OpenAI updated its API Data Usage Policies on May 28, 2026 to clarify workspace admin authority and data retention rules. Previously, the terms stated that end users controlled whether their conversations were retained and could view their own conversations. The updated language now establishes that workspace admins control data retention duration and can view, access, export, and delete end user conversations within their workspace. Additionally, the policy now permits OpenAI to retain deleted or unsaved conversations beyond 30 days if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm.
Organizations using ChatGPT Business: The expanded admin authority creates a need for organizations to define clear internal policies about who can access user conversations and when.
End users in workspace environments: Employees or users no longer have control over how long their conversations are kept; that decision now belongs to their organization's admins.
Organizations with existing DPAs or privacy representations: Organizations may need to update their privacy statements or contracts to reflect that OpenAI can keep conversation data longer than 30 days if it claims this is necessary for service protection.
The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
→ If you are an end user in a workspace environment, review your organization's data governance policies or ask your workspace admin about how they will exercise access and retention authority over conversations.
→ If you are a compliance officer or workspace admin, document your organization's policies governing admin access to conversations and retention duration.
Across all monitored documents, OpenAI has made 4 significant changes.
3 of OpenAI's significant changes have been classified as negative for consumers.
Admins now explicitly permitted to view, access, export, and delete end user conversations within their workspace.
Retention duration is now controlled by workspace admins rather than individual end users.
OpenAI now reserves the right to retain deleted conversations beyond 30 days if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
OpenAI clarified and expanded workspace admin authority over end user conversation data on May 28, 2026. The change shifts data retention control from individual users to workspace admins and explicitly authorizes admins to view, access, …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002395.
OpenAI's GPT-5.5 System Card was updated in an update detected on September 9, 2026. The change modified the metadata and …
OpenAI's GPT-5 System Card was revised in an update detected on September 9, 2026. The change removed the header 'GPT-5 …
OpenAI's Frontier Governance Framework webpage was updated on September 9, 2026. The framework document title header was removed, a loading …
H.R. 8094 would make the FTC the referee for AI model disclosure. It also names system cards as a way to comply, which turns a voluntary in…
The bill does not regulate most AI startups directly. But it changes the companies they depend on. Here is what the first federal AI law wo…
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.