OpenRouter expanded its privacy policy to document a new Files API feature that allows users to upload and persistently store files (images, PDFs, documents) for use in inference requests. The policy now specifies how these uploaded files are handled: they are encrypted, retained until deletion or account closure, transmitted to selected model providers, and not used for training OpenRouter's own models. Additionally, OpenRouter raised the minimum age requirement from 13 to 18 years old.
Consumers: The policy now explains how files you upload are stored, protected, and used.
Consumers: Users under 18 are no longer eligible to use the service.
The updated policy establishes a new Files API feature allowing you to upload and store files for use with inference requests. Files are encrypted at rest and in transit, retained until you delete them or close your account, and transmitted to the model provider you select for processing. OpenRouter states it does not use uploaded file content to train its own models, for unrelated analytics, or for marketing. The policy also raises the minimum age requirement from 13 to 18 years old, meaning users under 18 are no longer eligible to use the service.
→ Review the Files API documentation if you plan to upload files to OpenRouter; understand that files are retained until you delete them or close your account.
→ If you are under 18, note that you are no longer eligible to use OpenRouter under the updated age requirement.
This is the 2nd significant Data Collection Expansion change OpenRouter has made since ConductAtlas began monitoring.
ConductAtlas has recorded 2 material changes to this document over 56 days of monitoring (since July 2026).
Across all monitored documents, OpenRouter has made 5 significant changes.
Introduced new disclosure of file upload, encryption, retention, model provider transmission, and content screening practices.
Increased from 13 to 18 years old, removing service eligibility for minors previously permitted.
Policy explicitly states uploaded files are not used for training OpenRouter's own models, unrelated analytics, or marketing.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
OpenRouter introduced documentation of a Files API feature with persistent file storage and updated its age eligibility requirement from 13 to 18. The Files API disclosure specifies encryption, retention practices, model provider transmission, and content …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-004769.
OpenRouter's privacy policy now includes an additional disclosure circumstance for data sharing: routing API requests in-region in Europe through EU …
OpenRouter raised its minimum age requirement from 13 to 18 years old and removed the parental consent option for users …
OpenRouter restructured its Terms of Service to add detailed provisions governing API credentials, promotional credits, and credit mechanics. The updated …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.