Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that OpenAI receives information from advertisers and data partners, including data about purchases users make from those advertisers, and uses this data to measure and improve ad effectiveness for Free and Go tier users.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses an inbound data flow from third-party advertisers that includes individual purchase transaction data, which is used for ad measurement and personalization; this practice engages state-level targeted advertising and cross-context behavioral advertising opt-out requirements, and the policy provides opt-out controls through account settings and Global Privacy Control.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →Under this provision, OpenAI may receive data about purchases Free and Go users make from advertisers and use that data to personalize and measure the effectiveness of ads shown within OpenAI Services. Users can opt out of this data use through the advertising controls in account settings or via Global Privacy Control.
Cross-platform context
See how other platforms handle Advertiser Purchase Data for Free and Go Users and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may receive information from advertisers and other data partners, which we use for purposes including to help us measure and improve the effectiveness of ads shown to Free and Go users on our Services. For example, we could receive information about purchases you make from these advertisers.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages CCPA and CPRA definitions of 'sharing' personal information for cross-context behavioral advertising, enforced by the California Privacy Protection Agency. The policy's disclaimer that it does not 'sell' personal data, combined with this disclosure of inbound purchase data from advertisers for ad targeting, requires evaluation under CPRA's definition of 'sharing' and whether the opt-out mechanisms provided satisfy statutory requirements. Similar statutes in Colorado, Connecticut, Virginia, and other states with targeted advertising opt-out provisions are also engaged depending on user residence. FTC Act unfair or deceptive practices standards apply to the clarity of these disclosures. 2) GOVERNANCE EXPOSURE: Medium. The receipt of individual-level purchase transaction data from third-party advertisers for ad measurement purposes is operationally distinct from collecting first-party transaction data, and raises questions about the scope of data flows into OpenAI's systems from external commercial partners. The policy does not specify the number or identity of advertising and data partners involved in these flows. 3) JURISDICTION FLAGS: California users have the most clearly defined statutory opt-out rights under CPRA for cross-context behavioral advertising. Users in other states with enacted comprehensive privacy statutes should assess whether their state's targeted advertising opt-out rights apply. EU and UK users are directed to a separate policy and are not subject to this provision under the US policy. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations evaluating OpenAI's consumer-tier Services for employee use should note that purchase data about employees may flow from third-party advertisers into OpenAI's systems unless users are on paid plans or have activated opt-outs. Procurement teams should confirm whether the API or enterprise agreement applicable to their deployment excludes this data practice. 5) COMPLIANCE CONSIDERATIONS: Compliance teams in organizations where employees use Free or Go tier accounts should assess whether the inbound purchase data flow from advertisers implicates any internal data governance policies. Consent mechanism audits should verify that the advertising opt-out controls in account settings satisfy applicable state law requirements, including Global Privacy Control recognition, which the policy explicitly acknowledges.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses an inbound data flow from third-party advertisers that includes individual purchase transaction data, which is used for ad measurement and personalization; this practice engages state-level targeted advertising and cross-context behavioral advertising opt-out requirements, and the policy provides opt-out controls through account settings and Global Privacy Control.
Under this provision, OpenAI may receive data about purchases Free and Go users make from advertisers and use that data to personalize and measure the effectiveness of ads shown within OpenAI Services. Users can opt out of this data use through the advertising controls in account settings or via Global Privacy Control.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.