Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that when users choose to connect device contacts, OpenAI uploads address book information and retains data about contacts who do not use OpenAI Services, using that data to notify the account holder if non-user contacts subsequently register.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes the collection and retention of personal data belonging to individuals who have not agreed to any OpenAI terms of service, creating a data processing relationship with non-users that may raise questions under applicable privacy frameworks regarding notice, consent, and data subject rights for those individuals.
Interpretive note: The policy does not specify retention periods, deletion mechanisms, or the full scope of data categories collected from non-user contacts, creating ambiguity about the extent of data processing for those individuals.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →Under this provision, connecting device contacts causes OpenAI to upload address book data including information about individuals who do not use OpenAI Services; that data is retained and used to match and notify account holders when non-users later register. The policy links to additional information about how uploaded contact information of non-users is handled.
Cross-platform context
See how other platforms handle Device Contact Upload Including Non-Users and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services. If any of your contacts aren't yet using our Services, we'll update you if they sign up for our Services later.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR and UK GDPR requirements regarding the lawful basis for processing personal data of individuals who are not party to any agreement with OpenAI, enforced by the Irish Data Protection Commission for EEA users and the UK Information Commissioner's Office for UK users. For US users, CCPA and CPRA may apply to the extent non-user contacts are California residents. COPPA is engaged if any contact data belongs to individuals under 13. The FTC Act's unfair or deceptive practices standards apply to whether the notice provided to the account holder adequately discloses the scope of non-user data processing. 2) GOVERNANCE EXPOSURE: Medium. The processing of personal data belonging to non-users who have not been given notice or an opportunity to consent is an operationally distinct data practice. The policy does not specify what categories of contact data are retained, for how long, or what rights non-users may exercise with respect to their data held by OpenAI. 3) JURISDICTION FLAGS: EU and UK users are directed to a separate policy, and the EEA and UK versions may address this practice under different legal bases. California residents whose contact information is uploaded by others may have CPRA rights they can exercise even as non-users. Illinois residents should note that if contact data includes biometric identifiers, the Illinois Biometric Information Privacy Act may be engaged, though the policy does not suggest biometric data is collected through contacts. 4) VENDOR IMPLICATIONS: The policy references a help center article providing additional detail on how non-user contact data is handled; compliance teams should review that linked resource as part of any due diligence assessment, as the policy text alone does not specify retention periods or deletion mechanisms for non-user contact data. 5) COMPLIANCE CONSIDERATIONS: Organizations whose employees use OpenAI consumer Services should assess whether business contact information of clients, partners, or colleagues could be uploaded through device contact connections, and whether any contractual or regulatory obligations govern that secondary disclosure. Data mapping exercises should account for the potential upload of third-party personal data from employee devices.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes the collection and retention of personal data belonging to individuals who have not agreed to any OpenAI terms of service, creating a data processing relationship with non-users that may raise questions under applicable privacy frameworks regarding notice, consent, and data subject rights for those individuals.
Under this provision, connecting device contacts causes OpenAI to upload address book data including information about individuals who do not use OpenAI Services; that data is retained and used to match and notify account holders when non-users later register. The policy links to additional information about how uploaded contact information of non-users is handled.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.