“OpenAI will process Customer Data only in accordance with Customer Instructions, unless required to do so by applicable law to which OpenAI is subject...”
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause establishes Customer control over data processing as the default, with the only override being a legal obligation imposed on OpenAI—limiting OpenAI's discretion to use Customer Data for other purposes.
Interpretive note: The excerpt is truncated; any further elaboration on the scope of 'Customer Instructions' or the legal override is not captured.
Customers can expect their Customer Data to be processed only as they instruct, with the exception that applicable law binding OpenAI may require different processing.
How other platforms handle this
To the extent the Network Data includes any Personal Data...Cloudflare will handle such Personal Data in compliance with applicable data protection laws.
To the extent we treat data as deidentified under the US State Privacy Laws, we will maintain and use that data solely in deidentified form and will not attempt to reidentify that data with any individuals, other than to assess whether the deidentification process complies with applicable law...
We process your data for necessary purposes as described in the main Policy, and for secondary purposes. We use both human and automated means to process your data.
"OpenAI will process Customer Data only in accordance with Customer Instructions, unless required to do so by applicable law to which OpenAI is subject...Excerpt from OpenAI's Data Processing Addendum
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This clause establishes Customer control over data processing as the default, with the only override being a legal obligation imposed on OpenAI—limiting OpenAI's discretion to use Customer Data for other purposes.
Customers can expect their Customer Data to be processed only as they instruct, with the exception that applicable law binding OpenAI may require different processing.
ConductAtlas has identified this type of provision across 273 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.