Prohibition on Surveillance and Privacy-Violating Applications

What it is

The policy prohibits using Cohere's AI to build applications that secretly track, monitor, or profile individuals without their knowledge or authorization.

Why it matters (compliance & governance perspective)

This provision covers location tracking, communications monitoring, and unauthorized profiling, which are categories of data processing subject to significant regulatory obligations under privacy frameworks including GDPR, CCPA, and sector-specific wiretapping laws.

Consumer impact (what this means for users)

Operators cannot use Cohere's services to build covert surveillance tools, location trackers, or unauthorized profiling systems targeting individuals, providing a contractual protection for end users against certain privacy-invasive applications built on the platform.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR Articles 5 and 6 (lawful basis for processing and data minimization), CCPA provisions on sensitive personal information, the Electronic Communications Privacy Act (ECPA) and state wiretapping laws in the US, and the EU AI Act's provisions on real-time biometric surveillance. The FTC has active enforcement interest in covert tracking and unauthorized profiling practices. GOVERNANCE EXPOSURE: Medium to High depending on operator context. Employers using AI-powered employee monitoring tools, law enforcement technology vendors, and consumer analytics platforms face heightened exposure. The prohibition on 'profiles of individuals for unauthorized purposes' requires operators to assess whether their profiling activities have a lawful basis under applicable privacy law. JURISDICTION FLAGS: GDPR imposes strict limitations on surveillance and profiling of EU residents. California's CCPA imposes special category restrictions on sensitive personal information including precise geolocation. Illinois BIPA regulates biometric data collection. These frameworks impose obligations independent of the AUP. CONTRACT AND VENDOR IMPLICATIONS: B2B contracts involving AI-powered monitoring, analytics, or profiling capabilities should include explicit representations regarding the lawful basis for data processing and the scope of user consent. Procurement teams at regulated entities should assess whether surveillance-adjacent use cases require data protection impact assessments. COMPLIANCE CONSIDERATIONS: Operators should review all use cases involving individual monitoring or profiling against applicable privacy law requirements, conduct data protection impact assessments for high-risk processing activities, and ensure consent mechanisms are adequate for the level of monitoring involved.

Applicable agencies

Provision details

Other risks in this policy

• Prohibited Use: CSAM and Sexual Content Involving Minors high
• Prohibited Use: Weapons of Mass Destruction and CBRN Content high
• Prohibited Use: Cyberweapons and Critical Infrastructure Attacks high
• Prohibited Use: Non-Consensual Synthetic Media and Deepfakes high
• Prohibited Use: Election Interference and Political Disinformation medium
• Operator Responsibility for Downstream Use high