Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy states that personal data is processed and stored in the United States and may be transferred to other countries, and asserts that users consent to such transfers by using the platform.
This analysis describes what ElevenLabs's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts consent-based authorization for cross-border data transfers, including from the EU and UK to the United States; under GDPR, consent alone is generally not a sufficient transfer mechanism and the policy does not specify reliance on Standard Contractual Clauses or other adequacy mechanisms, which may require further evaluation.
Interpretive note: The policy does not specify the transfer mechanism relied upon for EU and UK data flows, and the adequacy of consent as a GDPR Chapter V transfer basis for systematic transfers is a matter of active regulatory interpretation.
Changed from conditional warning ('If you are accessing') to affirmative consent mechanism ('you consent to'); elevated severity from medium to high by explicitly stating users accept reduced legal protections.
View full change record →Under this clause, personal data submitted by users in the EU, UK, or other jurisdictions is transferred to and processed in the United States. The agreement asserts user consent as the basis for this transfer, though GDPR compliance for such transfers typically requires additional mechanisms beyond consent obtained through terms acceptance.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
Monitoring
ElevenLabs has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"ElevenLabs is based in the United States and the information we collect is governed by U.S. law. By accessing or using our Services or otherwise providing information to us, you consent to the processing, transfer and storage of information in and to the U.S. and other countries, where you may not have the same rights and protections as you do under local law.Excerpt from ElevenLabs's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly implicates GDPR Chapter V (restrictions on transfers of personal data to third countries), UK GDPR transfer rules, and the EU-U.S. Data Privacy Framework. The assertion of consent as the transfer mechanism engages GDPR Article 49 (derogations for specific situations), which permits consent-based transfers only where the consent is explicit, informed, and given after the data subject is told of possible risks. Enforcement authorities are EU member state data protection authorities and the UK ICO. 2. GOVERNANCE EXPOSURE: High. EU data protection authorities have scrutinized consent-based cross-border transfer justifications and have generally held that Article 49 consent derogations are not appropriate as a primary transfer mechanism for systematic, large-scale transfers. The absence of explicit reference to Standard Contractual Clauses, Binding Corporate Rules, or the EU-U.S. Data Privacy Framework in the policy text creates documented uncertainty about the transfer compliance architecture. 3. JURISDICTION FLAGS: EU and UK users face the greatest exposure from this provision given GDPR and UK GDPR transfer restrictions. Users in countries with analogous data localization or transfer requirements (e.g., Brazil under LGPD, India under DPDPA) may also be affected as those regimes develop. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers in the EU or UK using ElevenLabs as a data processor should confirm whether a GDPR-compliant data processing agreement including appropriate transfer mechanisms (SCCs or DPF certification) has been executed with ElevenLabs. The policy text alone does not document the transfer mechanism in sufficient detail for processor due diligence purposes. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should request documentation from ElevenLabs confirming the transfer mechanism in place for EU and UK data flows, verify whether ElevenLabs is certified under the EU-U.S. Data Privacy Framework, and assess whether the consent language in the policy satisfies GDPR Article 49 requirements for derogation-based transfers if SCCs or DPF are not the primary mechanism.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision asserts consent-based authorization for cross-border data transfers, including from the EU and UK to the United States; under GDPR, consent alone is generally not a sufficient transfer mechanism and the policy does not specify reliance on Standard Contractual Clauses or other adequacy mechanisms, which may require further evaluation.
Under this clause, personal data submitted by users in the EU, UK, or other jurisdictions is transferred to and processed in the United States. The agreement asserts user consent as the basis for this transfer, though GDPR compliance for such transfers typically requires additional mechanisms beyond consent obtained through terms acceptance.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ElevenLabs.