Privacy and preparation
Which privacy notice applied when? Versioning notices for old records
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
To know which privacy notice applied to an old record, rebuild a privacy policy version history: collect every past version, date when each took effect, and map each version to the records collected under it. The version in effect at collection is the reference point for any reuse, so store the finished map in the dataset's privacy record.
Key takeaways
- The privacy notice in effect when a record was collected is the reference point for reusing it.
- Past versions can be rebuilt from CMS history, git, web archives, update emails and legal files.
- Map each version to the systems and record date ranges collected under it.
- Treat a gap as governed by the stricter neighboring version until better evidence appears.
Why the notice in effect at collection matters#
The privacy notice in effect when a record was collected is usually the reference point for what a company told people about that record, so a privacy policy version history is one of the first documents counsel asks for before old records are reused. A promise made in an earlier version does not disappear because the current policy says something different.
Regulators have been explicit about retroactive changes. In February 2024, FTC staff warned that a company adopting more permissive data practices, such as using consumer data for AI training, and announcing it only through a surreptitious, retroactive change to its terms or privacy policy may be engaging in unfair or deceptive practices.
Bankruptcy law points the same way. Section 363(b)(1) of the Bankruptcy Code looks at the privacy policy in effect when the case begins to decide whether personally identifiable information can be sold without further court review, and in the RadioShack proceedings the Texas attorney general quoted the exact policy wording the company had displayed in stores and online.
Where old privacy policy versions hide#
Old privacy policy versions are rarely kept in one place, but most companies can rebuild them from several sources. Treat each source as evidence with a date and a confidence level, not as a final answer.
| Source | What it can give you | Limits to note |
|---|---|---|
| Website CMS revision history | Exact text and save dates for each edit of the policy page | Lost when the site moved to a new CMS or was rebuilt |
| Git history of the website or app repository | Committed versions of policy files with author and date | Covers only policies stored as files in the repository |
| Public web archives such as the Internet Archive's Wayback Machine | Snapshots of the public page as captured on particular dates | Captures are irregular, so changes between snapshots stay invisible |
| Customer emails announcing policy updates | The date people were told and the summary they received | Sent from marketing tools whose history may have expired |
| Legal and board files | Drafts, approvals and redlines with internal dates | Some drafts were never published |
| App store listings, signup forms and order forms | Notices shown at the point of collection | Often overlooked and rarely archived |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Rebuilding the timeline step by step#
Rebuilding the notice timeline is a short research project, and it moves faster with one owner and a shared log. Record every version you find, even duplicates, because two independent sources agreeing on a date is stronger evidence than one.
- Step 1: list every notice the company has used, including the website policy, in-app notices, employee and recruiting notices, and product-specific notices.
- Step 2: collect every version from the sources above and save each as a dated PDF with its source noted.
- Step 3: give each version an effective-from and effective-to date, using the earliest reliable evidence for each boundary.
- Step 4: compare consecutive versions and note changes to sharing, sale, retention, de-identification and AI or analytics language.
- Step 5: record whether people were told about each change, and how.
- Step 6: have counsel review the timeline and mark any version whose wording limits reuse.
Mapping notice versions to record date ranges#
Mapping connects each notice version to the records collected while it was in effect. Without the map, neither counsel nor a buyer can tell whether a ticket from an early year was collected under a stricter promise than one from last year.
Use one row per notice version per system. The columns below are enough for most companies and drop straight into the privacy record for a dataset.
| Column | What to record |
|---|---|
| Notice and version | Which notice, a version label and a link to the archived copy |
| Effective from and to | Boundary dates, with the evidence used for each |
| Systems and record families | For example help desk tickets, CRM contacts or job records |
| Record date range covered | Creation dates of the records collected under this version |
| Relevant promises | Exact wording on sharing, sale, retention, de-identification and new uses |
| Change notice given | Email, site banner or none, with the date |
| Counsel's note | Any limit on reuse that applies to this slice of records |
Hard cases: gaps, undated versions and several notices at once#
Gaps in the timeline are normal, and a cautious convention is to treat a gap as governed by the stricter of the two versions on either side until better evidence turns up. Undated versions can often be bracketed by the first and last archive captures that show the same text.
Many companies ran several notices at once: one on the website, one inside the app, one for job applicants and one for employees. Records follow the notice their subject actually saw, so customer support tickets and staff HR records from the same year can sit under entirely different promises.
Records collected offline need extra care. A home services company that took homeowner details by phone or on a technician's tablet may have given notice through estimate forms, invoices or service agreements rather than the website, so check those templates too. Acquired companies bring their own notice histories, which should be rebuilt separately.
Illustrative: a plumbing and HVAC company rebuilds its notices#
Illustrative: a fictional plumbing and HVAC company has run ServiceTitan for years and rebuilt its website twice, losing the old CMS each time. Its privacy lead recovers earlier policy versions from public web archive captures, finds a policy update email in the marketing platform, and pulls the privacy wording printed on service agreement templates from a shared drive.
The timeline shows that an early version said customer information would never be shared with third parties for any purpose, while later versions allowed sharing with service providers and de-identified analytics. Counsel advises excluding customer contact fields and free-text notes from records collected under the early version, and including later job and dispatch records only after personal details are removed.
The map goes into the dataset's privacy record, so the scope decision can be explained line by line to the buyer and to anyone who later asks why some years look thinner than others.
How SourceX records the notice timeline#
SourceX reviews the notice timeline during the Rights step of the SourceX five-step transaction, before any preparation work begins. The completed map is stored in the privacy record of the SourceX Evidence Packet alongside provenance, licensing rights, permitted use and release authorization.
Where a notice version limits reuse, the affected date range is excluded or prepared under stricter rules, and the supplier approves the resulting scope. The supplier's counsel makes the legal assessment; SourceX documents it.
Frequently asked questions
What if we cannot find an old version at all?
Record the gap, the sources you searched and the dates they cover. Counsel can then decide whether records from that period should be excluded or treated under the strictest nearby version. A documented, honest gap is far easier to defend than an assumed wording that later turns out to be wrong.
Does updating our privacy policy today cover records we already hold?
Not automatically. A new notice generally speaks to data collected after it takes effect, and regulators have warned against quiet retroactive changes. Whether and how to notify people or seek consent for older records is a question for counsel, assessed for the specific records and the intended use.
Do business customer contracts override the website notice?
They usually add obligations rather than replace them. A master services agreement or data processing addendum may restrict how you use customer content, while the website notice describes how you treat individuals' personal information. Map both, because either one can limit reuse.
How long should we keep old notice versions?
Keep every version for as long as you hold any record collected under it, and longer if counsel advises. Store them as dated, unedited copies with their sources, ideally next to your retention schedule and dataset documentation.
Does the employee privacy notice follow the same process?
Yes, with different sources. Employee notices tend to live in handbooks, HR system acknowledgments and onboarding packets rather than on the website. Rebuild that timeline separately, because chat, email and internal documents are governed by what staff were told.
Sources
- On February 13, 2024, FTC staff warned that adopting more permissive data practices, such as using consumer data for AI training, and disclosing it only through a surreptitious, retroactive change to terms or a privacy policy may be unfair or deceptive. Source
- 11 U.S.C. 363(b)(1) restricts sale of personally identifiable information where the debtor's privacy policy in effect when the case commences prohibits transfer to unaffiliated persons. Source
- In 2015 the Texas attorney general's filing objecting to the RadioShack customer data sale cited the company's privacy policy displayed in stores and on its website. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.