Palo Alto Networks
Information Technology
51
out of 100. Number 204 of 512, counting from the worst.
Where Palo Alto Networks does well
- Arbitration 0 of 20. Nothing found.
- Renewals 3 of 20. Few problems found.
- No forced arbitration: the website Terms of Use routes disputes to the exclusive personal jurisdiction of state and federal courts in Santa Clara County, CA — unlike many peers, it does not force AAA arbitration or waive class actions.
- As a data controller for customer product data, the company states it does not use data its products collect for marketing purposes, does not share customer data with other customers, and does not sell customer data to third parties.
- Its government-request policy promises to give the affected customer reasonable advance notice of a demand where law allows, and to challenge demands that would breach another country's data-protection law.
- It explicitly carves out call recordings and AI analytics from sale/sharing for cross-context behavioral advertising, and disclaims extracting voiceprints, facial-recognition templates, or emotion recognition from call recordings.
- It publishes real CCPA request metrics (for 2024: 4 requests to know received, 4 responded to, 2 compiled) and holds Global CBPR + PRP certifications.
They can rewrite the terms whenever they want and don't have to tell you.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
They can rewrite the terms whenever they want and don't have to tell you. Continued use of the site counts as agreement to terms you may never have seen.
We reserve the right to change these Terms at any time, without notice, at our sole discretion.
-
Anything you post to their communities — comments, code, bug fixes, product ideas — becomes theirs forever, worldwide, without credit or payment, and they can sublicense it to anyone.
Palo Alto Networks shall have no obligations to you with regard to its use or disclosure of Contributions, and shall have a worldwide, perpetual, irrevocable and fully-paid right to use, reproduce, prepare derivative works of, perform, display, and distribute the Contributions, including any ideas, concepts, know-how or techniques contained in such Contributions, for any and all purposes without limitation, and to authorize others to do so as well, without attribution.
-
Your sales calls and demos are recorded, transcribed, and scored by AI (how much you talk, your 'methodology alignment', account health); the AI embeddings land in internal searchable databases. And their products sweep up your logs, telemetry, files and personal data by default — the irony being this is all from a company whose product is your privacy and security.
When you participate in sales calls, product demonstrations, contract negotiations, or account review meetings with Palo Alto Networks representatives, we act as a data controller regarding the audio, video, transcripts, and derived interaction metrics collected during those sessions... We infer preferences and generate interaction metrics derived from conversational transcripts using natural language processing (NLP) and AI utilities. This includes talk-to-listen ratios, conversation topic tags, sales methodology alignment scores (e.g., MEDDPICC frameworks), customer account health indicators, auto-generated meeting summaries, and semantic text embeddings stored in secure internal search repositories. "End User Data" means data that may be accessed or collected by Products during the relationship governed by this EULA, in the form of logs, session data, telemetry, user data, usage data, threat intelligence data, and copies of potentially malicious files detected by the Product. End User Data may include confidential data and personal data.
-
They lead with 'we generally don't sell your data,' then admit some disclosures can legally count as sales — and that in the last year they disclosed or sold every category of personal information they collect to third parties including marketing and strategic partners, analytics providers, and social networks. The site also records mouse movements, keystrokes, Ad IDs, and uses statistical modeling to recognize you across devices.
While we generally do not engage in the sale of personal information... there may be limited circumstances where we disclose personal information with third parties on our Sites in a way that may be considered a "sale" under the CCPA or other similar laws (e.g., for cross-context behavioral advertising purposes where no money is exchanged)... In the previous 12 months, we have disclosed or sold all of the categories of personal information we collect... to third parties for a business purpose.
-
Your account can be killed at any time for any reason — or no reason — and your data stays or goes entirely at their discretion. Call recordings are purged after 180 days, but the AI embeddings derived from them are kept indefinitely ('as long as necessary'), so the content of your calls lives on in searchable form long after the raw files are deleted.
We may, in our sole discretion (i) restrict, suspend, or terminate your access to any or all of the Site or (ii) cease to provide and maintain the Site, in whole or in part, at any time, for any or no reason, with or without prior notice, and without liability. Upon doing so, we may retain or delete any information or content that you provided, subject to applicable law... Raw Call Audio & Video Files: Retained for up to 180 days post-call, after which raw media assets are automatically purged... AI Vector Embeddings & Index Data: Retained for as long as necessary to evaluate pilot performance, conduct model quality testing, and support internal search functionalities.
-
Customers are contractually banned from publishing any benchmark or performance comparison of the products — a security vendor gagging independent evaluation and public security-performance scrutiny.
You shall not... Disclose, publish or otherwise make publicly available any benchmark, performance or comparison tests that you (or a third-party contracted by you) run on the Products, in whole or in part.
How these were found
Terms of Use read in full directly from paloaltonetworks.com on Oct 1, 2026 (page shows no version/date). Privacy Statement read in full directly from paloaltonetworks.com, Effective Date: August 27, 2026. End User Agreement clauses (benchmark ban, End User Data definition, auto-activation) came from verbatim third-party mirrors of official Palo Alto Networks PDFs (dogeunblocker proxy of the official Dec 2020 EULA PDF on paloaltonetworks.com; cgrzzl proxy of the official Feb 2025 EULA PDF), not from the current live EULA — I did not verify the current EULA text directly. Palo Alto Networks is B2B/enterprise, so consumer-facing terms are mostly the website Terms of Use; some findings apply mainly to site visitors and meeting participants.
These notes come from the original draft and are not independent verification.