The change

Cognition AI, the company that makes the AI software engineer Devin, published a new Privacy Policy. The date moved from “Last updated: March 9, 2026” to “Last updated: October 26, 2026.” The policy now opens with a note: “We updated this Privacy Policy to add detail about the opt-out choices on our Privacy Choices page, including Global Privacy Control, and to describe our sharing with advertising partners.”

What the note does not say is that the sentence promising that Cognition does not sell or share personal data for targeted ads was deleted.

What changed

• The no-ads promise was removed. The deleted sentence read: “We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months.”

• Data now goes to ad partners. Cognition says it discloses, “and in the past 12 months have disclosed, identifiers, commercial information, and internet or other electronic network activity information to advertising partners to promote our Services.”

• Tracking across websites. Cognition says “our advertising partners may collect information about your online activities over time and across different websites when you use our websites.”

• More data collected automatically. This includes “your IP address, browser and device information, and how you interact with our websites and Services, including sign-ups and purchases.”

• Marketing is now a stated purpose. Cognition now uses personal information “to market our Services.”

• New opt-out tools. You may opt out on the Privacy Choices page, through the “Your Privacy Choices” link, or with Global Privacy Control.

From “We do not sell” to “We disclose”

The change sits in the first lines of section 3, “How and why we share your information.” The March version began with a clear no. The October version begins with a yes, and adds a legal label for it: the sharing “may be considered a “sale,” “sharing,” or “targeted advertising” under certain US state privacy laws.”

Both versions also look back 12 months. The March version said Cognition had not shared data for targeted ads in that period. The October version says Cognition has disclosed data to advertising partners in the past 12 months.

Which ad networks are involved

The policy itself does not name the advertising partners. Cognition’s Privacy Choices page does. It says that when you opt out, these stop loading on cognition.com and their cookies are deleted: “Google Tag Manager and the advertising tags it loads (Google Ads, Meta, LinkedIn, X, Reddit, Bing, and similar).” Google Analytics, HubSpot visitor-tracking cookies, and “Other third-party advertising tags” are on the same list.

How to opt out

Cognition offers three ways. You can use the Privacy Choices page, the “Your Privacy Choices” link on its websites, or a browser setting. The policy says: “You can also opt out by turning on Global Privacy Control (GPC) in your browser, and we will treat the signal as a request to opt out.”

The Privacy Choices page adds one detail. “Where required by applicable law, this opt-out cannot be reversed for 12 months from the date the signal was first detected, even if you later disable GPC in your browser.”

What did not change

• Cognition still says it does “not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old.”

• Users must still be at least 18 to use the Services.

• The policy still allows “using User Content to train, fine tune and improve the models that power our Services,” depending on the terms that apply to you.

Who this affects

The new sharing is about Cognition’s websites and marketing. Company accounts are treated separately: “If you use the Services through an organization that has an enterprise agreement with us, such as your employer, the personal information that the organization submits to the Services is governed by our agreement with that organization.”

So the people most affected are individual developers and anyone who visits cognition.com, cognition.ai, or devin.ai. Devin EU users are covered by a separate EU notice, with Cognition AI Labs Ireland Limited as the controller.

Why this matters

AI companies are adding ad tracking as they grow their marketing. We saw the same pattern when an OpenAI ad pixel appeared in CircleCI’s cookie policy, and when Uber said its ad partners may combine your data with other sources.

For a company, a vendor’s promise not to sell your data often ends up in a security review or a privacy notice. When that line disappears, the review is out of date. That is why it pays to monitor vendor terms of service and privacy policies, not only the contract.

Potential impact

If you or your team use Devin, the update raises four practical questions:

• Did your vendor review rely on Cognition’s old “do not sell or share” statement?

• Do your developers sign up for Devin with personal accounts rather than through an enterprise agreement?

• Is Global Privacy Control turned on in the browsers your team uses?

• Does your own privacy notice describe the ad tools that your vendors load on your behalf?

How Venpo detected it

Venpo monitors Cognition’s privacy policy and flagged the October 26 update on October 27, 2026, with every inserted and deleted line marked. The record is on the Cognition page on Venpo. Every quote in this article was checked against the redline and against the live pages at the time of publication.

Business outcome

Teams that see this change can update their vendor records, tell developers how to opt out, and decide whether personal Devin accounts are allowed for work. That is what continuous monitoring of vendor legal changes is for.

Key takeaway

Since October 26, 2026, Cognition’s privacy policy no longer says it does not sell or share personal data for targeted ads. It now says Cognition discloses data to advertising partners, its opt-out page lists Google Ads, Meta, LinkedIn, and other ad tags, and you can opt out with Global Privacy Control or the Privacy Choices page.