Track 3 platforms and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is OpenAI's US Privacy Policy for consumer services including ChatGPT and Sora, covering what personal data the company collects, how it is used, and what controls users have. The policy authorizes use of user-submitted content, including prompts, uploaded files, images, and audio, to train AI models, subject to an opt-out available in account settings; it also discloses that Free and Go users' data is used to personalize advertising shown within the services, with purchase data potentially received from third-party advertisers to measure ad effectiveness. The policy further discloses that users who connect their device contacts allow OpenAI to upload that address book data and track when non-users in that contact list later sign up for the service.
This document is OpenAI's US Privacy Policy (effective May 18, 2026), governing personal data collection, use, retention, and disclosure for users of OpenAI's consumer-facing services including ChatGPT and Sora; it explicitly excludes data processed on behalf of API customers, which is governed by separate customer agreements. The policy states that OpenAI collects identifiers, device information, log and usage data, geolocation data, user-submitted content (including prompts, files, images, audio, video, and address book contacts), commercial transaction history, and data received from advertising partners and third-party data sources; the terms authorize use of this data to provide services, conduct research, train AI models (subject to user opt-out), personalize advertising for Free and Go users, and share limited data with marketing partners for cross-context behavioral advertising. The policy authorizes collection of device contacts and notification of users when non-enrolled contacts later join the service, asserts broad retention authority for safety, fraud, legal, and financial recordkeeping purposes including after user-initiated deletion, and discloses that advertiser-provided purchase data may be received to measure ad effectiveness. The policy references engagement with GDPR (for EEA and Swiss users under a separate policy version), US state privacy laws including California, and COPPA-adjacent obligations for users under 13; applicability of specific state privacy rights depends on jurisdiction, and the document acknowledges that data is processed on servers in the United States and other jurisdictions under legally valid transfer mechanisms. Material compliance considerations include the scope of model training data use and opt-out mechanisms, the contact data upload feature covering non-users, the cross-context behavioral advertising disclosure and opt-out pathway, and the retention of data post-deletion for enumerated legitimate purposes.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Get Compliance17 important changes detected
18 versions captured · Last updated: July 2026
OpenAI's privacy policy was restructured on June 12, 2026, adding a table of contents and clarifying how personal data is used. The most material change is new language explicitly disclosing …
View change record →OpenAI updated its privacy policy on June 9, 2026, removing specific language about ad personalization controls for Free and Go users while adding language directing Korean users to a separate …
View change record →OpenAI removed language identifying this as a US-specific privacy policy and collapsed a multilingual language selector into an ellipsis (…) in the document header on June 8, 2026. Previously, the …
View change record →OpenAI updated its privacy policy on June 7, 2026 to add explicit language about how it collects and uses advertising data for Free and Go users. The updated policy now …
View change record →OpenAI removed specific language about collecting advertiser data for ad targeting on free and paid tiers, but simultaneously removed user-facing controls for managing ad personalization. The policy now consolidates ad-related …
View change record →OpenAI updated the language selector in their Privacy Policy header on May 23, 2026. The change modified the spelling and formatting of several language names and codes in the multilingual …
View change record →OpenAI modified two sentences in its US Privacy Policy on May 19, 2026. The document timestamp was updated from April 30, 2026 to May 18, 2026. More substantially, the opt-out …
View change record →OpenAI updated its privacy request procedures on May 14, 2026. Previously, the policy stated users could exercise privacy rights by submitting requests through privacy.openai.com or dsar@openai.com. The updated language now …
View change record →OpenAI updated its privacy policy on May 11, 2026 to explicitly authorize the collection and use of advertiser data from partners and to create a new ad personalization purpose for …
View change record →OpenAI's Privacy Policy was updated on May 9, 2026 with a single language modification in the document header. The change added Persian (فارسی) to the list of available language options …
View change record →OpenAI removed language describing advertiser data partnerships and ad personalization controls for free users, while also removing the specific statement that free and go users could control ad personalization through …
View change record →OpenAI added a new statement clarifying that sensitive data is not processed to infer characteristics about users. The policy also changed how users who are not logged in can exercise …
View change record →OpenAI updated its Privacy Policy on May 1, 2026 to add explicit language about direct marketing to users and disclosure of data sharing with marketing partners. The policy now states …
View change record →OpenAI removed language describing a separate category of marketing partners and the cookie-based data sharing practices used with those partners. The updated policy now consolidates all third-party recipients under a …
View change record →OpenAI's privacy policy was updated on March 6, 2026, with changes to how it describes data uses and disclosures. The updated policy removed explicit language about receiving data from advertisers …
View change record →Monitoring
OpenAI has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Get ComplianceCross-platform context
See how other platforms handle AI Model Training Using User Content and similar clauses.
Compare across platforms →OpenAI expanded its data sharing terms to include third-party marketing partners. The updated policy authorizes the use of personal data fo…
872 provisions across 8 AI platforms. The terms your AI provider sets become the terms your product operates under.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
The bill does not regulate most AI startups directly. But it changes the companies they depend on. Here is what the first federal AI law wo…
H.R. 8094 would make the FTC the referee for AI model disclosure. It also names system cards as a way to comply, which turns a voluntary in…
Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.