Aug 1, 2026, 10:51 AMyear 2026relevance 25024 min read

Higgsfield Changed Its Terms Twice · What Remained

Theoretically Media's Tim sparked an important discussion by analyzing terms submitted by Higgsfield on July 23, 2026. Three days later, the company published a review. This guide compares the two official texts, confirms the improvements, identifies the remaining training consent, and turns the debate into a checklist for creators and agencies.

Video credit: Tim · Theoretically Media.Source video: Fine. Let's Talk About Higgsfield..

Quick Summary

  • The July 23, 2026 version never came into force for old users. It was archived and replaced by the July 26 revision, effective immediately for new accounts and August 27 for previous accounts, unless accepted in advance.
  • The original license to content was transferable, perpetual, irrevocable, and sublicensable at multiple levels. The revision removes those words, limits the license to operating the service, and terminates it when the content or account is deleted, with exceptions for backups, public content, prior uses, and legal retention.
  • Higgsfield goes on to say that content, inputs and outputs from regular accounts can be used to train and improve models, algorithms, products and services. The contractual treatment of Enterprise customers is different.
  • Canceling a subscription ends future charges, but does not delete your account or files. To stop future use of content in training, the current text points to deleting the content or account, followed by a 30-day recovery window.

--what to try first

  • Ownership and license are not the same thing: the user maintains ownership, but grants rights to use the platform.
  • The review was a material improvement, particularly in the duration, transferability and purpose of the license.
  • Consent to training remains active by default on accounts covered by the general terms.
  • Private content shouldn't be used in marketing without consent, but public content, contests, and showcases have different rules.
  • Photographs, video and voice require appropriate consents from the persons depicted.
  • Derived biometric data is described as temporary and limited to the requested functionality, but uploaded files remain subject to the remaining content and training rules.
  • Unlimited means fair use, dedicated queue, variable speed and possible competition limits.
  • Subscription credits do not carry over; Additional packs expire after 90 days.
  • The complaints shown on Discord and the claim of 331 thousand views belong to the creator's account and are not independent proof of a universal standard.
  • For client work, the decision should start with consent, confidentiality, training, retention and subprocessors, not the quality of the demo.

Before You Begin: Credit, Scope, and Disclaimer

This article is based on Tim's video from Theoretically Media channel and the transcript provided for this publication. The video deserves credit for bringing attention to the text sent on July 23, documenting the community's reaction, and returning to the topic after review.

The analysis below is not legal advice. It is an editorial reading of the official documents available as of August 1, 2026. Terms, policies, plans and interfaces may change. For a sensitive campaign, work with minors, faces, voices, confidential data or client contracts, consult someone qualified in the applicable jurisdiction.

It is also important to separate three layers of evidence. Terms and privacy policy clauses are official sources. The experiences, Discord captures, and reach numbers are Tim's reporting. The operational recommendations in this guide are analysis to help creators make more informed decisions.

The chronology: July 23, 25 and 26

On July 23, 2026, Higgsfield published new terms and a new privacy policy, initially presented with an expected entry into force on August 7 for existing users. Tim analyzed the text, published a thread on X and says that the publication exceeded 331 thousand views.

On July 25, Higgsfield published a plain-language explanation of ownership, training, billing, and disposal. On July 26, it published a second version of the terms. The official file itself confirms that the text of July 23 was replaced and did not produce the expected effect for old accounts.

The current version says it applies immediately to people who registered on or after July 26th. For those who registered earlier, the indicated date is August 27, 2026, or whatever time you accept before that. This difference in dates matters when documenting which text governed an account at a given time.

The short answer: it got better, but the training stayed

The simplest reading is this: the revision corrects the most aggressive part of the license, clarifies that the user keeps the exported outputs, limits the promotional use of private content and narrows the compensation. These changes are substantial.

The central point that has not changed is the authorization to use content, inputs and outputs in training and improving Higgsfield and affiliated systems. In normal accounts, there is no separate contractual opt-out button in the current text. The anticipated action to stop such use in the future is to delete the content or account.

This does not mean that Higgsfield owns everything. It means that ownership and license coexist. The user can maintain rights to the output and, at the same time, allow the platform to use materials for purposes described in the contract.

Before and after: the verifiable scorecard

Content license. Before: non-exclusive, transferable, perpetual, irrevocable, worldwide, free and sublicensable at various levels. After: non-exclusive, worldwide and free, with sublicensing only to service providers when reasonably necessary. The purpose is to operate, provide and maintain the service.

Duration. Before: the license was perpetual and irrevocable. After: lasts as long as the content is saved or available on the service and ends after deletion, subject to temporary backups, publicly shared content, previous permitted uses and legal obligations.

Marketing. Before: training, moderation, classification and promotional use appeared together among the possible uses. After: Private content and content created for customers should not appear in marketing without consent. Material that the user makes public, submits to a competition or puts in a showcase can be used in another way.

Commercial outputs. The review explicitly states that rights to generated and exported output survive account cancellation or deletion and may be transferred or sublicensed to customers.

Compensation and discretion. The compensation clause now links the content to situations in which rights are lacking or there is a violation of the agreement or law. In the ending for cause, sole discretion was replaced by reasonable discretion.

Training. Broad authorization remained. The revision adds an explanation of future deletion and recognizes that content already embedded in trained models cannot feasibly be removed.

Notice of changes. The specific commitment of at least 15 days for material changes has been replaced by reasonable advance notice. The deadline is no longer quantified.

The video graphically presents six victories and four setbacks. The narration provided describes in detail only two of these setbacks: incorporation of the privacy policy into the agreement and replacement of the 15 days with reasonable notice. Therefore, this article does not invent the two items that were not clear in the transcription and limits the scorecard to what is directly comparable in the documents.

The user owns, but grants a license

The current section 4.2 states that the company does not claim ownership of user content. Section 4.4 says the same for inputs and outputs and does not restrict the commercial use of the results.

Section 4.3, however, grants you a license to use, copy, reproduce, modify, adapt, translate, distribute, perform and display the content. In revision, these verbs remain, but the purpose, duration and ability to sublicense are narrower than in the archived text.

For an agency, the decisive detail is the representation given by the user: it must have sufficient rights, authorizations and consents to grant that license without additional payments to third parties. A contract between agency and client should cover this handover to AI vendors.

The terms also warn that AI outputs may not be unique. Another user may receive something similar or identical. The platform does not guarantee originality, exclusivity or absence of third party rights. Legal approval and trademark research continue to be required in high-risk commercial work.

Training authorization remained

Section 4.4 allows you to use content, inputs and outputs to train, develop, improve and evolve models, algorithms, technology, products and services of Higgsfield and its affiliates. The privacy policy repeats that multimedia data, prompts, inputs and outputs can be used for training, improvement, moderation and security.

The text does not describe this use as optional for normal accounts. Higgsfield's official explanation is straightforward: the content helps improve the models, and deleting the account stops that use going forward.

Deleting does not undo completed training. The contract says that content already used to develop or improve a model cannot be feasibly decoupled from already trained models. The commitment is to stop future use of the deleted content.

Customers under an Enterprise agreement receive another promise: content is not used to train or improve models and is treated as confidential. Don't assume that a more expensive team plan or subscription automatically equates to an Enterprise deal. Confirm the applicable document.

Canceling is not deleting

Canceling a subscription ends future renewals. It does not delete the account, inputs or outputs. This distinction appears in the terms, privacy policy and official summary.

When the account is deleted, the content is inaccessible and unrecoverable for 30 days. It must then be removed from active systems and is no longer recoverable. Exceptions remain for legal obligations, anonymized or aggregated data, backups, and influence already built into models.

Deleting an individual item may also leave temporary copies on servers or backups. Content previously shared in public areas may have been copied by other users, search engines or third parties. Source deletion does not automatically collect these copies.

The operational rule is simple: export before canceling and delete only after confirming the file. Save files, prompts, reference images, metadata, invoices, accepted terms and proof of consents. A creative platform shouldn't be the only production file.

Faces, voices and biometric information

The video describes the original license as an over-the-face license that could never be taken away. The wording was broader than that: photographs, video and voice were part of the content covered by a perpetual and irrevocable license. Higgsfield did not claim ownership of the face, but received very extensive contractual rights to the uploaded file.

The revised version limits the general license and says that biometric information derived from the content is used only to provide the requested functionality. The policy defines biometrics as measurements, for example facial geometry or voiceprint, and states that derived biometric data is not saved and is deleted immediately after processing.

This does not make any photo anonymous or eliminate the remaining rules. The uploaded file, metadata, prompt and output remain content. The policy also says that the user must not submit sensitive personal information and that they must obtain consents, authorizations and disclosures required by law for faces and voices.

In production, treat consent as an artifact. Register person, project, purposes, suppliers, territory, deadline, training possibility, right of withdrawal and contact. A generic authorization to film is not automatically authorization to create an avatar or voice clone.

Private, public and promotional use

The review creates a clear protection: a company must not use private content or private work created for a client in marketing without consent.

The limit depends on the state of the content. If you post it to the community, enter a contest or showcase, or accept additional terms for a campaign, the platform may show and share it in accordance with those rules.

The policy also warns that default settings may make information visible to other users. Public content may be viewed, copied, saved, scraped or indexed by third parties. Check visibility before uploading an embargo, unreleased trade dress, or confidential product.

For portfolio and marketing, consent is a relationship opportunity, not just a legal box. Asking for permission, identifying the creator and agreeing on compensation or credits is a better practice than relying on the maximum allowed by the contract.

What data is collected and where it can go

The policy covers contacts, profile, transactions, uploaded media, prompts, messages, feedback, device data, online activity, location and metadata. Payment is processed by vendors, including Stripe, rather than being held entirely by Higgsfield.

For European users, the policy identifies Higgsfield as the controller and presents bases such as performance of the contract, legitimate interest, legal obligation and consent. Data used for research and development may include media, prompts, feedback, device data, and location.

The document says that personal information is necessarily accessed and processed in the United States. It also mentions a location in Kazakhstan and suppliers or partners in the European Union, the United Kingdom, the United States and China. For transfers without an adequacy decision, refer to standard contractual clauses or, in limited cases, derogations such as explicit consent.

These countries are not, in themselves, proof of misuse. They are a signal to map subprocessors, legal bases, and transfers before sending customer data. Persons in the European Economic Area have rights to access, correction, erasure, portability, restriction, opposition and withdrawal of consent in the circumstances provided.

What Unlimited means in section 10.6

Plans promoted as Unlimited are subject to fair use. The platform may restrict, suspend, slow down or slow down automated usage or use materially above the individual standard.

Unlimited models use a dedicated queue, separate from the priority queue of generations paid with credits. In periods of high demand, speed and competition may vary. Neither the processing time nor the number of parallel generations are guaranteed.

The existence of fair use is common in services with high computational costs. The communication risk arises when the word Unlimited dominates the promise and material limits are hidden. Before purchasing, look for the plan definition, eligible models, queue, speed, competition, allowed automation, and appeal mechanism.

The screenshots and complaints seen by Tim on Discord illustrate individual experiences. They do not alone prove the frequency of cancellation or throttling failures. The Forbes investigation, however, reports separate complaints about slowdowns and payments and includes responses from the company, which provides independent context for the concern.

Credits, refunds and renewals

Credits included in a subscription do not carry over to the next period. Additional packs purchased once are valid for 90 days. The current text removes the word forfeited in that sentence, but continues to say that credits expire at the end of the window.

A refund request may be made within seven days of the initial purchase if no credit has been used, subject to a service charge of up to 6 percent where legally permitted. As a rule, this policy does not cover renewals. Additional credit-based purchases follow a similar seven-day non-use condition.

Consumers in the European Economic Area and the United Kingdom have a 14-day legal right to withdraw. According to the terms, this right may end when the execution of digital content begins after consent, for example when using credits or generating outputs.

The price of a subscription may only change for the next renewal period with at least 30 days notice via email. This pricing term is different from the general notice, now unquantified, for other material changes to the terms.

The setbacks that should not disappear from the conversation

The Privacy Policy is incorporated by reference into the Agreement. In practice, the reader has to analyze the two documents together. A lawyer might consider this incorporation normal, as Tim reports, but it increases the contractual surface that deserves archiving and comparison.

The minimum notice of 15 days for material changes has become reasonable notice. Reasonable is a legal standard, but it doesn't give the user a certain timetable. A team must therefore save the date of each version and monitor emails and notices from the service.

Current license ends upon deletion, but contains exceptions. Temporary backups, public content, material already used by others, and legal retention prevent an absolute promise of immediate disappearance.

The terms also continue to allow changes to prices, credits, models and features within the mechanisms described. A specific model may be replaced without it automatically counting as a service failure, as long as the overall functionality remains substantially similar.

Discord, sponsorships and allegations: how to read the receipts

Tim declares that he has never made a video sponsored by Higgsfield and that he has already turned down opportunities. This disclosure is relevant to interpreting the video, but does not transform all conclusions into an independent audit.

The cancellation captures and credits presented in the video are evidence of specific cases at the time of recording. One of the credits mentioned will have been restored, according to the narrator himself. Without access to aggregated data, it is not possible to calculate the true failure rate or conclude that all users have the same experience.

The website higgsfieldsucks.com is presented by Tim as a bare-knuckle catalog of allegations. It should be read as a file of complaints, not as automatic confirmation of each statement. The Forbes report is a separate editorial source that interviewed users and executives, documented controversial marketing, throttling and payment difficulties, and published responses from Higgsfield.

The editorial rule is to keep attribution close to the statement. Say the terms state when there is clause. Tell Tim shows when it comes from the video. Tell Forbes reports when there is reporting. Say unverified when the available evidence does not allow going any further.

Does Higgsfield build models or aggregate models?

Tim criticizes Alex Mashrabov's language about building models, arguing that much of the product aggregates third-party models. Official policy confirms a mix of proprietary and third-party models. Both descriptions can be true at the same time.

A platform can develop its own models, control systems, ranking, prompt and product improvement, while also distributing external models. The extent and value of each tier cannot be concluded from a LinkedIn post alone.

Tim's challenge to open the weights of the Soul model is a strategic position, not a legal consequence of the terms. The Krea 2 page shows a real contrast: Krea has published open weights under its own licenses. Open weights increases inspection and portability, but does not replace a review of licensing, training data, security, or commercial rights.

Checklist for an individual breeder

Before uploading: classify the material as public, internal, customer, embargoed, personal or sensitive. If it includes a person, confirm consent for AI, editing, derivative generation, and external vendors.

Before generating: save a PDF copy or screenshot version of the terms, policy, plan and price. Record the date, region and account. Confirm whether the generation will be public by default and whether the model is your own or a third party.

During the project: immediately export important inputs, outputs, prompts and receipts. Don't leave the only approved version in the platform's gallery. Avoid unnecessary personal data in prompts.

Before publishing: Review AI tags, likeness, music, reference material, and disclosure requirements. The fact that the platform allows commercial use does not guarantee that all elements of the output are free from third-party rights.

When leaving: cancel the renewal, confirm by email or capture, use or count expiring credits, export the file and decide separately whether to delete content or account. Record the date the 30-day recovery window ends.

Additional checklist for agencies and teams

Create a list of approved suppliers by risk level. Public prototypes can use regular accounts. Sensitive campaigns, personal data, and unreleased products require no-training, confidentiality, and retention clauses consistent with the customer contract.

Don't confuse a multi-seat account, a Workspace, or an expensive plan with Enterprise. Request the applicable agreement, data processing attachment, list of subprocessors, processing location, deletion commitment, and incident process.

Add to the customer agreement authorization for AI vendors, use of image and voice, creation of derivatives, portfolio limits, territory, and responsibility for materials provided. Keep the option to remove a supplier without blocking the project.

Take inventory by generation: client, campaign, people, source of resources, model, platform, visibility, date, applicable terms, prompt, output, approval and final destination. This record reduces discussions months later.

If you can't get a clear contractual answer, don't send the highest risk asset to prove that the tool works. Use synthetic or authorized material to test the workflow first.

How to use Claude or ChatGPT without pretending to be lawyers

Tim ends by suggesting that the community put terms into Claude or ChatGPT and compare platforms. The idea is useful if the model receives the full texts, dated versions and a structured task.

Ask for a matrix of citation clauses, not just a summary. Separate ownership, license, training, marketing, biometrics, retention, subprocessors, billing, cancellation, compensation, arbitration and future changes.

Force the model to write not found when the answer is not in the document. Ask to distinguish contractual text, interpretation and question for legal advice. Then open each clause mentioned and confirm manually.

Do not upload confidential contracts, customer data or personal information to an AI tool without authorization. Remove identifiers or use a solution with appropriate guarantees. The auditor's audit is also part of the process.

Verdict: A community victory, not a free pass

Public pressure produced a better review. The license was no longer perpetual and irrevocable, the promotional use of private content gained limits and the elimination began to have clearer future effects. It's reasonable to call this a victory.

It is also reasonable to remain uncomfortable with default training, notice of changes without a fixed deadline, fair use in Unlimited plans and an operation that requires trust in content, people and customers.

The decision doesn't need to be a war between fans and critics. A creator can use Higgsfield for low-risk material, opt for Enterprise for protected work, choose APIs or templates with other rules, or opt out entirely. The important thing is that the decision is conscious and documented.

The best lesson from the video is not that a chatbot replaces a lawyer. It's just that no one should accept creative infrastructure as a black box. Read, compare, archive, ask and choose. As Tim says in closing: make good choices.

Prompts for auditing terms of an AI platform

Use these prompts with complete, dated documents. Remove confidential data and always confirm clauses at the source. The result is for screening, not legal advice.

Prompt pack credit: Tim · Theoretically Media.

Compare two versions clause by clause

Creates a verifiable matrix of changes without relying on the company summary.

Compare these two documents, keeping the versions separate.

DOCUMENT A
Name: {{previous terms}}
Date: {{date}}
Text: {{paste full text}}

DOCUMENT B
Name: {{current terms}}
Date: {{date}}
Text: {{paste full text}}

Create a table with:
1. theme and clause number in each version;
2. previous formulation, in short paraphrase;
3. current formulation, in short paraphrase;
4. concrete change;
5. possible impact for individual user, client and agency;
6. exact evidence, with a citation of no more than 20 words;
7. level of trust;
8. question requiring legal advice.

Mandatory analysis of ownership, license, sublicensing, duration, training, marketing, biometrics, deletion, credits, refunds, cancellation, compensation, arbitration and future changes.

Don't conclude that something has changed just because a word disappears. Checks exceptions, definitions, and clauses incorporated by reference. Writes "not found" when the document does not respond.
Data and privacy map

Transforms the privacy policy into an operational data map.

Review this privacy policy for an AI-powered creation workflow.

Text: {{paste full policy}}
User jurisdiction: {{Portugal / EEA / other}}
Project type: {{personal/client/campaign confidential}}
Predicted data: {{prompts, faces, voice, video, documents, metadata}}

For each data category, identify:
- origin and purpose;
- declared legal basis;
- mentioned recipients and subprocessors;
- countries or regions of treatment;
- retention period or criteria;
- use in training, analytics or marketing;
- controls and user rights;
- gaps that require supplier response.

Clearly separates official text, inference and recommendation. Don't assume that a photo is the same as a biometric template. Cite the section of each answer.
Risk Gate for Client Work

Decide whether a resource can go into a normal account, Enterprise or not be sent.

Create a risk gate for this project before using an AI platform.

Project: {{description}}
Client: {{sector}}
Confidentiality: {{public / internal / embargo / trade secret}}
People represented: {{none / team / talent / minors / public}}
Personal data: {{list}}
Platform contract: {{paste relevant clauses}}
Customer contract: {{paste only authorized and anonymized clauses}}

Classify each resource as:
A. allowed on a regular account;
B. permitted only with private setting and additional consent;
C. requires Enterprise agreement or DPA;
D. do not send.

Explains why using training, retention, transfers, subprocessors, likeness, voice, third-party rights, and archiving obligations. It ends with a list of required approvals and questions for the client or lawyer.
Cancellation and deletion plan

Avoid confusing end of billing with removal of content.

Build an exit plan from this platform based on the terms below.

Terms and policy: {{paste cancellation, credits, retention and deletion sections}}
Renewal date: {{date}}
Current credits: {{quantity and type}}
Stored projects: {{list}}

Provide a timeline with:
1. last safe date to cancel;
2. files, prompts, invoices and metadata to be exported;
3. credits that expire and what should not be generated just to spend them;
4. difference between cancelling, deleting content and deleting an account;
5. recovery window;
6. estimated date of elimination of active systems;
7. exceptions, backups and content already incorporated into models;
8. proof to save at each stage.

Do not take any action. Mark everything that needs direct confirmation on the panel or with support.
Face and voice consent

Create a list of points to discuss with talent and legal counsel.

Prepare a consent brief for using face and voice in an AI workflow.

Project: {{description}}
Person: {{talent type}}
Uses: {{editing, avatar, voice clone, advertising, variants}}
Platforms: {{list}}
Territory and duration: {{details}}

Create a checklist, not a contract, that covers:
- original media and derived data;
- generation of images, video and voice;
- training by suppliers;
- subprocessors and international transfers;
- public content, portfolio and marketing;
- compensation;
- review and approval;
- withdrawal, elimination and technical limits;
- use by client, agency and suppliers.

Identify vague terms and questions for a lawyer. Do not declare that consent may be irrevocable without checking the applicable law.
Claims audit and sponsorship

Separates contract, individual experience, reporting and opinion.

Audit the claims in this video or article about an AI platform.

Transcript: {{paste transcript}}
Official terms: {{paste or provide text}}
Official policy: {{paste or provide text}}
Independent reporting: {{paste authorized excerpts or notes}}
Sponsorship disclosure: {{text}}

For each material statement, classify as:
- officer;
- confirmed by documentary comparison;
- report from the creator;
- reporting;
- third party allegation;
- opinion;
- not verified.

Indicates the evidence, date and safest public language. It signals conflicts of interest, unsourced numbers, contextless captures and generalizations from individual cases. Do not transform absence of proof into proof of absence.

Video Timestamps

FAQ

Does Higgsfield own my inputs and outputs?

The current terms say that Higgsfield does not claim ownership of the content, inputs or outputs. The user, however, grants usage licenses to operate the service and for the training and improvement purposes described in the contract.

What was problematic about the July 23rd version?

The content license was transferable, perpetual, irrevocable and sublicensable at multiple levels. It also covered inputs and outputs and allowed for training, improvement and promotional use.

Did the July 23rd version come into force?

The official file says that this version has been replaced and that the change planned for existing users has not come into effect. The July 26, 2026 version applies immediately to new accounts and on August 27, 2026 to previous accounts, unless early acceptance.

Did the July 26 review resolve the perpetual license?

Yes, the current text removes transferable, perpetual and irrevocable, limits sublicensing to necessary providers, and makes the license terminate upon deletion, with exceptions described in the contract.

Can Higgsfield train with my content?

The current general terms say that content, inputs and outputs may be used to train and improve models, algorithms, products and services of Higgsfield and affiliates.

Is there a training opt-out for a regular account?

The text consulted does not present a separate opt-out for normal accounts. It says that the user can stop future use by deleting the content or account. Training already completed is not reversed.

Are Enterprise accounts used for training?

Current terms state that content covered by an Enterprise agreement is not used to train or improve models and is treated as confidential. It is necessary to confirm that the account is actually covered by this agreement.

Does unsubscribing delete my account?

No. Canceling ends future charges. Deleting your content or account is a separate process.

How long does it take to delete the account?

The content is inaccessible and retrievable for 30 days. It must then be eliminated from active systems, with exceptions for legal obligations, anonymized data, backups and influence already incorporated into models.

Can Higgsfield use my work in advertising?

Private or proprietary customer content should not be used in marketing without consent. Content made public, entered into contests, or submitted to showcases may be subject to promotional use and supplemental terms.

Can I upload someone else's face or voice?

Only if you have all required consents, authorizations and disclosures. The policy limits derived biometric data to the requested functionality, but the file and output remain subject to the general rules.

Does Unlimited allow you to generate without any limit?

No. Section 10.6 applies fair use, separate queue, dynamic speed and concurrency, and allows for throttling or suspension of automated or materially excessive use.

Do the credits carry over to the next month?

Subscription credits do not carry over. Additional packs expire 90 days after purchase, unless a different condition is presented at the time of purchase.

Can I request a refund?

Terms allow you to request a refund of the initial purchase within seven days if no credit has been used, subject to a fee of up to 6 percent where permitted. Renewals are generally non-refundable. EEA and UK consumers have additional legal rights.

Can data be processed outside of Europe?

Yes. The policy states that they are necessarily accessed and processed in the United States and there may be recipients in Kazakhstan, the European Union, the United Kingdom, the United States and China, with transfer mechanisms outlined for European users.

Can I use Claude or ChatGPT to review terms?

You can use an LLM for screening and comparison, as long as you provide complete versions and manually confirm each clause. Do not send confidential material without authorization and do not treat the result as legal advice.

Does the video prove that everyone has problems canceling?

No. It shows concrete examples and reports, which deserve investigation, but do not allow us to calculate prevalence. The Forbes report provides additional independent context and includes responses from the company.

What is the safest decision for an agency?

Rate resources by risk, use non-confidential material in testing, obtain consents, confirm applicable agreement, and require appropriate non-training, retention, and subprocessor safeguards before submitting protected work.

--sources and credits