Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that OpenAI does not sell personal data but shares limited data with marketing partners for targeted advertising on third-party properties, characterizes this as cross-context behavioral advertising under applicable state privacy laws, and provides opt-out mechanisms through account settings, the Your Privacy Choices link, and Global Privacy Control.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision directly engages state privacy law definitions of cross-context behavioral advertising and targeted advertising sharing, provides multiple opt-out pathways including recognition of Global Privacy Control, and discloses that this practice does not apply to users known to be under 18 years of age.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →The agreement discloses that data is shared with select marketing partners for targeted advertising on third-party properties, characterized as cross-context behavioral advertising under applicable state law. Users can opt out through account settings, the Your Privacy Choices link, or Global Privacy Control, and the policy states that this practice does not apply to users known to be under 18.
Cross-platform context
See how other platforms handle Cross-Context Behavioral Advertising Opt-Out and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We don't 'sell' Personal Data. Depending upon your choices, we may share limited data with select marketing partners for purposes of promoting our products and services to you on third-party properties. This is known as 'targeted advertising' or sharing for 'cross-context behavioral advertising' under certain state privacy laws. You can opt out using the marketing privacy control in your account settings. If you're not logged in, you can opt out within Settings > Data Controls on ChatGPT or using the Your Privacy Choices link on our website. You can also opt out using a legally recognized opt-out mechanism, like Global Privacy Control.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages CCPA and CPRA opt-out requirements for cross-context behavioral advertising, enforced by the California Privacy Protection Agency. Colorado, Connecticut, Virginia, and other states with enacted comprehensive privacy statutes have parallel targeted advertising opt-out requirements. The policy's explicit recognition of Global Privacy Control as a valid opt-out mechanism is consistent with CPRA regulatory guidance. The policy's disclaimer that it does not 'sell' personal data, combined with the cross-context behavioral advertising disclosure, requires evaluation under each applicable state's statutory definitions to confirm that the opt-out mechanism provided is sufficient under all relevant statutes. 2) GOVERNANCE EXPOSURE: Low to Medium. The provision is notable for its explicit acknowledgment of multiple opt-out mechanisms including Global Privacy Control, which reflects statutory compliance posture. However, the identity of the select marketing partners is not disclosed in the policy, and compliance teams may wish to evaluate whether applicable state statutes require more granular disclosure. 3) JURISDICTION FLAGS: California's CPRA requires that Global Privacy Control be honored as an opt-out signal, which the policy acknowledges. Colorado, Connecticut, and other states have similar requirements. EU and UK users are directed to a separate policy. The under-18 carve-out addresses COPPA and state minor data protection requirements by excluding this practice for known minors. 4) CONTRACT AND VENDOR IMPLICATIONS: The policy refers to 'select marketing partners' without further identification; procurement and vendor management teams may wish to request a list of such partners for due diligence purposes, particularly in enterprise deployment contexts where employee data may be subject to additional contractual restrictions. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the Global Privacy Control opt-out is technically implemented consistently with applicable regulatory guidance, and that the Your Privacy Choices link is accessible on all relevant web properties as required by applicable state statutes. Cookie notice alignment should be reviewed to confirm that the cross-context behavioral advertising opt-out covers all relevant data sharing mechanisms including those operating through cookies and similar technologies.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision directly engages state privacy law definitions of cross-context behavioral advertising and targeted advertising sharing, provides multiple opt-out pathways including recognition of Global Privacy Control, and discloses that this practice does not apply to users known to be under 18 years of age.
The agreement discloses that data is shared with select marketing partners for targeted advertising on third-party properties, characterized as cross-context behavioral advertising under applicable state law. Users can opt out through account settings, the Your Privacy Choices link, or Global Privacy Control, and the policy states that this practice does not apply to users known to be under 18.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.