A privacy policy is not a document signed once and forgotten. Product iteration, supplier changes and regulatory developments all produce amendments. The common practice is to update the text, change the effective date and add a line at the foot of the site that continued use constitutes acceptance. That may be acceptable for non-material changes; for material changes it is not, because consent must be specific, informed and withdrawable rather than a blanket authorisation for the future.
1. Three categories of change and their consequences
| Category | Example | Re-consent required |
|---|---|---|
| Non-material | Contact details updated, wording refined, typographical corrections | No; notice sufficient |
| Material but not adverse | New security measures, shorter retention | Generally no; notice required |
| Adverse | New processing purpose, new third-party provision, wider collection | Yes |
The boundary between the categories is not the size of the textual amendment but the effect on the individual. Shortening retention or strengthening security increases the individual’s protection, so notice suffices. Adding a purpose or widening sharing affects the individual, so fresh consent is required.
2. Five tests for materiality
Whether a change is material can be tested item by item.
- The purpose changes. From service delivery to model training, advertising recommendation or risk assessment.
- The categories increase. New collection of location, contacts or biometrics, or processing of third-party personal information contained in user input.
- The recipients increase. A new model provider, a new affiliate sharing arrangement, a new SDK.
- The method changes. From local to cloud processing, or from domestic to overseas processing.
- Rights become harder to exercise. The entry points for deletion, withdrawal or account closure are narrowed, or response times extended.
Any one of the five makes the change material. The frequent real-world case is the third and fourth occurring together: integrating a new overseas model service is both a new provision to a third party and a change of processing method, and each requires fresh consent.
3. Notice content and effective-date arrangements
The purpose of notice is not to announce that the text has changed but to tell users what changed and what it means for them. Notice should therefore contain four elements: the substance of the change, its effect on user rights, the effective date, and how to refuse and what follows from refusal.
| Method | Use | Caution |
|---|---|---|
| Pop-up | Material changes requiring re-consent | Requires affirmative confirmation; no pre-ticked box |
| In-app message or email | Material but not adverse changes | Retain delivery records |
| Site announcement | Non-material changes | Notice period should not be too short |
Material changes should carry a reasonable transition period, usually no less than seven days, so that users can read and decide. Making a change effective on the day it is published is readily characterised, in a dispute, as failing to give a reasonable opportunity to take note.
4. Four situations requiring fresh consent
New processing purpose. Existing consent covers existing purposes only; a new purpose needs new consent.
New provision to third parties. Providing personal information to a third party requires separate consent, and a new recipient requires fresh consent.
New processing of sensitive personal information. Sensitive information requires separate consent, with notice of the necessity of processing and its effect on the individual.
New cross-border provision. Cross-border provision requires separate consent and notice of the recipient’s name, contact details, purpose and method.
All four share a common feature: consent must be separate and specific and cannot be obtained by updating the policy and treating continued use as acceptance.
5. Handling users who refuse
A user who refuses the new consent cannot simply be denied all service. Three routes are available.
Route one: degraded service. Retain basic functionality that does not depend on the new purpose and suspend only the functionality that does. This is the most common approach, provided the product can separate authorisation by module.
Route two: an alternative. For example, allow the user to opt out of model improvement while retaining basic generation. Where this is technically feasible, it should be offered.
Route three: termination and deletion. Where the user accepts neither the new terms nor the degraded service, terminate on request and delete the personal information, explaining the backup and export arrangements.
Treating refusal as grounds for terminating all service, as the only option, risks being characterised as an unreasonable restriction in consumer-facing contexts.
6. Records and evidence
Evidence for change management includes the full text of each version, effective dates, a change comparison note, delivery records of notice, records of user consent with time, method and version number, and records of how refusals were handled.
The change comparison note is the most commonly omitted item. It need not be published, but in regulatory enquiries and disputes it demonstrates that the company understood what it changed, why, and with what effect. A version archive without a comparison note often cannot explain the rationale for the change.
7. Checklist
| No. | Item | Pass standard |
|---|---|---|
| 1 | Classification | Categorised; conclusion recorded |
| 2 | Five tests | Each tested; hits marked |
| 3 | Notice content | Substance, effect, effective date, refusal route |
| 4 | Notice method | Chosen by category; delivery provable |
| 5 | Transition | At least seven days for material changes |
| 6 | Separate consent | All four situations implemented independently |
| 7 | Refusal routes | Degrade, alternative or terminate |
| 8 | Version comparison | Change note exists, not merely an archive |
| 9 | Internal alignment | Support, operations and product aware of new terms |
| 10 | Periodic review | Full review at least annually |
Change management for a privacy policy is ultimately a question of whether consent is real. The text may be updated at any time, but consent does not renew itself. Getting this right is what allows a company to stand behind its position when a complaint or an inspection arrives.
Related reading: privacy policies for AI products, user agreements for AI products, personal information protection impact assessment, new duties for large personal information processors, and the data compliance service page.
Last updated: 10 September 2026.
Frequently Asked Questions
What counts as a material change?
Five tests: a substantive change in processing purpose, categories of information, processing method, recipients, or how users exercise their rights. Meeting any one triggers material-change treatment.
How should a material change be notified?
Notify in advance and prominently, through a standalone prompt, or an in-app message plus SMS or email, explaining the change and its consequences, then obtain fresh consent.
What if a user refuses?
Offer an alternative that does not require acceptance, such as basic functions only, data export or account closure. Withholding all service to force consent is not permitted.
Do minor changes require fresh consent?
No. They take effect after publication with records retained, provided the change does not materially expand the processing scope.
How long should change records be kept?
At least a reasonable period after termination, preferably three years, for complaints, inspections and contractual evidence.
Do new terms bind a user who did not consent?
A material change does not take effect for users who did not consent. Continue under the original terms, or terminate lawfully and deal with the data.