OpenAI Privacy Policy

This is OpenAI's US Privacy Policy covering how the company collects and uses personal data when users interact with ChatGPT, Sora, the Atlas browser, and other consumer-facing Services. The policy states that user-submitted content including prompts, files, images, and audio may be used to train OpenAI's AI models, though users can opt out of this use through account settings; it also discloses that data received from advertising and data partners, including information about purchases made from those advertisers, is used to measure and improve ad effectiveness for Free and Go users. The policy further discloses that when users connect device contacts, OpenAI uploads address book information and may retain data about non-users, notifying the account holder if those contacts later sign up.

This document is OpenAI's US Privacy Policy (effective May 18, 2026), governing the collection, use, disclosure, and retention of personal data from users of OpenAI's consumer-facing Services including ChatGPT, Sora, and the Atlas browser; it does not apply to data processed under OpenAI's API customer agreements. The policy states that OpenAI collects identifiers, device information, log data, usage data, geolocation data, payment and transaction history, user-submitted content (including prompts, files, images, audio, video), device contact lists, and data received from advertising and data partners; the terms authorize use of user content to train AI models subject to an opt-out, and authorize sharing with vendors, marketing partners, affiliates, business account administrators, government authorities, and parties to corporate transactions. The policy discloses that data is received from advertisers and data partners including information about purchases users make from those advertisers, and that device contact information for non-users may be uploaded and retained; these practices, combined with cross-context behavioral advertising disclosures, engage state-level privacy frameworks including California's CPRA and similar statutes, and the policy's assertion that it does not 'sell' personal data while engaging in targeted advertising sharing warrants evaluation under applicable statutory definitions. The policy engages GDPR, UK GDPR, and Swiss data protection law for EEA, UK, and Swiss users through a separate policy version, and designates OpenAI Ireland Limited as the EEA and Switzerland data controller; for US users, applicable frameworks include CCPA and CPRA, state biometric and consumer privacy statutes, COPPA for users under 13, and FTC Act provisions governing unfair or deceptive practices, with jurisdiction-specific exposure varying by state residence.

The agreement authorizes OpenAI to use user-submitted content including prompts, files, images, and audio to train AI models, subject to a user-controlled opt-out available in account settings. For Free and Go users, the terms authorize receipt of purchase data from advertisers and use of that data to personalize and measure ad effectiveness, with opt-out controls available through account settings or the Global Privacy Control. You can opt out of model training data use, ad personalization, and cross-context behavioral advertising through your OpenAI account settings at privacy.openai.com or via the Your Privacy Choices link on the OpenAI website.