OpenAI Privacy Policy

This document is OpenAI's US Privacy Policy, governing how OpenAI collects, uses, shares, and retains personal data from users of its consumer and API products, including ChatGPT, DALL-E, and related services, with stated legal bases including consent, contractual necessity, and legitimate interests. The policy states that OpenAI collects name, contact information, payment details, conversation content, files and images uploaded by users, device identifiers, IP addresses, browsing activity, location data, and usage logs, and the terms authorize use of this data for service delivery, safety monitoring, model training (where users have not opted out), and marketing communications. The policy discloses that conversation content submitted through non-API consumer products may be used to train AI models unless the user disables the training toggle in settings, which is an operationally significant disclosure given the nature of inputs users submit; the terms also authorize sharing personal data with affiliated entities, service providers, advertising and analytics partners, and in connection with corporate transactions such as mergers or acquisitions. The policy engages the California Consumer Privacy Act (CCPA/CPRA), which grants California residents rights to access, delete, correct, and opt out of certain data uses, and the policy provides a dedicated Privacy Request Form for these purposes; it also references compliance with US state privacy laws more broadly, including those in Virginia, Colorado, Connecticut, and Texas. Material compliance considerations include the adequacy of the model-training opt-out mechanism under emerging US AI and privacy regulations, the classification of third-party advertising pixel data flows under CCPA's sale and sharing definitions, and the policy's assertion that it does not knowingly collect data from users under 13, which engages COPPA enforcement by the FTC.