Block, Inc. has posted a privacy notice for dessa.com, dated October 21, 2026, describing a service called Dessa — billed elsewhere as a conversation model trained only on speech. What the public actually received, however, is not a product demo, technical paper, or capability showcase. It is a privacy policy. The notice follows a boilerplate corporate privacy framework. Block collects identification information (name, email, address, phone), device information (hardware model, OS, unique device identifiers), and internet activity data (browser type, IP address, access times, interaction patterns). None of this is unusual for a web service. The collection methods — cookies, web beacons, server logs — are standard. Data sharing flows through Block's affiliate network, which includes Square, Cash App, Afterpay, and TIDAL. The stated purpose is internal product improvement and cross-platform personalization. Service providers performing fraud prevention, identity verification, and fee collection also receive user data. Business transfers, legal compliance, and user consent round out the sharing categories. The notice explicitly states that Block collects information only directly from users and from their service usage — no third-party data brokers are mentioned. Retention is described vaguely: information is kept "as long as reasonably necessary" to provide services or comply with law, with copies retained for compliance purposes. What is conspicuously absent is any mention of how speech data — the defining feature of Dessa as a product — is handled. A conversation model trained on speech presumably ingests, processes, and potentially stores voice recordings. The privacy notice treats dessa.com as a generic website, not as an AI speech platform. There is no mention of audio data, voice recordings, biometric identifiers, or model training on user inputs. This gap matters. Speech data occupies a higher regulatory tier than text in most jurisdictions. The EU's AI Act, Illinois BIPA, and similar frameworks treat voice as biometric data requiring explicit, informed consent. Publishing a website privacy policy without addressing the core data type of the product is either premature (the speech features aren't live yet) or a significant oversight. The practical read: Block is planting a flag at dessa.com but has not yet launched the speech-interaction product to the public. The privacy notice is infrastructure, not substance. The real test comes when Dessa's actual speech capabilities go live and Block must disclose how it handles the most sensitive data type in its pipeline.
