← All case files
verified deployment saas · NL · ops

WeTransfer removed the machine-learning clause from its Terms of Service after user backlash (July 2025)

After users read a newly added clause 6.3 as permission to train AI on their uploaded files, WeTransfer rolled the change back on 15 July 2025 — removing the machine-learning language and stating it does not use AI to process content shared via the service. Documented first-party by WeTransfer's own blog post and independently by The Register and Malwarebytes Labs, all three captures byte-tied to Wayback.

The problem

WeTransfer, the consumer file-sharing service, quietly updated its Terms of Service in early July 2025. Sometime after 2 July it rewrote clause 6.3 — Malwarebytes Labs reported that “Sometime after July 2, it updated clause 6.3 of the document” (source) [Source 3]. The added language granted WeTransfer a “perpetual, worldwide, non-exclusive, royalty-free, transferable, sub-licensable license to use” (source) user Content [Source 3]. In mid-July, creatives and other users read the clause as permission to train AI on the files they upload, and the criticism spread across social media.

What was built

This is a Terms-of-Service reversal, not a deployment. In its own blog post WeTransfer quoted the disputed licence, which extended to “improve performance of machine learning models that enhance our content moderation process” (source) — the same clause language The Register also reported [Source 1, Source 2]. The revised terms were set to take effect on 8 August 2025 (a date carried by the press, not the primary — see the verification box) [Source 2].

The outcome

  • The clause was rolled back. After the backlash WeTransfer reversed the change. In its first-party blog post the company said it had “removed the mention of machine learning” (source) [Source 1]. The Register reported the company “rolled back changes it had introduced to its Terms of Service after they deeply upset users” (source) [Source 2], and Malwarebytes reported that WeTransfer had “rolled back language that allowed it to train machine learning models on any files that its users uploaded” (source) [Source 3].
  • WeTransfer’s framing. In the same blog post WeTransfer stated firsthand that it does not use “machine learning or any form of AI to process content shared via WeTransfer” (source) and added: “We apologize for any confusion this may have caused” (source) [Source 1]. The Register separately quoted the company saying it does not use “any form of AI to process content shared via WeTransfer” (source) [Source 2]; per Malwarebytes the company said the clause “may have caused confusion for our customers” (source) and that it does not “sell content to third parties” (source) [Source 3].

The weakest load-bearing source, named where you meet it: WeTransfer’s own blog post (Source 1) is a Tier-1 first-party primary, but it is the subject narrating its own reversal — an admission-against-interest (it removed the clause and apologised), not an independent audit. It does not stand alone: the rollback itself is independently reported by The Register (Source 2, Tier 2) and Malwarebytes Labs (Source 3, Tier 2), the two independent secondaries around the first-party origin. WeTransfer’s counter-claim — that the machine-learning reference was only ever intended for possible future AI-powered content moderation, not a built or used feature — is recorded here as the company’s position, not asserted as fact.

Why this matters for TIN: an AI-training permission read into a licence clause, then withdrawn under pressure, is exactly the kind of dated, publicly refutable reversal the verified-story model is built to pin down — the record supports the walk-back; nothing here depends on WeTransfer confirming it privately.

How this was verified

  • Method. Every quoted line was read verbatim from the captures in sources/; no figure is paraphrased or recalled. The WeTransfer blog is client-rendered (Prismic), so its article body lives in an embedded JSON payload — the four first-party fragments were bound against both the decompressed capture and a .nextdata.txt extract of that payload (each grep -F count ≥ 1).
  • Primary artifact. WeTransfer’s walk-back blog post (capture 20250718202036, Tier-1 first-party), fetched via the Wayback id_ raw payload, is byte-tied: sha1-base32 of the raw gzip bytes PKMC2GUZKIAZHBVP42ZBPOSMACOXQKAB == the live CDX digest at that snapshot. first_publication_date reads 2025-07-15T15:34:04+0000 inside the capture.
  • Independence. Two mutually independent newsrooms carry the rollback and WeTransfer’s statement firsthand — The Register (capture 20250718141105, digest GYKMWMV3VVFYJHSQ7VXFDTY64HNW2ESJ) and Malwarebytes Labs (Danny Bradbury, capture 20250717143258, digest 34YOTJJRSYTYP3GD2CPRFKDAXU4D6XOC), each byte-tied to its snapshot. Aggregator reprints (AOL/Yahoo, Business Standard, PPC.land, and others) recycle the same text and are not counted as independent origins.
  • Conflation guards. This is distinct from WeTransfer’s separate 2024 acquisition by Bending Spoons and the associated layoffs, and from the other 2023–2025 ToS/AI-training reversals (Zoom, Dropbox, Adobe, Slack, LinkedIn) — none of which are cited here.
  • Open item (human, post-graduation). The 8 August 2025 effective date and a canonical, archivable first-party copy of WeTransfer’s statement are the human confirmation steps in dossier.json → path_to_green; the badge is amber pending and green never depends on WeTransfer confirming anything.
  • Verified on: 2026-08-08 (presentation rebuilt 2026-08-19).

Sources

  1. [Tier 1] WeTransfer · “Terms of Service changes: July 2025” (first-party blog post; first_publication_date 2025-07-15) · 15 July 2025 · https://wetransfer.com/blog/story/wetransfer-terms-of-service-changes-july-2025 (archived: https://web.archive.org/web/20250718202036id_/https://wetransfer.com/blog/story/wetransfer-terms-of-service-changes-july-2025)
  2. [Tier 2] The Register · “WeTransfer backtracks on TOS changes that opened the door to LLM training” · 18 July 2025 · https://www.theregister.com/2025/07/18/llm_products_terms_of_service/ (archived: https://web.archive.org/web/20250718141105/https://www.theregister.com/2025/07/18/llm_products_terms_of_service/)
  3. [Tier 2] Malwarebytes Labs (Danny Bradbury) · “WeTransfer walks back clause that said it would train AI on your files” · 17 July 2025 · https://www.malwarebytes.com/blog/news/2025/07/wetransfer-walks-back-clause-that-said-it-would-train-ai-on-your-files (archived: https://web.archive.org/web/20250717143258/https://www.malwarebytes.com/blog/news/2025/07/wetransfer-walks-back-clause-that-said-it-would-train-ai-on-your-files)

Consumer file-sharing service — Terms of Service / content licence (clause 6.3)

Verification record
Status
verified
Method
WeTransfer's own walk-back blog post (Tier-1 first-party, byte-tied to its Wayback capture) plus two mutually independent newsrooms — The Register and Malwarebytes Labs — that carry the rollback and the company's statement firsthand and are each byte-tied to their Wayback snapshots (sha1-b32 == CDX digest). Every quoted fragment grep-F byte-verified against the decompressed captures.
Verified on
2026-08-24
Provider
WeTransfer (Bending Spoons)
Client
WeTransfer · File-sharing / consumer SaaS
Disclosure
named