Anthropic · Anthropic Privacy Policy · View original document ↗

Data Controller versus Processor Scope Distinction

Medium severity High confidence Explicitdocumentlanguage Unique · 0 of 325 platforms
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for Anthropic Create a free account to receive the weekly governance digest and monitor one platform for governance changes.
Create free account No credit card required.

This analysis describes what Anthropic's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

Many users may not realize that using Claude through a work account or third-party app means Anthropic's consumer privacy policy does not apply to them, leaving their data protections determined entirely by their employer or the app provider.

Consumer impact (what this means for users)

The policy states that Inputs (your messages to Claude) and Outputs (Claude's responses) may be used to train Anthropic's AI models, and that this use continues even after opting out if the conversation is flagged for safety review or if you have explicitly submitted feedback about it. Device identifiers, IP address-derived location data, browsing activity, and usage information are also collected automatically. You can opt out of conversation use for model training by accessing your account settings at Claude.ai.

How other platforms handle this

Auth0 Medium

When Okta provides its products and services to its customers (e.g., organizations that use Okta to manage their workforce or Auth0 to manage their customer identity), Okta processes personal data on behalf of those customers as a data processor. In those cases, the customer is the data controller a...

Smartsheet Medium

When we provide the Service to our customers, we act as a data processor on behalf of those customers. Our customers are the data controllers, meaning that they determine the purposes and means of the processing of personal data that is submitted into the Service. If you are an end user of a custome...

Zendesk Medium

When Zendesk processes personal data on behalf of its customers, Zendesk acts as a data processor and the customer acts as the data controller. In those cases, the customer's privacy policy and data processing agreement with Zendesk govern the processing of that data, not this Privacy Notice. If you...

See all platforms with this clause type →

Monitoring

Anthropic has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.

Start Watcher free trial Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
This Privacy Policy does not apply where Anthropic acts as a data processor and processes personal data on behalf of commercial customers using Anthropic's Commercial Services – for example, your employer has provisioned you a Claude for Work account, or you're using an app that is powered on the back-end with Claude. In those cases, the commercial customer is the controller, and you can review their policies for more information about how they handle your personal data.

— Excerpt from Anthropic's Anthropic Privacy Policy

Applicable regulations

EU AI Act
European Union
BIPA
Illinois, USA
CCPA/CPRA
California, USA
Colorado AI Act
US-CO
CAN-SPAM
United States Federal
ePrivacy Directive
European Union
EU AI Act - High Risk Provisions
EU
FTC Act Section 5
United States Federal
GDPR
European Union
UK GDPR
United Kingdom

Provision details

Document information
Document
Anthropic Privacy Policy
Entity
Anthropic
Document last updated
May 5, 2026
Tracking information
First tracked
May 9, 2026
Last verified
May 12, 2026
Record ID
CA-P-007138
Document ID
CA-D-00012
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
20bca03faeb6eca729c8a9ece674a093b027618cf9e96f1e0a652dcaef888ca9
Analysis generated
May 9, 2026 14:50 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: Anthropic
Document: Anthropic Privacy Policy
Record ID: CA-P-007138
Captured: 2026-05-09 14:50:44 UTC
SHA-256: 20bca03faeb6eca7…
URL: https://conductatlas.com/platform/anthropic/anthropic-privacy-policy/data-controller-versus-processor-scope-distinction/
Accessed: May 13, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Professional Governance Intelligence

Need to monitor specific governance provisions?

Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.

Arbitration clauses AI governance Data rights Indemnification Retention policies
Start Professional free trial

Or start with Watcher →

Built from archived source documents, structured governance mappings, and historical version tracking.

Frequently Asked Questions

What does Anthropic's Data Controller versus Processor Scope Distinction clause do?

Many users may not realize that using Claude through a work account or third-party app means Anthropic's consumer privacy policy does not apply to them, leaving their data protections determined entirely by their employer or the app provider.

Is ConductAtlas affiliated with Anthropic?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Anthropic.