Sproutsocial

Key Changes and Risks

1. Corporate entity covered by the policy

• Tagger Media, Inc. is removed from the statement that the company complies with the EU-U.S. Data Privacy Framework.
• The provision now refers only to Sprout Social, Inc.
• Risk: If Tagger still processes personal data or participates in transfers, the revised wording may create uncertainty about which legal entity is responsible and whether Tagger remains covered by the stated transfer mechanism.

2. New opt-out right for materially different uses

The revised language gives individuals in the EEA, United Kingdom (including Gibraltar), and Switzerland the ability to opt out where personal information will be:

• Disclosed to a non-agent third party; or
• Used for a purpose materially different from the purpose for which it was originally collected or later authorized.

This replaces the former, more general commitment to resolve privacy complaints.

• Significance: This is a more specific data-use control and may restrict secondary uses of customer data unless the individual is given a choice.
• The wording distinguishes between third parties acting as the company’s agents and independent third parties. The opt-out applies to disclosures to non-agents, which may include certain vendors, partners, or other data recipients.

3. Sensitive personal information

The revised policy states that Sprout Social does not intentionally collect or process sensitive personal information under the DPF Principles. If it receives such information, it says it will obtain affirmative express consent (opt-in) before:

• Disclosing it to a non-agent third party; or
• Using it for a purpose other than the original or subsequently authorized purpose.

• Risk: The commitment is framed around DPF requirements and may not fully describe obligations under applicable GDPR, UK GDPR, or other laws. The phrase “receives such information” could also leave questions about accidental or user-submitted data.

4. Complaints and dispute resolution

The procedure is substantially rewritten:

• A specific contact email is added: privacy@sproutsocial.com.
• Sprout Social states it will respond within 45 days.
• Individuals may complain to their competent supervisory authority.
• Unresolved complaints may be referred to BBB National Programs’ Data Privacy Framework Services.
• Binding arbitration remains available for certain residual claims, subject to DPF conditions.
• Sprout Social expressly commits to cooperate with EEA, UK, and Swiss data protection authorities concerning certain employment-related HR data.

• Drafting risk: Parts of the diff appear internally corrupted, including an instance where the email address is shown as blank (“email at .”). The final published version should be checked carefully.

5. AI-model training and data use

• No express change to AI training, model development, or use of customer data to train AI models appears in this diff.
• However, the new “materially different purpose” limitation could become relevant if customer data is used for AI training or model improvement and that use was not part of the original purpose or authorization.
• The policy should be reviewed elsewhere for any AI-training language, including provisions on service improvement, de-identification, analytics, or third-party providers.

The publisher records this document as revised on this date (“Effective Date: May 9, 2025”).

Summary

The provided text only states:

> “Text modified while maintaining similar length”

It does not include the underlying contract language, marked additions, deletions, or replacements. As a result, no substantive legal changes can be identified.

Key Findings

• No identifiable contractual changes: The text does not show which provisions were added, deleted, or replaced.
• No AI-training provisions identified: There is no language addressing:
• Use of customer data to train, fine-tune, or improve AI models
• Whether customer data is used for product development or analytics
• De-identification, aggregation, or anonymization of customer data
• Human review or model-training access
• Customer opt-out or consent rights
• Ownership or licensing of inputs, outputs, or derived data
• Retention or deletion of data used in AI systems
• Disclosure of data to AI service providers or subprocessors
• No risk assessment possible: Without the actual marked-up provisions, it is not possible to determine whether the changes expand data-use rights, reduce confidentiality protections, increase third-party access, or alter liability and security obligations.

Required for Further Review

Please provide the actual diff, including the text shown with:

• Additions in {braces}
• Deletions in [brackets]
• Replacements in []{}

The full marked-up language is necessary to assess legal and AI-training-related risks.

The publisher records this document as revised on this date (“Effective Date: June 30, 2023”).

Summary

Information Provided

• The diff states only: “Added approximately 149 words to the document.”
• The actual added language is not included.
• No deletions, replacements, or substantive contractual wording are shown.

Legal and Risk Assessment

• It is not possible to determine what legal changes were made from the information provided.
• The nature of the added provisions—such as changes to liability, confidentiality, intellectual property, data protection, warranties, termination, or governing law—cannot be assessed.
• No conclusions can be drawn about whether the new language is favorable or unfavorable to the customer.

AI Training and Data Use

• The provided diff does not identify whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with an AI provider or other third party;
• Retained after the customer relationship ends;
• De-identified, aggregated, or anonymized before use; or
• Excluded from model-training activities unless the customer opts in or consents.
• The presence or absence of an AI-training authorization therefore cannot be determined.

Information Needed

To perform a meaningful review, provide the actual 149-word addition and any surrounding text showing whether it modifies existing provisions. Particular attention should be given to language addressing:

• “Training,” “fine-tuning,” “improving,” or “developing” models;
• Customer content, inputs, outputs, prompts, telemetry, or usage data;
• De-identification or aggregation;
• Third-party AI providers and subprocessors;
• Customer opt-out or consent rights;
• Data retention and deletion; and
• Ownership or licensing of data and model outputs.

Summary

The provided diff does not include the actual contract language or any visible additions, deletions, or replacements. It only states:

> “Text modified while maintaining similar length”

Accordingly, it is not possible to identify:

• The specific legal provisions that changed
• New obligations, restrictions, or liability exposure
• Changes to customer data rights or confidentiality
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is retained, de-identified, shared with providers, or used for product development
• Any changes to opt-out rights, consent requirements, security obligations, or deletion commitments

AI Training and Data Use

No meaningful conclusion can be reached regarding AI-model training because the relevant contractual text is absent. The actual diff should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models
• “service data,” “customer data,” “content,” or “inputs and outputs”
• De-identification, aggregation, or anonymization
• Human review or use for quality assurance
• Sharing with affiliates, subprocessors, or third-party AI providers
• Customer opt-out, consent, or restriction rights
• Data retention and deletion after termination
• Ownership or licensing of prompts, outputs, and derived data

Information Needed

Please provide the full redline using the stated notation, for example:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Without the underlying text, any assessment of legal risk—particularly regarding AI training and customer-data use—would be speculative.

Executive Summary

The diff is primarily a formatting and punctuation update. It changes curly quotation marks and apostrophes to straight ASCII quotation marks and apostrophes. No material change to the substantive privacy terms is apparent.

Important Changes

1. No apparent change to AI-training rights or data use

• The diff does not add or remove language expressly authorizing Sprout Social to use customer data, personal information, content, or usage data to train, fine-tune, or improve AI models.
• It also does not appear to modify any existing AI-training disclosure, opt-out right, data-retention provision, or restriction on using customer data for machine learning.
• Based on the text provided, there is therefore no identifiable change in AI-model training practices or customer control over such use.

2. Punctuation and quotation-style changes

Numerous terms are changed only from typographic punctuation to standard ASCII characters, including:

• “Privacy Policy” → "Privacy Policy"
• “Site” and/or the “Services” → "Site" and/or the "Services"
• “About Us,” “How to Contact Us,” “Your Data Protection Rights,” and other headings
• Curly apostrophes in terms such as customers’, user’s, party’s, consumer’s, and agent’s
• “Do Not Track,” “Cookies,” “Data Privacy Frameworks,” and “DPF Principles”

These changes should not alter legal meaning, but they may affect presentation, text matching, or automated document-linking systems.

3. No apparent change to tracking or advertising practices

The provisions concerning:

• Do-Not-Track signals;
• Cookies and similar tracking technologies;
• Matched Ads and audience matching;
• Global Privacy Control; and
• targeted advertising, sale, and sharing under the CCPA

appear substantively unchanged. The policy still states that browser Do-Not-Track requests are not recognized.

4. Existing disclosure regarding influencer data remains

The policy continues to state that Sprout Social may disclose creator personal information to customers through its Influencer Marketing platform. It also maintains language addressing potential CCPA “sale” or “sharing” treatment of advertising-related activities.

This is not a newly introduced risk in the shown changes, but it remains an important disclosure for creators and customers handling creator data.

Risk Assessment

• AI-training risk: No new or changed risk identifiable from this diff.
• Privacy/compliance risk: No material change apparent.
• Drafting risk: The conversion to straight quotation marks could create minor formatting or accessibility issues, but is unlikely to affect enforceability.
• Review limitation: If AI-use terms exist elsewhere in the full policy or linked terms, they are not shown as changed here.

Summary of Important Changes

Overall assessment

The diff is predominantly non-substantive formatting and punctuation updates, especially replacing straight quotation marks with typographic curly quotation marks and correcting apostrophes. No clear changes were identified to the policy’s core data-collection, retention, security, or customer-contract terms.

AI model training

• No provisions addressing AI, machine learning, generative AI, model training, or use of customer data to train models appear to have been added, deleted, or modified.
• The diff does not create or remove:
• A right to use customer data for AI training;
• A restriction on using customer content or personal information for model development;
• An opt-out or consent mechanism for AI training;
• Ownership or licensing rights concerning AI inputs or outputs; or
• De-identification, aggregation, or anonymization requirements for AI-related use.
• Accordingly, this diff does not appear to change the customer’s AI-training risk position. Any AI-related rights or restrictions would need to be located elsewhere in the full Privacy Policy, Services Agreement, Data Processing Addendum, or product-specific terms.

Potentially substantive clarifications

Definitions and regulatory language

• The policy’s definitions of “Targeted advertising,” “Cross-context behavioral advertising,” “Sale,” and “Profiling” are presented with corrected quotation and punctuation formatting.
• These changes do not appear to alter the legal scope of the definitions, but the definitions continue to support broad treatment of advertising, profiling, and sharing activities under applicable privacy laws.

Advertising and influencer disclosures

• The policy continues to state that Sprout Social may disclose creator personal information to customers through its Influencer Marketing platform.
• It also continues to address potential CCPA “sale” or “sharing” treatment of advertising-related activities, including sharing advertising identifiers, hashed contact information, and conversation information.
• These statements may be important for customers whose data is processed through advertising, audience-matching, or influencer-marketing features, but the diff does not materially expand or narrow them.

Privacy rights and tracking

• References to “Do Not Track,” Global Privacy Control, “Do Not Sell or Share,” data-access appeals, deletion, correction, and other privacy rights are merely reformatted.
• The policy still states that Sprout Social’s systems do not recognize browser “Do Not Track” signals.
• The policy continues to describe cookies, analytics, targeted advertising, and audience matching as potential data uses.

Data Privacy Frameworks

• References to the EU-U.S., UK-U.S., and Swiss-U.S. Data Privacy Frameworks and their principles are reformatted but not substantively changed.

Risk conclusion

Based solely on this diff, there are no newly identifiable legal risks and no apparent change to AI-training practices. The principal limitation is that the diff may omit unchanged language elsewhere in the policy; a definitive AI-data-use assessment requires review of the complete current policy and related contractual documents.

Summary of Important Changes

Overall assessment

The diff is primarily typographical and formatting cleanup, especially replacing curly quotation marks with straight quotation marks and correcting apostrophes. These changes generally do not alter the legal meaning of the Privacy Policy.

No clear substantive change to customer rights, data-processing purposes, retention, security, or sharing obligations is shown in the supplied diff.

Changes potentially relevant to data use and disclosure

• The policy continues to describe sharing of information through:
• Cookies and similar tracking technologies;
• Matched Ads and audience matching;
• Targeted advertising and cross-context behavioral advertising;
• Influencer Marketing activities; and
• Sharing of creator information with customers.
• References to CCPA concepts such as “sale,” “sharing,” “targeted advertising,” and “profiling” appear to have been reformatted rather than substantively revised.
• The policy continues to state that Sprout Social may share advertising identifiers, hashed contact information, and conversation information for advertising, sale/sharing, or profiling purposes. The diff does not indicate that the scope of these activities was expanded or narrowed.
• The Data Privacy Framework references and related compliance language appear unchanged apart from punctuation.

AI model training

• No provision in the supplied diff expressly addresses AI, artificial intelligence, machine learning, model training, fine-tuning, or use of customer data to improve models.
• There is therefore no identifiable change in the policy concerning whether customer data, customer content, social-media data, analytics, or personal information may be used to train AI models.
• This diff does not establish that customer data is excluded from, or permitted for, AI training. That issue would need to be assessed by reviewing:
• The full current and prior Privacy Policies;
• The customer agreement or terms of service;
• Product-specific terms;
• Data-processing agreements; and
• Any AI or acceptable-use documentation.

Other notable items

• The policy continues to state that Sprout Social does not generally “sell” personal information in the traditional sense, while acknowledging that certain Influencer Marketing and advertising-technology activities may qualify as “sale” or “sharing” under the CCPA.
• A consumer-request metrics table is shown, including deletion, correction, Do Not Sell/Share, and access requests for 2024 and 2025. The figures displayed appear incomplete or zero-filled and may warrant verification for accuracy and presentation.
• The policy continues not to recognize browser Do Not Track signals.

Risk assessment

Low substantive risk based solely on this diff. The principal legal risk is not a newly introduced obligation, but potential ambiguity about AI training because the policy does not expressly clarify whether customer data may be used for that purpose.