AI Training Data Use

What it is

When you use NVIDIA AI tools such as NIM, content you submit may be used to train or improve NVIDIA's AI models, though the policy states opt-out options may be available.

Why it matters (compliance & governance perspective)

The policy authorizes use of user-submitted content for AI model training, which means inputs to NVIDIA AI services could contribute to model development; the scope of data retained after opt-out is not fully specified in the policy.

Consumer impact (what this means for users)

Users of NVIDIA AI products including NIM may have their input data used for AI model training under this provision; the policy states opt-out mechanisms exist but does not fully detail what data is excluded from training after opt-out is exercised.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles 5, 6, and 13 regarding lawful basis and transparency for AI training use of personal data; the EU AI Act's requirements on providers of general-purpose AI models regarding training data documentation and transparency are also engaged. The FTC has issued guidance on AI training data use under Section 5 of the FTC Act. EU Data Protection Authorities and the UK ICO have both issued guidance questioning the adequacy of legitimate interests as a lawful basis for AI training without explicit consent. The California Privacy Protection Agency has initiated rulemaking on automated decision-making and AI that may affect this provision. 2) GOVERNANCE EXPOSURE: High. The provision asserts a right to use personal data for AI model training with an opt-out mechanism rather than requiring affirmative consent; in the EU/EEA, this approach may require a legitimate interests assessment that demonstrably outweighs data subject rights, and regulators in Italy, Ireland, and France have previously challenged similar provisions by other AI providers. The adequacy of the opt-out as a substitute for consent is jurisdiction-dependent and operationally uncertain based on the policy language alone. 3) JURISDICTION FLAGS: Heightened exposure in EU/EEA where GDPR requires a clear lawful basis for each processing purpose; UK where the ICO has scrutinized AI training practices; California where CPRA sensitive data provisions and CPPA rulemaking on automated decision-making may apply; and Brazil under LGPD. The provision may require different consent or opt-out mechanisms depending on the jurisdiction of the user. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise and developer customers integrating NVIDIA NIM or other AI APIs into their own products should assess whether this AI training use provision conflicts with their own privacy policies or data processing agreements with end users. Data processing addenda with NVIDIA should clarify whether customer data submitted via API is used for model training and what contractual controls exist to restrict such use. The policy as stated does not clearly distinguish between consumer and enterprise/developer data use. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether opt-out mechanisms for AI training are prominently disclosed at point of data collection for AI products; evaluate whether a legitimate interests assessment has been documented for EU users; assess whether product-level privacy settings are accessible and functional; and consider whether data processing agreements with NVIDIA for enterprise use include explicit restrictions on training data use.

Applicable agencies

Provision details

Other risks in this policy

• Third-Party Data Sharing Including Advertising and Data Brokers medium
• Consumer Data Subject Rights (Access, Deletion, Portability, Objection) medium
• Cross-Border Data Transfers medium
• Children and Minors Data Restriction low
• Data Retention low