The policy states that when users choose to connect device contacts, OpenAI uploads address book information and retains data about contacts who do not use OpenAI Services, using that data to notify the account holder if non-user contacts subsequently register.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes the collection and retention of personal data belonging to individuals who have not agreed to any OpenAI terms of service, creating a data processing relationship with non-users that may raise questions under applicable privacy frameworks regarding notice, consent, and data subject rights for those individuals.
Interpretive note: The policy does not specify retention periods, deletion mechanisms, or the full scope of data categories collected from non-user contacts, creating ambiguity about the extent of data processing for those individuals.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →No material change in text; provision renamed from 'Contact Data Upload and Non-User Data Collection' to 'Device Contact Upload Including Non-Users'.
View full change record →Under this provision, connecting device contacts causes OpenAI to upload address book data including information about individuals who do not use OpenAI Services; that data is retained and used to match and notify account holders when non-users later register. The policy links to additional information about how uploaded contact information of non-users is handled.
Cross-platform context
See how other platforms handle Device Contact Upload Including Non-Users and similar clauses.
Compare across platforms →"If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services. If any of your contacts aren't yet using our Services, we'll update you if they sign up for our Services later.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR and UK GDPR requirements regarding the lawful basis for processing personal data of individuals who are not party to any agreement with OpenAI, enforced by the Irish Data …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes the collection and retention of personal data belonging to individuals who have not agreed to any OpenAI terms of service, creating a data processing relationship with non-users that may raise questions under applicable privacy frameworks regarding notice, consent, and data subject rights for those individuals.
Under this provision, connecting device contacts causes OpenAI to upload address book data including information about individuals who do not use OpenAI Services; that data is retained and used to match and notify account holders when non-users later register. The policy links to additional information about how uploaded contact information of non-users is handled.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.