How does Termsight measure "an update"?

We hash the cleaned text of every tracked policy every 24 hours. When the hash differs from the previous snapshot, we compute a word-level diff and classify the change as none, minor, moderate or significant. "Updates" in our public stats count only moderate-and-above changes — cosmetic edits are excluded.

Which sectors change their policies most?

In our monitoring, large consumer platforms (social, advertising, AI products) update most frequently — often several times per year. B2B SaaS sits in the middle. Smaller specialist tools tend to move only annually unless a regulation forces an update.

How often do companies actually update their Privacy Policies?

Termsight monitors the Privacy Policies and Terms of Service of hundreds of companies, re-fetching each one at least once every 24 hours. That gives us a rare ground-truth dataset on how often the small print actually moves — and what kinds of edits are usually behind those moves.

Most policies move several times per year

The lay assumption is that a Privacy Policy is written once at launch and only rewritten in response to a regulator. In practice, large consumer platforms update their Privacy Policy every few months — sometimes more often — and B2B SaaS products typically push at least two to four updates per year. Even relatively stable mid-market tools usually have at least one meaningful edit a year, and almost no tracked policy in our dataset is genuinely static.

The majority of "updates" are cosmetic

A surprisingly large share of detected changes — well over half in our data — are cosmetic: whitespace, reformatting, broken links being fixed, tracking pixels being added or removed, dates being bumped. This is why we run an AI severity layer on top of the diff: cosmetic edits are filtered out of the main feed so the changes you do see are the ones that actually move the substance of the policy.

What changes when it changes for real

The most common categories of substantive change, in our monitoring:

New subprocessors and advertising partners added to data-sharing lists.
New product features prompting new data-collection disclosures (notably AI-related ones over the past two years).
Updated international data-transfer language.
Adjusted retention periods.
Refined or expanded user-rights language (deletion, portability, opt-out).
Tweaks to arbitration, class-action waivers and governing-law clauses in Terms of Service.

Why this matters

If a policy you signed off on twelve months ago has been quietly rewritten five times since, your "agreed-to" version no longer exists. That's the entire reason continuous monitoring is interesting — at audit, renewal, incident response, or procurement, you want to know what the policy said at the moment it mattered, not what it says today.

You can browse the directory to see the change history for any tracked company, or scan the live changes feed to see what moved this week.