts are not aggregated to make loans, loans are used to make deposit accounts. To top it all off, George Bailey’s notion of how his savings and loan worked was way off the mark. Is nothing real?

Well, thankfully for George Bailey, Zuzu’s petals were. And thankfully for us, other arrows in the government’s quiver can provide real and sustainable relief. Chief among them are actions that will support investment now that gives rise to insulation for consumers from the sorts of costs that are currently causing the biggest pocketbook pinch – things like energy and electric vehicles. The pain of inflation is felt most acutely by consumers most vulnerable owing to rising costs of goods necessary for day to day life, so decoupling those goods from the most volatile sectors of the economy can go a long way towards protecting consumers from the next, inevitable, inflationary period.