Luma uses the images, videos, text, and other content you submit to its services to train and improve its AI models.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users uploading personal images, videos, or sensitive text may not expect that content to contribute to AI model development, and no specific opt-out for this use is described in the policy.
Interpretive note: Whether Luma's legitimate interests basis for AI training satisfies GDPR's balancing test without a specific opt-out depends on jurisdiction-specific regulatory interpretation and has not been adjudicated with respect to this policy.
Severity downgraded from high to medium, and the provision was split—conversation/input data collection details moved to separate 'Conversation and Input Data Collection' provision, removing the explicit statement about Outputs reproducing Input information.
View full change record →Content you upload to Luma, including personal images, videos, and AI chat conversations, may be used to train Luma's AI models. Because no dedicated opt-out mechanism is specified for this use, users who do not want their content used for training must either avoid uploading sensitive material or request deletion via the contact details provided.
How other platforms handle this
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, delete, or port your data. EU and UK users may also have the right to object to or restrict certain processing. California residents may have the right to know, delete, corre...
Monitoring
Luma AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Train, develop, and improve the artificial intelligence, machine learning, and models that we use to support our Services— Excerpt from Luma AI's Luma AI Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Articles 6 and 13 (legal basis and transparency obligations) and potentially Article 9 where uploaded content includes biometric or sensitive data. Luma asserts legitimate interests as a basis for AI training, which under GDPR requires a documented balancing test against user rights and interests. The EU AI Act may require evaluation given Luma's model development activities. The FTC Act's framework on unfair or deceptive practices applies to the adequacy of disclosure about AI training use. GOVERNANCE EXPOSURE: High. The use of user-submitted images, videos, and conversation inputs for AI model training without a specific opt-out raises meaningful exposure under GDPR's legitimate interests framework and may require a Data Protection Impact Assessment (DPIA) under GDPR Article 35, particularly if uploaded content includes images of identifiable individuals or sensitive categories of data. The scope of data used for training is broadly defined and not limited to anonymized or aggregated content. JURISDICTION FLAGS: EEA and UK users have the strongest exposure given GDPR and UK GDPR requirements for legitimate interests balancing and transparency. California users may have rights under CCPA to know about and limit use of personal information, depending on whether AI training qualifies as a sale or sharing under California law. Illinois users should note that if uploaded images are used in ways that implicate facial recognition or biometric identifiers, the Illinois Biometric Information Privacy Act may engage. CONTRACT AND VENDOR IMPLICATIONS: Enterprises deploying Luma as a vendor should clarify in their data processing agreement whether employee or end-user content submitted through enterprise accounts is used for model training, as this policy explicitly carves out enterprise processor relationships. Procurement teams should request confirmation of AI training data use limitations in contractual form. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether Luma's legitimate interests basis for AI training is supported by a documented balancing test and whether users are provided with sufficiently specific notice at the point of data collection. Consent mechanism reviews should evaluate whether any separate opt-in or opt-out for AI training use is required under applicable law. Data mapping exercises should identify categories of content being uploaded and assess whether special category data protections are triggered.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Users uploading personal images, videos, or sensitive text may not expect that content to contribute to AI model development, and no specific opt-out for this use is described in the policy.
Content you upload to Luma, including personal images, videos, and AI chat conversations, may be used to train Luma's AI models. Because no dedicated opt-out mechanism is specified for this use, users who do not want their content used for training must either avoid uploading sensitive material or request deletion via the contact details provided.
ConductAtlas has identified this type of provision across 2 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.