What are the institutional and regulatory implications of this document?

REGULATORY LANDSCAPE: This document engages GDPR and UK GDPR (with Anthropic Ireland, Limited designated as EEA and UK controller), CCPA and related US state consumer privacy statutes, Brazil's LGPD, Canada's PIPEDA framework, and South Korea's PIPA and Network Act. The FTC Act is implicated through general consumer data practices. The policy's biometric data collection disclosure may engage Illinois BIPA, Texas CUBI, and Washington's My Health MY Data Act depending on user geography. The docum…

How does Anthropic's Anthropic Privacy Policy (Superseded Capture) affect users?

The agreement establishes that user Inputs and Outputs may be used for AI model training by default, with opt-out available through account settings, subject to carve-outs for safety-flagged content and explicitly reported materials. Under these terms, users who opt out of model training retain coverage for standard conversations, but conversations flagged for safety review or submitted as feedback remain available for training regardless of opt-out status. You can opt out of model training thr…

How often is Anthropic's Anthropic Privacy Policy (Superseded Capture) updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when Anthropic updates this document?

Yes. Monitor subscribers ($19/month) can add Anthropic to their watchlist and receive same-day email alerts whenever this document or any other Anthropic document changes.

CA-D-000012

Anthropic Privacy Policy (Superseded Capture)

Anthropic

Last change detected July 9, 2026 Privacy policy

SHA-256: e91b78d120f18b8a635… 4 versions captured 2 changes documented

Create free account

Track 3 platforms and get the weekly governance digest. No credit card required.

View original document at Anthropic ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

81 Total

14 High severity

50 Medium severity

17 Low severity

Summary

This is Anthropic's consumer Privacy Policy covering how the company collects and uses personal data when individuals use Claude.ai, the Anthropic website, and related consumer services. The policy discloses that Anthropic may use user Inputs and Outputs to train its AI models unless users opt out through account settings, though opt-out does not apply when conversations are flagged for safety review or when users have explicitly submitted feedback about the content. The policy also discloses that in some identity verification contexts, Anthropic collects biometric data including facial geometry templates, which the document acknowledges may be classified as biometric data under applicable law in certain jurisdictions.

Technical / Legal Breakdown

This Privacy Policy, effective July 8, 2026, governs Anthropic's collection, use, disclosure, and processing of personal data for users of its website, Claude.ai, and other consumer-facing services; it expressly excludes data processed on behalf of Enterprise customers, which is governed by separate customer agreements. The agreement states that Anthropic collects identity and contact data, payment information, user Inputs and Outputs, feedback, verification data (including biometric facial geometry templates in some contexts), device and connection information, and usage and log data; and the terms authorize use of Inputs and Outputs for AI model training unless users opt out, with carve-outs permitting such use regardless of opt-out status where content is flagged for safety review or explicitly reported via feedback mechanisms. The policy discloses that verification data may include biometric facial geometry templates, which the document acknowledges may qualify as biometric data in some jurisdictions, and that de-identified Inputs and Outputs may be re-identified to enforce Terms of Service or Usage Policy against specific users when necessary. The document engages GDPR and UK GDPR (with Anthropic Ireland, Limited designated as EEA and UK data controller), CCPA and US state consumer health data laws, Brazil's LGPD, Canada's PIPEDA framework, and the Republic of Korea's Personal Information Protection Act (PIPA) and Act on Promotion of Information and Communications Network Utilization; regional supplemental disclosures are provided for Canada, Brazil, and South Korea, and a separate Consumer Health Data Privacy Policy applies to Washington State and similar jurisdictions. Compliance teams should note the layered opt-out architecture for model training, the re-identification carve-out for policy enforcement, the biometric data collection disclosure, and the cross-border transfer mechanisms relying on Standard Contractual Clauses and adequacy decisions, each of which may require jurisdiction-specific evaluation.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Get Compliance

2 important changes detected

4 versions captured · Last updated: July 2026

July 9, 2026

low

What changed Anthropic's privacy policy was updated on July 9, 2026 to add a single introductory sentence describing the company as 'an AI safety and research company working to build reliable, interpretable, and steerable AI systems.' This sentence was removed from its previous location and then reinserted in the document header. The change is editorial and does not alter any substantive privacy rights, data practices, or user obligations.

Why this matters This change has no material impact on consumer privacy rights, data collection practices, or obligations. The updated policy now includes a single introductory sentence identifying Anthropic as an AI safety and research company. This is a purely editorial modification with no changes to how personal data is handled, retained, or shared.

View full change record →

June 9, 2026

low

What changed Anthropic updated its Privacy Policy on June 9, 2026, with an effective date of July 8, 2026. The revised policy narrows its scope to clarify that it applies when Anthropic acts as a data controller for consumer services (Claude.ai, Claude Team), but not when it processes data on behalf of enterprise customers whose own data governance controls how their data is handled. The policy also expands the definition of 'Inputs' to explicitly include content submitted through third-party integrations and connected services, and clarifies that personal data or external references in Inputs may be reproduced in Outputs.

Why this matters The updated policy clarifies that it applies when you use Anthropic's consumer services like Claude.ai or Claude Team, but does not govern your data when you access Anthropic products through your employer or an enterprise account. In that case, your employer's or enterprise customer's own data governance policies control how your data is handled. The policy also now explicitly states that personal data or external references included in your inputs to the service may be reproduced in the outputs generated in response.

View full change record →

Featured — High severity

Agentic outputs may affect third-party services Compare →

Claude's agentic outputs can have tangible real-world consequences beyond the Anthropic platform, and those consequences are conditioned on permissions the user grants, placing meaningful weight on the user's permission decisions.

Added July 10, 2026 Unique
Anthropic not responsible for third-party data practices Compare →

This disclaimer means users have no recourse against Anthropic for how Third-Party Services collect, use, or share data, even when those services are accessed through or in connection with Anthropic's platform.

Added July 10, 2026 Standard Seen across 286 platforms
Biometric data collection for verification Compare →

Facial geometry templates are among the most sensitive categories of personal data and are regulated as biometric data in several jurisdictions; their collection by Anthropic carries significant privacy implications depending on applicable law.

Added July 10, 2026 Standard Seen across 298 platforms
Deletion of child data upon notification Compare →

Deletion is conditional on Anthropic's determination that it is 'appropriate,' meaning it is not automatic upon notification; the outcome depends on Anthropic's investigation.

Added July 10, 2026 Standard Seen across 275 platforms
Detection and removal of underage users Compare →

Anthropic maintains measures to detect and remove children from its Services.

Added July 10, 2026 Standard Seen across 275 platforms
Disclosure to government and law enforcement Compare →

This provision permits disclosure of personal data to government and law enforcement actors without user consent, conditioned only on Anthropic's good-faith belief that it is reasonably necessary for legal compliance.

Added July 10, 2026 Standard Seen across 286 platforms
Inputs and outputs sent to third-party services Compare →

User data—including the content of interactions with Claude—may be transmitted to external third parties outside Anthropic's direct control, expanding the set of entities that receive and process that data.

Added July 10, 2026 Standard Seen across 286 platforms
Inputs and Outputs used for model training Compare →

Training use of Inputs and Outputs is the default; users must take an affirmative step through account settings to prevent it, meaning inaction results in data use for model improvement.

Added July 10, 2026 Standard Seen across 277 platforms
Safety-flagged content training override Compare →

The opt-out for model training is not absolute; two specific conditions—safety flagging and user-initiated reporting—override the opt-out, meaning users cannot prevent training use of flagged or self-reported content.

Added July 10, 2026 Standard Seen across 277 platforms
User opt-out for model training Compare →

The availability of an opt-out mechanism gives users a degree of control over whether their interaction data is used for model training, though that control must be exercised affirmatively through account settings.

Added July 10, 2026 Standard Seen across 287 platforms

Featured — Medium severity

Flagged content disassociated but re-identifiable for enforcement Compare →

The disassociation provides only conditional anonymity: Anthropic preserves the operational capacity to re-identify flagged content, meaning the separation is not permanent and can be reversed for enforcement purposes.

Added July 10, 2026 Standard Seen across 277 platforms
No automated legal decision-making Compare →

This commitment limits Anthropic's use of fully automated decision-making for consequential outcomes, which is directly relevant to rights under privacy frameworks such as GDPR that restrict such practices.

Added July 10, 2026 Standard Seen across 211 platforms