The agreement places full legal responsibility on the customer for providing privacy notices and obtaining consents required by applicable law when processing end user personal data through AWS services, and the customer represents to AWS that these obligations have been met.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that AWS's contractual liability for privacy notice and consent compliance is limited and that the customer assumes responsibility for lawful basis requirements under GDPR, CCPA, and other applicable privacy frameworks when using AWS services to process personal data.
The updated terms remove the explicit reference to a Data Processing Addendum governing Anthropic data transfers, though the requirement to obtain opt-in consent for Anthropic model use remains in place. For Kiro users, the revised language now explicitly states that abuse detection includes retention and potential human review of inputs and outputs when selecting certain models. Users of Anthropic models on Bedrock should verify opt-in consent mechanisms in service documentation to understand data handling practices.
View change record →The updated terms establish a new project-based service structure for AWS (new) users, effective August 17, 2026, with new rules governing team member access and content ownership. Users who enable spend limits agree that AWS may suspend their account or project access upon reaching their limit, and may permanently close the account or project if not reactivated within an unspecified timeframe. Contributed content by team members becomes the project owner's property and is subject to a nonexclusive irrevocable license granted to all project members. You can configure AI services opt-out policies through AWS Settings; project owners can manage team member permissions and access controls.
View change record →The updated terms now explicitly state that AWS IoT SiteWise Scenario Discovery is not designed for real-time vehicle control and cannot be used as the sole basis for determining vehicle safety or regulatory compliance. Organizations deploying this service must implement independent human monitoring and safety validation before using its outputs to support vehicle system decisions. The terms make clear that AWS assumes no responsibility for uses that violate these constraints.
View change record →Under this clause, customers using AWS services to process end user personal data bear full legal responsibility for privacy notices, consent mechanisms, and lawful processing compliance under applicable law, and make an affirmative representation to AWS that these requirements have been satisfied.
Cross-platform context
See how other platforms handle Customer Responsibility for Privacy Notices and Consent and similar clauses.
Compare across platforms →"If you process the personal data of End Users or other identifiable individuals in your use of a Service, you are responsible for providing legally adequate privacy notices and obtaining necessary consents for the processing of such data. You represent to us that you have provided all necessary privacy notices and obtained all necessary consents. You are responsible for processing such data in accordance with applicable law.Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 13 and 14 (information obligations to data subjects), Article 6 (lawful basis for processing), and Article 7 (conditions for consent), as well as CCPA disclosure and opt-out …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that AWS's contractual liability for privacy notice and consent compliance is limited and that the customer assumes responsibility for lawful basis requirements under GDPR, CCPA, and other applicable privacy frameworks when using AWS services to process personal data.
Under this clause, customers using AWS services to process end user personal data bear full legal responsibility for privacy notices, consent mechanisms, and lawful processing compliance under applicable law, and make an affirmative representation to AWS that these requirements have been satisfied.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.