Bluesky's recent ToS changes show how not to do ToS changes
Today, when logging into Bluesky, I got a notice that Bluesky were changing their ToS, Privacy Policy, Copyright Policy (“effective September 15th, 2025”) and their Community Guidelines (“take effect on October 15th, 2025”). You can read Bluesky's official statement about this update on their blog entry Updated Terms and Policies published on August 14, 2025.
Unfortunately, the way these changes were handled are a huge problem.
Where the problems start: Shrinkwrap licenses
In order to continue using the site, I had to click “continue” which would “acknowledge that you understand and agree to these updates.”
This is set up in such a way that almost guarantees that people won't read the updates. The ethical alternative for this dark pattern would be:
- Advise people of the upcoming change
- Offer them the option to accept the new terms early
- Offer them the option to deny the new terms now and continue using the site under the existing terms until September 15th (with them being prompted to accept the new terms later)
That was the first unethical thing I ran into. I wish it was the last.
Massive textual rewrites
When making changes to a ToS or other policy, it's not enough to provide a summary that says “you should look at this part because we made changes.” It behooves the company to keep things organized in at least roughly the same way as the document was organized previously. This allows a user / customer / etc. to make a cogent, side-by-side comparison between the old policy and the new policy. There are other ways to handle this in order to have the same effect but keeping the same organization is the least technically challenging solution to implement.
Almost every single thing about the ToS, Privacy and Copyright policies, and Community Guidelines have been changed so radically textually that it is essentially impossible for a regular person to compare the terms, policies, or guidelines to see what has actually changed. You can only read the new one and decide, almost entirely without context, whether you can put up with the new terms, policies, and guidelines.
To demonstrate just how thoroughly the documents have changed, I'm sharing a snippet of a screenshot from KDiff3 comparing the top section of the Copyright Policy. KDiff3 is a technical tool that allows you to compare the changes between two sets of text. The yellow text highlights sections that are comparable but have changes between the two documents. Text highlighted blue or green is completely different between the documents (apart from the sections with black text and no highlights).
While this is a very brief snippet, this is typical of each of the changed documents. There's a bit at the top which is comparable. There are a few clips where extremely brief text is the same. All of the rest of it is radically different.
So. I don't know what has changed. Not really.
What do the new terms say
The thing I think most of you need to be aware of is the age verification information. What applies to you will depend on your jurisdiction. They have a variety of methods for verifying that you are old enough to access adult material. As adult content oriented sites have already said, any and all means currently in use or seriously proposed to prove the adultness of adult content consumers are extremely bad.
The adult content industry is currently pushing the certification of devices as being owned and operated by adults. I think this proposal is just as bad as the policies and laws they propose but that's neither here nor there.
You won't win the battle on this one by arguing with Bluesky about it. You need to get off your ass and fight your government about it. Wherever you're at, there are nanny state people out there trying to curtail your access to the internet in the name of protecting children. Those nanny state people don't have a reasonable definition of porn. They don't have an interest in protecting children. They want to remove your rights and freedom to access any material they disagree with. They must be fought.
Privacy policy
Every privacy policy I've read from any major site is completely and utterly unconscionable. Bluesky is no exception. Their privacy policy isn't as bad as, say, People Grove. If you've never read a privacy policy before, you'll find it shocking. It's all about the ways that you don't have privacy while using the Bluesky service.
As I understand it, they say they don't sell your data at present and they don't use it to target ads to you. My brain slides off most ads but I'm pretty sure I've never seen an ad on Bluesky so this seems like a reasonable statement to make.
Bluesky includes this statement in their privacy policy:
“Do Not Track”. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we currently do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers, as there is no consistent industry standard for compliance.
Translating this to plain language, they are saying “most companies aren't honoring this signal so we won't honor it either.” That is unacceptable.
Conclusion
It's not enough that the terms, policies, and guidelines your company implement are ethical and respect the rights and needs of your customers. The way you communicate and ask for agreement must also be ethical.
Bluesky dropped the ball here. I expect better.
This is where I would normally suggest you buy my books. Instead, I'll ask U.S. citizens to get involved in the ACLU's efforts to fight unjust policies at Mastercard or any one of the other fights the ACLU are taking on our behalf to fight for our rights.
If you're not a U.S. citizen, please get involved in the fight for your rights in other jurisdictions.