ElevenLabs updated its Privacy Policy on May 21, 2026 to add two new affiliate entities (Eleven Labs Auto India Private Limited and Eleven Labs Technology Middle East Limited), revise legal bases for data processing to encompass contract performance and legitimate interests alongside consent, simplify contact procedures for exercising privacy rights by removing physical mailing details from the main contact section, and replace references to 'state, province or country' with the broader term 'location' when describing residency. The practical effect is that the policy now explicitly permits processing based on multiple legal grounds beyond consent, establishes a clearer data protection contact mechanism via email and online form, and expands the organizational entities authorized to process personal data.
The updated terms establish that ElevenLabs may process personal data under multiple legal bases, including contract performance, compliance with legal obligations, and legitimate interests in fraud prevention and legal defense, rather than relying solely on user consent. The policy now identifies a Data Protection Office at legal@elevenlabs.io as the primary contact for privacy rights requests and clarifies the mechanism for exercising those rights. For Brazil residents, the policy specifically names Paulo Eduardo Lilia as the Data Protection Officer. You can submit privacy rights requests using the online form or by emailing the Data Protection Office.
The updated terms establish that ElevenLabs may process personal data under multiple legal grounds (contract, legitimate interests, legal obligation) rather than requiring explicit consent for all processing. This aligns the policy with standard GDPR practice and clarifies the organizational framework for data handling across new geographic entities. The streamlined privacy rights contact procedure makes it operationally simpler for users to exercise those rights.
→ Review the updated Data Protection Office contact information at legal@elevenlabs.io to know where to direct privacy rights requests.
→ If you are a Brazil resident, note that Paulo Eduardo Lilia is named as the Data Protection Officer for your jurisdiction.
→ Data processing will continue under the legal bases stated in the updated policy, including contract performance and legitimate interests, without requiring advance notice to individual users.
Expanded from consent-only to include contract performance, legitimate interests, and legal obligation compliance.
Simplified to direct email to Data Protection Office; removed physical mailing address from primary contact; added Brazil-specific DPO naming.
Added Eleven Labs Auto India Private Limited and Eleven Labs Technology Middle East Limited to the list of authorized processing entities.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
ElevenLabs can now process your data for reasons beyond what you explicitly agreed to, including when necessary to deliver a service or comply with law.
ElevenLabs' updated privacy policy on May 21, 2026 expands the legal bases it may invoke for data processing beyond consent to include contract performance, legitimate interests, and legal obligations. This aligns with GDPR Article 6 lawful basis frameworks and reflects standard international privacy practice. The policy clarifies the Data Protection Officer contact mechanism and adds specific Brazil-jurisdiction guidance naming a DPO. Organizations using ElevenLabs services should confirm their data processing addenda reflect these expanded legal bases and updated contact mechanisms, particularly where cross-border data transfers or contract-driven processing occur.
GDPR (lawful basis determination under Article 6); LGPD (Brazil-specific DPO naming satisfies Article 41 requirements); CCPA (notice and rights exercise mechanisms); jurisdictional privacy laws governing legitimate interest balancing.
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Monitor: regulatory citations + obligations. Compliance: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002230.
Removal of dedicated CCPA provision eliminates explicit high-severity notice of California residents' specific consumer privacy rights, though some protections appear consolidated in location-dependent provision.
Removal of policy update notification provision eliminates contractual commitment to notify users of material privacy changes, potentially reducing transparency about policy modifications.
Language simplified and narrowed to focus on submitted recordings only; added explicit reference to 'account settings and applicable consent choices' providing user control over AI training use.
Added explicit confidentiality requirement for third parties ('agree to keep this information confidential') and consolidated separate vendor/analytics language into unified provision.
Expanded scope to include 'financing due diligence, reorganization, bankruptcy, receivership' and 'transition of service to another provider'; added qualifier 'as permitted by law and/or contract'.
Consolidated separate GDPR and CCPA provisions into single location-dependent provision; added CCPA 'opt out of sale or sharing' right; provided complete contact information.
Changed from conditional warning ('If you are accessing') to affirmative consent mechanism ('you consent to'); elevated severity from medium to high by explicitly stating users accept reduced legal protections.
Removed 'referral URLs' from tracking list; expanded scope to explicitly include 'interactions with our Services and third-party sites'; removed stated purposes (analytics, advertising, improvement).
Removed detailed retention decision factors ('amount, nature, sensitivity, risk of harm, purposes, alternative means'); simplified to basic necessity standard.
Removed user reporting mechanism ('If you believe we may have collected information from a child under 13, please contact us').
Cross-platform context
See how other platforms handle similar provisions across the ConductAtlas archive.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — MonitorElevenLabs removed the phrase 'Contact Sales' from the initial paragraph of its Privacy Policy on June 26, 2026. This was …
The detected change involves removal of the phrase 'Contact Sales' from the navigation or header section of ElevenLabs' Usage Policy …
ElevenLabs removed a call-to-action button labeled 'Contact Sales' from its privacy policy document on June 26, 2026. The substantive text …
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 352+ platforms every Sunday.