Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
If you are in the EU or UK, you have legal rights to access, correct, delete, or restrict how Midjourney uses your personal data, and to receive a copy of your data in a portable format.
This analysis describes what Midjourney's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause establishes Midjourney's obligation to recognize and facilitate statutory data subject rights mandated by EU and UK data protection regulations. The provision operationalizes compliance with GDPR requirements that apply to the controller's processing activities.
Interpretive note: The policy does not specify the legal basis for AI training data processing under GDPR, which creates uncertainty about the scope of the right to object and how Midjourney would respond to such an objection in practice.
EU and UK residents can formally exercise rights to access, correct, delete, or object to processing of their personal data by Midjourney, including data used for AI training purposes, and can escalate to their national data protection authority if requests are not fulfilled.
How other platforms handle this
When you exercise any of your applicable legal rights to access, amend, or delete your personal information, we may request additional information from you for the purpose of confirming your identity.
When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
Monitoring
Midjourney has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you are located in the European Economic Area or the United Kingdom, you have certain rights under the General Data Protection Regulation (GDPR) or the UK GDPR, including the right to access your personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object to processing.Excerpt from Midjourney's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR and UK GDPR rights frameworks enforced by EU member state supervisory authorities and the UK Information Commissioner's Office (ICO). The right to object under GDPR Article 21 is particularly relevant to AI training data uses based on legitimate interests, and Midjourney's ability to continue processing for AI training in the face of an objection depends on whether it can demonstrate compelling legitimate grounds. GOVERNANCE EXPOSURE: Medium. The policy asserts GDPR rights but does not specify the designated EU or UK representative or the supervisory authority with which Midjourney is registered, which may be relevant for users seeking to escalate complaints. The absence of a specified legal basis for AI training processing creates a related governance gap. JURISDICTION FLAGS: EU and EEA residents have enforceable rights through national supervisory authorities. UK residents have comparable rights through the ICO. The adequacy of cross-border data transfer mechanisms for data flowing from the EU and UK to Midjourney's US operations is a material compliance question not fully addressed in the policy text. CONTRACT AND VENDOR IMPLICATIONS: Organizations subject to GDPR that use Midjourney for business purposes should assess whether a Data Processing Agreement with Midjourney is in place and whether it covers all relevant processing activities including AI training data use. The right to data portability may be relevant for enterprise users who wish to retrieve employee-generated content. COMPLIANCE CONSIDERATIONS: Legal teams should verify that Midjourney has a functional process for handling GDPR data subject requests within the required timeframes and that a valid cross-border transfer mechanism is in place for EU-to-US data flows. Compliance teams should document whether the right to object to AI training processing has been exercised and how Midjourney has responded.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This clause establishes Midjourney's obligation to recognize and facilitate statutory data subject rights mandated by EU and UK data protection regulations. The provision operationalizes compliance with GDPR requirements that apply to the controller's processing activities.
EU and UK residents can formally exercise rights to access, correct, delete, or object to processing of their personal data by Midjourney, including data used for AI training purposes, and can escalate to their national data protection authority if requests are not fulfilled.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Midjourney.