The policy describes statutory privacy rights available to users depending on their jurisdiction, including access, rectification, deletion, restriction, portability, consent withdrawal, and the right to lodge a regulatory complaint, with requests submittable through privacy.openai.com or dsar@openai.com.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the procedural framework through which users can exercise data subject rights, with jurisdiction-dependent availability and a centralized submission pathway. The policy also addresses accuracy limitations of AI-generated outputs and provides a mechanism for requesting correction or removal of factually inaccurate information about a user.
The updated policy explicitly discloses that OpenAI receives information from advertisers and other data partners for Free and Go users, and uses this data to personalize ads and measure ad effectiveness. The policy now states that Free and Go users can control what data OpenAI uses to personalize ads through advertising controls in account settings. This represents clarified disclosure of an existing practice rather than a new authorization.
View change record →The updated privacy policy now explicitly states that OpenAI receives information from advertisers and other data partners, which is used to personalize ads shown to Free and Go users and to measure the effectiveness of those ads. For example, the policy notes that OpenAI could receive information about purchases users make from advertisers. The policy now includes a dedicated section on ad personalization and measurement as a primary use of personal data for these user tiers. You can manage what data OpenAI uses for ad personalization by accessing the advertising controls in your account settings or by using the Data Controls option.
View change record →The updated policy now explicitly authorizes OpenAI to promote products and services to users through direct marketing on third-party properties and to share limited information with select marketing partners (who are not service providers) to support these efforts. The policy states that some marketing partners may receive information through cookies and similar technologies. The revised terms establish that these marketing practices are subject to user choices and controls, with additional information and opt-out options available. You can make choices about the use of your information for third-party product promotion purposes through controls referenced in the policy.
View change record →Under this provision, users may submit requests to access, correct, delete, or export their personal data at privacy.openai.com or by emailing dsar@openai.com, with availability of specific rights depending on applicable law in the user's jurisdiction. The policy states that requests to correct factually inaccurate AI-generated information will be considered based on applicable law and the technical capabilities of OpenAI's models.
Cross-platform context
See how other platforms handle User Data Subject Rights and Exercise Mechanism and similar clauses.
Compare across platforms →"Depending on where you live, you may have certain statutory rights in relation to your Personal Data. For example, you may have the right to: Access your Personal Data and information relating to how it is processed. Rectify or update your Personal Data Delete your Personal Data from our records. Restrict how we process your Personal Data. Transfer your Personal Data to a third party (right to data portability). Withdraw your consent—where we rely on consent as the legal basis for processing. Lodge a complaint with your local data protection authority. You can exercise some of these rights through your OpenAI account using the tools described in the Data controls section, or you can submit your request through privacy.openai.com or to dsar@openai.com.Excerpt from OpenAI's Privacy Policy
(1) REGULATORY LANDSCAPE: The rights described correspond to CCPA and CPRA rights for California residents, and GDPR rights for EEA/UK users under the separate policy.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the procedural framework through which users can exercise data subject rights, with jurisdiction-dependent availability and a centralized submission pathway. The policy also addresses accuracy limitations of AI-generated outputs and provides a mechanism for requesting correction or removal of factually inaccurate information about a user.
Under this provision, users may submit requests to access, correct, delete, or export their personal data at privacy.openai.com or by emailing dsar@openai.com, with availability of specific rights depending on applicable law in the user's jurisdiction. The policy states that requests to correct factually inaccurate AI-generated information will be considered based on applicable law and the technical capabilities of OpenAI's models.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.