Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal data is processed on servers in the United States and other jurisdictions where OpenAI affiliates, partners, vendors, and service providers are located, and that data transfers are conducted pursuant to legally valid transfer mechanisms.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personal data may be transferred to and processed in the United States and other jurisdictions, and that OpenAI relies on legally valid transfer mechanisms; for users in the EU, UK, and Switzerland, this provision interacts with the separate regional policy version and applicable adequacy, standard contractual clause, or other transfer mechanism requirements.
Interpretive note: The specific transfer mechanisms relied upon for international data transfers are not identified in this US policy version, requiring reference to supplemental documentation or the EEA policy for full assessment.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →Under this provision, personal data submitted to OpenAI consumer Services may be processed and stored on servers in the United States and other countries where OpenAI's affiliates, vendors, and service providers operate. The policy states that legally valid transfer mechanisms are used for international data transfers, though the specific mechanisms employed are not identified in this US policy.
Cross-platform context
See how other platforms handle International Data Transfer and Processing and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"OpenAI processes your Personal Data for the purposes described in this policy on servers located in various jurisdictions, including processing and storing your Personal Data in our facilities and servers in the United States, or in countries or territories where our affiliates and partners or our vendors and service providers are located. While data protection law varies by country, we apply the protections described in this policy to your Personal Data regardless of where it is processed, and only transfer that data pursuant to legally valid transfer mechanisms.Excerpt from OpenAI's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V requirements for international data transfers from the EEA, enforced by EU supervisory authorities including the Irish Data Protection Commission as OpenAI Ireland Limited's lead authority. UK GDPR and Swiss data protection law impose parallel requirements. The policy states that legally valid transfer mechanisms are used but does not specify whether these are standard contractual clauses, binding corporate rules, or other mechanisms; the separate EEA policy may provide additional detail. US data localization requirements do not generally apply at the federal level but specific state or sector-specific rules may be relevant. 2) GOVERNANCE EXPOSURE: Medium. The failure to specify the transfer mechanisms employed in the US policy text means that compliance teams must consult the EEA policy and any supplemental documentation to assess whether applicable requirements are met. The Schrems II decision and subsequent EU-US Data Privacy Framework developments are relevant to the lawfulness of US transfers; compliance teams should confirm which framework applies to OpenAI's transfers. 3) JURISDICTION FLAGS: EEA, UK, and Swiss users are directed to a separate policy, suggesting that transfer mechanism documentation is addressed in those jurisdictions' versions. US-based multinational employers whose employees use OpenAI consumer Services should assess whether EU employee data may be transferred under terms that satisfy applicable EU and UK requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise and API customers should confirm through their customer agreements which transfer mechanisms govern their specific data flows, as the consumer policy's reference to legally valid mechanisms is not sufficient for procurement due diligence. Vendor assessment procedures should include a review of OpenAI's transfer mechanism documentation. 5) COMPLIANCE CONSIDERATIONS: Compliance teams subject to GDPR or UK GDPR should obtain and review OpenAI's transfer mechanism documentation rather than relying on the consumer policy's general statement. Data mapping updates should reflect that personal data processed through consumer Services may be stored and processed in the United States and unspecified other jurisdictions.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that personal data may be transferred to and processed in the United States and other jurisdictions, and that OpenAI relies on legally valid transfer mechanisms; for users in the EU, UK, and Switzerland, this provision interacts with the separate regional policy version and applicable adequacy, standard contractual clause, or other transfer mechanism requirements.
Under this provision, personal data submitted to OpenAI consumer Services may be processed and stored on servers in the United States and other countries where OpenAI's affiliates, vendors, and service providers operate. The policy states that legally valid transfer mechanisms are used for international data transfers, though the specific mechanisms employed are not identified in this US policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.