Policy Change Monitor: Privacy & Terms Tracker

What does Policy Change Monitor do?

Policy Change Monitor watches privacy policies, terms of service, cookie policies and DPA / subprocessor lists and gives you a row only when a document changes, with the added and removed paragraphs and a rule-based classification of what the change is about: data categories, third parties and subprocessors, retention periods, international transfers, arbitration and class-action waivers, liability caps, auto-renewal and cancellation, governing law, AI training on user data, and the effective date.

Give it company domains (up to 500) and it finds the documents itself: footer links first, then the usual paths (/privacy, /privacy-policy, /legal/privacy, /terms, /tos, /legal ...), always respecting each site's robots.txt. Or paste exact policy URLs. Schedule it daily and connect alerts by email, Slack or webhook.

For every change you get:

• 📄 the document type and URL, and the company domain
• 📏 the change size and the added and removed paragraphs (capped at 20 per row, each cut at 500 characters; the full diff is saved in your own key-value store)
• 🗓️ the policy's own "last updated" / "effective" date when it states one, and the previous one
• 🏷️ a classification with evidence: which topics the changed text touches, whether text on that topic was added, removed or modified, the changed sentences, and old → new values such as 90 days → 30 days or 12 months → 3 months
• 🧩 for subprocessor lists: the names added and removed
• 🧾 a one-sentence summary in plain language

No API key, no proxy, no login and no AI model: the Actor fetches public pages with plain HTTP and classifies with headings and keywords, so it is cheap, repeatable and every result can be checked against the quoted text.

Who is it for?

• Procurement and vendor-risk teams: know when a vendor adds a subprocessor, changes retention or moves data abroad.
• Data protection officers and privacy counsel: track changes in the policies of the vendors in your records of processing.
• Legal ops and contract managers: get notified when terms add arbitration, cap liability, or turn on auto-renewal.
• Competitor and market research: see how other companies change their privacy and AI-data terms.

How to use it

1. Click Start with the default input: three company domains. The first run finds each company's documents and saves a baseline (a row that says "baseline saved").
2. From the second run on, you get a row only when a document changed (the default input also asks for unchanged rows, so that a first try and Apify's daily test show something; turn Also return unchanged documents off for monitoring).
3. Replace the domains with your vendors, or paste exact policy URLs. Give the monitor a name: its snapshots live in the named key-value store policy-monitor-<name>.
4. Add a schedule (daily or weekly) and an integration (Slack, email, webhook, Zapier, Make, n8n) to the task.

Domains or exact URLs? A bare domain or home page (acme.com) is searched for policy documents. Any other address (acme.com/legal/privacy) is checked as it is: its type (privacy policy, terms, cookie policy, DPA) is read from the address and the page title. The documents found for a domain are remembered for 30 days (or until one stops existing), so later runs only fetch the documents.

What counts as a change, and how the classification works

The Actor extracts the main text of each document (menus, headers, footers, cookie banners and scripts removed) as paragraphs, compares it with the saved version and reports added and removed paragraphs. It then looks for these topics in the changed paragraphs and in the headings above them:

Topic	Typical words
Data categories	categories of personal data, information we collect, device / location / biometric data, identifiers
Third parties / subprocessors	third parties, subprocessors, service providers, partners, share / sell data; in a subprocessor list: every row that appears or disappears
Retention periods	retain, retention, kept for, delete after, periods such as 90 days
International transfers	transfers, outside the EEA, standard contractual clauses, adequacy, Data Privacy Framework
Arbitration / class-action waiver	arbitration, class action, waive, jury trial, dispute resolution
Liability cap	limitation of liability, aggregate liability, in no event, amounts or periods ("fees paid in the 12 months")
Auto-renewal / cancellation	automatically renew, renewal, cancel, termination, refund, free trial
Governing law	governing law, governed by the laws of, jurisdiction, venue
AI training on user data	AI or machine learning together with training, or with your content and data
Effective date	a changed "last updated" / "effective date"

This is keyword matching, not understanding: it tells you where to look, quotes the changed text as evidence and does not judge whether a change is good or bad. Wording that uses other words can be missed, and a keyword in an unrelated sentence can trigger a topic. Always read the quoted paragraphs.

Input example

{
    "startUrls": [
        { "url": "https://acme.com" },
        { "url": "https://vendor.example/legal/privacy-policy" },
        { "url": "https://another.example/subprocessors" }
    ],
    "includeUnchanged": false,
    "ignoreDatesAndTimes": false,
    "monitorName": "vendor-policies"
}

Output example

Discovery and baseline: real output of the default input on 1 October 2026 (first run, 11 documents found and saved):

domain	document	status	policy says	URL
mailchimp.com	privacy policy	baseline	March 9, 2026	https://www.intuit.com/privacy/statement
mailchimp.com	terms of service	baseline	October 10, 2025	https://mailchimp.com/legal/terms/
mailchimp.com	cookie policy	baseline	August 1, 2023	https://mailchimp.com/legal/cookies/
mailchimp.com	DPA / subprocessor list	baseline	Feb. 29, 2024	https://mailchimp.com/legal/subprocessors/
atlassian.com	privacy policy, terms, cookie policy, DPA	baseline	–	https://www.atlassian.com/legal/…
apify.com	privacy policy, terms, cookie policy	baseline	July 9, 2026	https://docs.apify.com/legal/…

The same domains on the next run: 11 unchanged rows (or no rows, with Also return unchanged documents off).

A change row. Live policies change rarely, so to show a real change the saved version of Mailchimp's terms was edited on the test machine (the Delaware / Georgia wording, the class-action sentence and an AI sentence removed, an older date) before the next run; the rest of the row is what the Actor produced from the live page:

{
    "domain": "mailchimp.com",
    "documentType": "terms-of-service",
    "url": "https://mailchimp.com/legal/terms/",
    "status": "changed",
    "summary": "Terms of service changed: 3 paragraphs added, 1 removed. Topics touched: third parties / subprocessors (added); arbitration / class-action waiver (modified); AI training on user data (added); effective date (October 10, 2024 → October 10, 2025). The document says it was last updated October 10, 2025.",
    "changeSize": 1297,
    "addedParagraphsCount": 3,
    "removedParagraphsCount": 1,
    "removedParagraphs": ["The State of Delaware laws and the Federal Arbitration Act will govern all disputes arising out of or relating to the Service and the Agreement, regardless of conflict of laws rules."],
    "policyLastUpdated": "October 10, 2025",
    "policyLastUpdatedDate": "2025-10-10",
    "previousPolicyLastUpdated": "October 10, 2024",
    "topics": ["third-parties", "arbitration-class-action", "ai-training", "effective-date"],
    "topicChanges": [
        { "topic": "arbitration-class-action", "direction": "modified", "section": "VI. Other Important Stuff",
          "addedEvidence": ["The State of Georgia laws and the Federal Arbitration Act will govern all disputes …"],
          "removedEvidence": ["The State of Delaware laws and the Federal Arbitration Act will govern all disputes …"], "detail": null }
    ],
    "foundBy": "footer-link",
    "error": null
}

Fields worth knowing:

• status: baseline (first check, saved), changed, unchanged (only on request) or error (a free info row).
• topicChanges[].direction: added (only new text mentions the topic), removed, or modified (both, for example a sentence was edited). detail shows old → new for retention periods, liability amounts or periods, effective dates and subprocessor names.
• foundBy: input (your exact URL), or footer-link, common-path, legal-index for discovered documents.
• Rows with an error code are free: robots-disallowed, http-error, blocked, timeout, empty-content, no-documents-found, document-not-found, invalid-url.

How much does it cost?

This Actor uses pay per event:

Event	Price
Document checked (fetched and compared, including baselines)	$0.002
Documents that fail to load, domains where nothing is found, documents robots.txt does not allow, info rows	free

• A vendor with 4 documents costs $0.008 per run; 100 vendors checked weekly (about 400 documents) cost about $3.20 a month.
• Finding a domain's documents (a handful of requests) is included; it is repeated only every 30 days.
• Set Maximum cost per run in the run options and the Actor stops when it is reached.

Limitations

• Heuristic discovery. Footer links and usual paths find most vendors' documents but not all, and can pick a related page (for example a consumer-terms page instead of the business terms). Check the url of each baseline, and paste exact URLs where it matters. When a document is not found the run says so in a free document-not-found row.
• Pages that need JavaScript (some policy centres) have no text in the HTML: they give a free empty-content row. This Actor does not run a browser.
• robots.txt is respected for discovery and for every document. A document that robots.txt disallows is not read (free robots-disallowed row); the Actor sends an identifiable User-Agent and waits at least 1.5 s between requests to the same site.
• Language: the document types and topics are recognised in English; link texts and dates are also read in German, French and Spanish, but the topic keywords are English.
• Classification is keyword matching (see above), not legal analysis. Not legal advice.
• Version history starts at your first run: the Actor compares each document with the version it saw last time, it does not know earlier versions.
• Up to 500 domains or URLs per run, at most one document of each of the four types per domain.
• The saved snapshots and diffs are in your own key-value store; the Actor does not share them.

Data and your responsibility

• The Actor reads public web pages of companies. Policy texts belong to their authors: the output only quotes changed paragraphs (at most 20 per row, 500 characters each) for monitoring. Check the site's terms before you republish them.
• The documents are company documents, not personal data. The Actor stores nothing about people.
• Not affiliated with any company whose documents you monitor.

FAQ

Do I get a row when nothing changed?

No, unless you turn on Also return unchanged documents. The first run returns "baseline saved" rows.

Can I track a document that robots.txt blocks?

No. The Actor respects robots.txt and tells you with a free row. Ask the vendor for a feed or notification instead.

Why did a change not show up under a topic?

The classification looks for keywords in the changed text and in the headings above it. A change that uses other words can be missed. The added and removed paragraphs are always in the row.

Does it use AI?

No. Discovery, comparison and classification are rules; nothing is sent to an AI service.

How do I track a subprocessor list?

Give the vendor's domain (the list is found as "DPA / subprocessor list" when it is linked or at a usual path such as /subprocessors) or paste the exact URL. Rows then show subprocessorsAdded and subprocessorsRemoved.

More tools from the same developer

All pay-per-result, no proxy or login needed, built and maintained by the same developer:

Website audits

• Website Accessibility Checker: WCAG 2.2 & EAA: accessibility issues with fixes, SEO basics and security headers.
• Cookie & Tracker Audit: GDPR Consent Checker: cookies and tracking tags that load before consent.
• AI Crawler Access Checker: robots.txt & llms.txt: which AI crawlers a site allows, plus llms.txt.
• Structured Data Validator: Schema & Rich Results: JSON-LD and Microdata checked against Google's rich result rules.
• Website Change Monitor: Diffs, Prices & Alerts: get a row only when a page changes, with a clean diff.
• SaaS Pricing Monitor: Track Competitor Plans: competitor pricing plans as structured data, with price-change diffs.
• Sitemap Change Monitor: New & Removed URLs: new, removed and changed URLs from a site's sitemaps.
• Site SEO Crawler: Broken Links & On-Page Audit: site-wide crawl for broken links, redirects and on-page SEO issues.
• Website Tech Stack Detector: Bulk Lead Filters: technologies used by websites, with filters for lead lists.
• Domain Availability & Expiry Checker (RDAP): domain availability, registrar and expiry dates from RDAP.
• Status Page SLA Monitor: Uptime & Incidents: SaaS vendor uptime, incidents and a monthly SLA table from public status pages.

Company data and compliance

• Company Contact Finder: Emails, Phones & Socials: contact details published on company websites.
• UK New Companies Feed: Companies House Daily: newly incorporated UK companies with sector filters.
• EU VAT Number Validator: Bulk VIES Checker: bulk VAT checks with name, address and consultation number.
• LEI Corporate Tree: GLEIF Parents & Subsidiaries: LEI lookup with parents, subsidiaries and a KYC summary.
• UK Company Distress Watch: Insolvency Alerts: administrations, liquidations and winding-up petitions from The Gazette.
• IBAN Validator: Bulk Check & Bank Lookup: IBAN format and checksum, plus bank name and BIC where open data exists.
• Sanctions Screening: OFAC, EU, UN & UK Lists: names screened against official sanctions lists, with match scores.
• OSHA & EPA Violation Monitor: Fines by Company: US OSHA and EPA enforcement cases and penalties by company.
• Email List Precheck: Syntax, MX & Disposable Check: cheap email list hygiene before a real verification.
• UK Company Officer Changes: Director & PSC Alerts: director, owner, address and status changes for a watchlist of UK companies.
• FDA Warning Letters Monitor: By Company & Subject: FDA warning letters by company and subject, with cited regulations.
• Supplier Risk Report: Sanctions, VAT & Insolvency: one risk row per supplier from eight official registers, with changes since last run.
• Brand Impersonation Domain Monitor: Look-alikes: look-alike domains and certificates that imitate your brand, with a risk score.

Media and AI

• Audio & Video Transcriber: Podcasts, SRT, Speakers: audio, video, podcasts and social links to text, SRT and VTT.
• Podcast Mention Alerts: Brand Mentions by Second: where your brand is said in new podcast episodes, with the exact second.
• News Brand Mentions Monitor: New Articles Only: new news articles about your brand, people or topics.
• YouTube Channel Monitor: New Videos & Growth: new videos and view growth of the channels you watch.

Market signals

• US WARN Layoff Notices: 12 States Daily Feed: layoff and plant closure notices from official state sources.
• US Product Recalls Monitor: FDA & CPSC Feed: FDA and CPSC recalls in one feed, with severity.
• EU Tenders Feed: TED Public Procurement Alerts: EU public tenders from TED with CPV, country and value filters.
• Liquor License Openings: New Bars & Stores (US): new US liquor licences from official state open data.
• Clinical Trials Change Monitor: Status & Updates: status, enrollment and results changes on ClinicalTrials.gov studies.
• Career Site Jobs Monitor: ATS Jobs & New Roles: open roles from company career sites, with new and closed roles since the last run.
• App Reviews Monitor: App Store & Google Play: app reviews from both stores, only new ones in monitor mode.
• US Federal Contracts Feed: SAM.gov & USAspending: SAM.gov contract opportunities with the buyer's award history.
• Grants.gov Opportunities: US Federal Grants Feed: US federal grant opportunities by keyword, eligibility and agency.
• Federal Register Monitor: US Rules & Notices Feed: new US rules, proposed rules and notices by agency or topic.
• B2B Sales Trigger Feed: Hiring + Tech Leads: companies hiring for a role and using (or not using) a technology, with contacts.
• Local Business Leads: OpenStreetMap, No Website: local businesses by city and category, including those with no website.
• Solana Token Pair Monitor: New & Trending Pairs: new and trending Solana pairs with liquidity, volume and safety flags.

Feedback

Missing a topic or a document type? Open an issue on the Issues tab.