# Policy Change Monitor - Terms & Privacy Diffs (`data_foundry/policy-change-monitor`) Actor

Terms of service and privacy policy change monitor. Watch policy pages and PDFs, get line-level diffs when they change, with moved-page detection and webhook alerts.

- **URL**: https://apify.com/data_foundry/policy-change-monitor.md
- **Developed by:** [Data Foundry](https://apify.com/data_foundry) (community)
- **Categories:** Business, Automation, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$2.00 / 1,000 policy page checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Policy Change Monitor

Watch terms of service, privacy policies and DPAs, and get a readable diff when they change - "3 lines added, here they are" rather than "the page changed". Works on HTML pages and PDFs.

<table>
<tr>
<th>What you get</th>
<th>Built for</th>
</tr>
<tr>
<td valign="top">

📄 **HTML and PDF** policies, parsed the same way <br>
🔍 **Line-level diff** with quoted added and removed lines <br>
📏 **Page-moved detection** via a similarity score <br>
🧩 **Beyond-window flag** when a change lands past the stored text <br>
🔔 **Webhook with HMAC signing** on change only <br>
🛡️ **False-empty guard** - a broken parse never reads as "policy emptied"

</td>
<td valign="top">

⚖️ **Compliance monitoring** for DPOs and legal <br>
🏢 **Vendor risk reviews** across dozens of suppliers <br>
📑 **Contract and DPA tracking** with an audit trail <br>
🤖 **LLM-ready JSON** for review workflows <br>
🔗 **API, schedules, webhooks** via Apify <br>
🧪 **Free test runs** on the Free plan

</td>
</tr>
</table>

### What data do I get?

One dataset record per URL per run, with the diff already computed.

- **`changed`** - true when the normalised text differs from the previous run
- **`addedLines` / `removedLines`** - how much moved
- **`addedSample` / `removedSample`** - up to five of the actual lines, truncated for readability
- **`similarity`** - word overlap with the previous version (0 to 1)
- **`replaced`** - true below 0.4 similarity, which usually means a redesign or a different document at the same URL
- **`beyondWindow`** - true when the page changed past the 20,000 character diff window
- **`suspicious`** - the page shrank to almost nothing but the previous state is kept, so a broken parse never looks like a deletion
- **`wordCount`**, **`pageHash`**, **`scrapedAt`** - for auditing

### How much does it cost?

Pay per event: **$2.00 per 1,000 pages checked** ($0.002 each), whether the page is HTML or PDF. You are not charged for pages that fail.

| You monitor | Runs | Monthly cost |
|---|---|---|
| 20 policies, weekly | 87 | **$0.17** |
| 50 policies, daily | 1,500 | **$3.00** |
| 200 policies, daily | 6,000 | **$12.00** |

That is roughly **50x cheaper** than the change monitors that charge $100 per 1,000 checks.

### How do I use it?

1. [Create](https://console.apify.com/sign-up) a free Apify account.
2. Open **Policy & Terms Change Monitor** in Apify Console.
3. Paste the policy URLs you are accountable for.
4. Add a `webhookUrl` if you want to be notified rather than check.
5. Run it once as a baseline, then schedule it daily or weekly.
6. Read `addedSample` to see the wording that changed.

### Input

| Field | Type | Description |
|---|---|---|
| `urls` | array | Policy URLs. HTML and PDF are both accepted. |
| `minWords` | integer | Below this word count a page is treated as an extraction failure (default 50). |
| `webhookUrl` | string | Optional https endpoint, called only when a policy changed. |
| `webhookSecret` | string | Optional. Adds `X-Signature-256: sha256=...`. |
| `proxyConfiguration` | object | Optional, for sites that block datacenter IPs. |
| `concurrency` | integer | Pages fetched in parallel (default 4). |

```json
{
  "urls": [
    "https://policies.google.com/terms",
    "https://stripe.com/legal/terms"
  ],
  "minWords": 50,
  "webhookUrl": "https://hooks.slack.com/services/..."
}
```

### Output

```json
{
  "url": "https://pdfobject.com/pdf/sample.pdf",
  "title": "sample",
  "changed": false,
  "addedLines": 0,
  "removedLines": 0,
  "addedSample": [],
  "removedSample": [],
  "wordCount": 415,
  "pageHash": "87657b40d081b94240333a512684ce80e04f131685aebc9f074df6587aa4b96c",
  "beyondWindow": false,
  "similarity": 1,
  "replaced": false,
  "scrapedAt": "2026-11-06T09:24:51+00:00"
}
```

The `POLICY_SIGNALS` record holds per-URL state plus totals (`changed`, `addedLines`, `suspicious`, `failed`) and any errors.

### Notes and exceptions

- **The first run is a baseline.** `changed` is false by construction; the second run is where diffs start.
- **Scanned PDFs have no text layer.** They are reported as an extraction failure rather than an empty policy. OCR is not included.
- **Only the first 20,000 characters are stored and diffed.** A change deeper in a very long policy still sets `beyondWindow: true`, but the diff lines themselves are not available.
- **Pages that render entirely in JavaScript** will fail the `minWords` check and be reported as errors. Server-rendered policy pages and PDFs are the supported path.
- **A redesigned page scores low on similarity.** That is what `replaced` is for - it distinguishes "your terms were edited" from "a different document now lives at this URL".
- **Login-protected and paywalled pages are out of scope.**

### What can I do with the data?

**Vendor risk reviews.** You are accountable for the policies of every supplier who touches customer data. Point the actor at 50 of them, run it weekly, and read only the entries where `changed` is true.

**Compliance evidence.** Keep every dataset run. `pageHash` plus `scrapedAt` is a record that a policy said a particular thing on a particular date.

**Watching a competitor's terms.** Pricing and terms often move together. When they add an arbitration clause or change a refund window, you see the exact wording.

### FAQ

**Does it work on PDF terms?** Yes - `application/pdf` is parsed and diffed like HTML, including PDFs served as `application/octet-stream`. A PDF with no text layer is reported as a failure.

**How is this different from a website change monitor?** Most of those only tell you "changed: true" or diff the whole DOM. This returns the actual added and removed lines, detects moved or redesigned pages, and refuses to report a parser failure as a deletion.

**What happens if a page goes down?** The URL is reported as failed, previous state is preserved, and nothing is charged.

**Can I be alerted only?** Yes - set `webhookUrl` and ignore the dataset. Delivery retries on 5xx and 429 and never fails the run.

### Related Actors

- **[Competitor Pricing Page Monitor](https://apify.com/data_foundry/pricing-page-monitor)** - price points and diffs from pricing pages.
- **[Review Scraper](https://apify.com/data_foundry/review-scraper)** - reviews across 11 sources with a new-since-last-run diff.
- **[App Store Rank Tracker](https://apify.com/data_foundry/aso-app-rank-tracker)** - chart rank, rating and version changes.

### Changelog

- **0.6** - PDF support, magic-byte sniffing, linear similarity (a quadratic path could stall for 35s), page caps.
- **0.5** - `replaced` and `similarity` for moved or redesigned pages.
- **0.4** - `beyondWindow` so changes past the diff window are not missed.
- **0.1** - First release.

# Actor input Schema

## `urls` (type: `array`):

Public policy pages to watch: terms, privacy, refund, DPA, acceptable use. One URL per line, must start with http:// or https://. Pages behind a login, PDFs and internal addresses are not supported.

## `minWords` (type: `integer`):

A page with fewer words than this is treated as an extraction failure, not as an empty policy. Use it to catch block pages, cookie walls and client-side rendering breaks.

## `concurrency` (type: `integer`):

How many policy pages to fetch at the same time.

## `webhookUrl` (type: `string`):

If set, a JSON digest is POSTed whenever at least one page changed since the previous run, including the added and removed line samples. Must be https; private and loopback addresses are refused.

## `webhookSecret` (type: `string`):

When set, requests carry X-Signature-256: sha256=HMAC(secret, raw body), so your endpoint can verify the payload.

## `proxyConfiguration` (type: `object`):

Optional. Policy pages are public, so try without a proxy first. Enable a proxy if a site answers 403 or serves an empty shell to datacenter IPs; it then applies to every URL in the run.

## Actor input object example

```json
{
  "urls": [
    "https://policies.google.com/terms"
  ],
  "minWords": 50,
  "concurrency": 4
}
```

# Actor output Schema

## `changes` (type: `string`):

One record per URL: title, changed, added and removed line counts, up to 5 sample lines of each, word count, page hash and scrape time.

## `signals` (type: `string`):

Per URL: changed, addedLines, removedLines, isFirstRun, suspicious. Plus totals for the run and any pages that failed.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://policies.google.com/terms"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("data_foundry/policy-change-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": ["https://policies.google.com/terms"] }

# Run the Actor and wait for it to finish
run = client.actor("data_foundry/policy-change-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://policies.google.com/terms"
  ]
}' |
apify call data_foundry/policy-change-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,data_foundry/policy-change-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/jPRrcFYdNCNKhyNlg/builds/XMTbhrlbX7r8yE4aF/openapi.json