How to change your terms of service to allow AI training without an FTC problem

Why do AI terms changes draw FTC attention?#

AI terms changes draw FTC attention because the FTC Act prohibits unfair or deceptive practices, and FTC staff have said a quiet terms change can be one. On February 13, 2024, FTC staff published a Tech@FTC post titled 'AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive'. It warned that a company adopting more permissive data practices, such as using consumers' data for AI training, and telling people only through a surreptitious, retroactive change to its terms or privacy policy may be engaging in unfair or deceptive practices.

The post is staff guidance, not a rule, and it speaks about consumers. Business-to-business vendors should not assume they sit outside it, because their customers' employees and end users are often the people described in the data, and state privacy laws and ordinary contract law may apply as well.

The commercial risk can arrive before any regulator does. After backlash over March 2023 changes to its terms, Zoom added a sentence to Section 10.4 in August 2023 saying it would not use audio, video or chat customer content to train its AI models without consent. Later that month, CIO Dive reported, it revised the terms again to say it does not use communications-like customer content to train its own or third-party AI models.

The five-step checklist for an AI terms change#

The five-step checklist for an AI terms change covers timing, notice, consent, document alignment and evidence. Each step addresses a different way the change could later be challenged by a customer, a regulator or an acquirer in diligence.

The steps work together. A prospective clause without notice still surprises customers, and an opt-in without records cannot be proved later. Skipping any one weakens the others.

• 1Step 1, prospective only: state in the clause itself that the AI training right applies to data submitted after the effective date.
• 2Step 2, clear notice: tell customers directly, by email and in the product, in plain language that explains what changes, which data is affected and how to object, well before the effective date.
• 3Step 3, opt-in for existing data: use records collected under earlier terms only after an affirmative choice, such as a signed addendum or an admin setting that defaults to off.
• 4Step 4, DPA and document alignment: update the data processing agreement, privacy policy, subprocessor list, security page and help center so none contradicts the new terms.
• 5Step 5, acceptance record: log which customer accepted which version, when, by whom and through what mechanism, and keep it with the contract file.

How do terms changes take effect for different customer types?#

Terms changes take effect differently for self-serve, negotiated and channel customers, so one announcement rarely covers everyone. Map your customer base to these groups before drafting, because each group needs its own mechanism.

Legacy accounts are easy to miss. A customer that signed years ago and never clicked through a later update may still be governed by the version it accepted, which can be narrower than your current terms. Negotiated contracts sit apart as well: Zoom said in 2023 that updates to its online terms do not affect customers who buy directly under separate contracts, such as enterprises and regulated education and healthcare customers.

What does clear notice look like?#

Clear notice is a direct, specific message that a reasonable customer admin would read and understand, not a changelog line. The stronger versions in the table are what counsel usually aims for.

Specific wording also protects the vendor. A notice that names the data types and purposes limits later arguments that customers agreed to something broader or narrower than intended.

Illustrative: a scheduling software vendor updates its terms#

Illustrative: a fictional vendor of scheduling and quality inspection software for commercial cleaning companies wants to train an in-product assistant on customer support chats. Its terms date from before generative AI and mention only service improvement.

Counsel drafts a clause that applies to chats submitted after the effective date, sends account admins an email and an in-app notice describing the change, and adds an admin setting that is off by default for historical chats. The DPA and privacy policy change in the same release, and each acceptance event is logged against the account.

Several enterprise customers decline, and their chats are excluded. Separately, the CEO notes that the company's own engineering and product records never depended on customer terms, so a licensing review of those records proceeds on its own track.

Mistakes that turn a terms update into a problem#

The mistakes that turn a terms update into a problem are usually shortcuts taken to avoid a negotiation. The most common is treating continued use after a notice as consent to reuse years of existing records.

Others include burying the change in a privacy policy update, changing the DPA unilaterally when it requires mutual agreement, announcing a broad right to share data with partners without naming AI training, and forgetting legacy customers who never accepted later versions. Each one either weakens the evidence of consent or creates a contradiction a customer can point to later.

A quieter mistake is changing terms when there is no need. If the goal is licensing your company's own records, such as code reviews and internal documentation, customer terms are not the lever; a rights review of those internal records is.

How SourceX approaches terms and consent#

SourceX approaches terms and consent as evidence to document, not something to assume. In the Rights step of the SourceX five-step transaction, each record family is tied to the terms version and any consent that governs it, and records without a clear basis are excluded.

The resulting SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization. That mirrors published provenance standards: the Data and Trust Alliance's Data Provenance Standards include a consent documentation location element in their Use metadata. The supplier approves every step, and nothing is shared during the initial assessment.