Beyond the Initial Agreement: How Privacy Drift Affects Modern Third-Party Contracting
A new CIPPIC report examines how privacy-relevant rights, obligations and data exposure can shift after an organization approves a cloud or AI service. Using Microsoft and Google as case studies, it describes agreement stacks whose documents, features and data practices may change on different schedules, alongside shadow AI as a separate route into a different contractual environment.
What the report examines
The report describes privacy drift as a gradual expansion or alteration of privacy-relevant rights and obligations that materially changes privacy conditions or data exposure over time. Its focus is public-sector contracting and governance, with Microsoft and Google as principal examples—not a claim that every vendor or service has identical terms.
An agreement stack can include a master agreement, product terms, a data-processing addendum, service-specific terms, policies and technical settings. Those layers can be updated through different mechanisms, so a point-in-time procurement review may not capture later changes to the environment.
Why ongoing review matters
The report highlights unilateral online changes, new-feature carve-outs, user-adjacent data such as telemetry or feedback, and changes to subprocessors as mechanisms that can affect the practical privacy picture. It also treats shadow AI—use of unapproved tools or accounts—as a separate exposure pathway, because staff may move into a different contractual and data-governance environment.
Its proposed response combines continuing monitoring and reassessment with workable employee policies and stronger governance of vendor changes. It sets out a six-part anti-drift legislative framework, including clearer agreement-stack disclosure, safeguards around risk-expanding unilateral amendments, coverage for user-adjacent and inferred data, matching vendor duties, and oversight and remedies. These are proposals in the report, not statements of law currently in force.
Attribution and scope
The report was prepared by CIPPIC for the Information and Privacy Commissioner of Ontario. The IPC's publication page says the report reflects its authors' views and not necessarily the IPC's views. Gareth Spanglett is a co-author. The report's legal and vendor-term analysis should be read within its stated public-sector context and checked against current primary sources before being relied on.