FTC retroactive terms of service AI: what it says
The short answer
The FTC says retroactive, quiet changes to allow AI use may be unfair or deceptive. FTC staff published that position. 1Health paid $75,000 in 2023 for a retroactive privacy change. Avast paid $16.5 million in 2024 and had to delete derived data and algorithms.
The FTC blog post is staff commentary. It is not a rule. Its weight comes from the cases behind it, so I have listed them in order.
What did the FTC say?
Staff in the Office of Technology and the Division of Privacy and Identity Protection wrote that a company may not collect data under one set of promises and then change them in secret. They added that users may have no recourse because switching costs are high.
The post says the FTC will pursue firms that "surreptitiously re-write" their privacy policies or terms. The goal of those firms is to give themselves free rein to use consumer data for product development (FTC).
Which cases does the FTC cite?
It names two cases. Gateway Learning Corporation (2004) changed its privacy policy to share consumer data with third parties. It gave no notice and got no consent. The second case is 1Health.io (2023).
The 1Health order was finalized 7 Sep 2023. It charged that in 2020 the company retroactively widened the third parties it could share data with. It did not tell consumers or get consent. It paid $75,000 for refunds (FTC).
What happened with Match and OkCupid?
On 30 Mar 2026 the FTC announced an action over OkCupid. It gave an unrelated third party access to photos, location and demographic data of nearly three million users. The third party's investors included OkCupid's founders.
The order permanently bars the companies from misrepresenting how they collect, use and share personal information. The release lists no money (FTC).
Can the remedy reach what was built from the data?
In some orders, yes. The Avast order, announced 22 Feb 2024, required deletion of web browsing information sent to Jumpshot "and any products or algorithms Jumpshot derived from that data." It also required $16.5 million for consumers (FTC's Avast order announcement).
The Rite Aid order, announced 19 Dec 2023, required deletion of images and any algorithms or other products developed using them (FTC's Rite Aid announcement).
My reading is that a buyer could face a deletion demand over data that was unlawfully obtained. That demand would reach back to the owner through contract warranties. That is analysis. It is not a holding.
The Everalbum order and the limits of model deletion are in our page on FTC model deletion orders.
What does this mean for a company with an archive?
Your notice history matters. What were customers and employees told when their records were collected? Does a license to an AI buyer fit it? Our page on updating your privacy policy covers the California side. The consent page covers when fresh consent may be the safer course.
The risk map lists the other exposures. The rights check starts the fact-finding. Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
