Corporate Transaction Data Transfer

What it is

If OpenAI is sold, merged, or acquires another company, your personal data may be transferred to the new entity as part of that transaction, including during the negotiation phase before any deal closes.

Why it matters (compliance & governance perspective)

This provision authorizes transfer of personal data during corporate transactions, including during the negotiation phase, without requiring individual user notification prior to the transfer, which may affect the continuity of the privacy protections users accepted.

This document changed recently

Consumer impact (what this means for users)

The policy states that personal data including conversation history, account information, and usage data may be transferred to an acquiring or merging entity; users are not guaranteed advance individual notice of such a transfer under this provision's terms.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA and CPRA, which require that consumers be notified if their personal data is transferred to a successor entity and that the successor be bound by the original privacy policy's terms or obtain fresh consent for materially different uses. The FTC Act applies where a corporate transaction results in data being used in ways materially inconsistent with representations made at the time of collection. State privacy laws in Virginia, Colorado, and Connecticut also impose requirements regarding notice of material changes to data processing following a business transfer. GOVERNANCE EXPOSURE: Medium. The inclusion of 'during negotiations' as a transfer trigger is notable because it potentially authorizes sharing personal data with a prospective acquirer before any transaction is finalized, which could precede any user notification. The practical scope of this exposure depends on what data categories are shared during due diligence processes. JURISDICTION FLAGS: California creates heightened exposure given CPRA's requirements for successor entities. The EU GDPR, while not addressed in this US policy, would impose additional notification and lawful basis requirements for EU-resident users if a transaction affected their data processing. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should assess whether their data processing agreements with OpenAI include provisions requiring notification of corporate transactions and successor entity obligations. The 'during negotiations' language may create a disclosure to a third party before users or enterprise customers are aware of the potential transaction. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the policy's successor entity language adequately commits the acquirer to honor existing privacy commitments, or whether a material change notice and re-consent obligation would be triggered. Data mapping documentation should flag conversation content and account data as categories subject to potential corporate transaction transfer.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• AI Model Training Use of Conversation Content high
• Third-Party Advertising and Analytics Data Sharing medium
• Data Categories Collected medium
• California and Multi-State Privacy Rights medium
• Data Retention low
• Children Under 13 Exclusion medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.