What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://privacy.openai.com', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': "Visit privacy.openai.com, select 'Delete my data' and follow the prompts to submit a verifiable deletion request for your personal information including conversation history.", 'deadline_days': None, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'The FTC has enforcement authority over unfair or deceptive collection and use of sensitive personal information including health data under FTC Act Section 5 and the Health Breach Notification Rule.', 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'HHS_OCR', 'reason': 'If health-related information shared in ChatGPT conversations constitutes PHI and OpenAI functions as a business associate, HHS OCR has HIPAA enforcement jurisdiction.', 'complaint_url': 'https://www.hhs.gov/ocr/complaints/index.html'}

What is the severity of this clause?

ConductAtlas classifies this Sensitive Personal Information Collection clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Do other platforms have similar clauses?

Yes. ConductAtlas has identified similar Sensitive Personal Information Collection clauses across approximately 7 other tracked platforms. You can compare how platforms differ on this clause type in the cross-platform comparison view.

Sensitive Personal Information Collection — OpenAI

Share 𝕏 Share in Share

What it is

OpenAI may collect sensitive personal information including health details, financial information, and other sensitive content that you type into ChatGPT conversations.

Consumer impact (what this means for users)

Sensitive personal information including health conditions, financial situations, and other private details shared in ChatGPT conversations is collected, retained, and potentially used for AI model training, with human reviewers at OpenAI having access to conversation content for safety and quality purposes.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data

Visit privacy.openai.com, select 'Delete my data' and follow the prompts to submit a verifiable deletion request for your personal information including conversation history.

Cross-platform context

See how other platforms handle Sensitive Personal Information Collection and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

Users often share sensitive health, financial, or personal information with ChatGPT without realizing it may be stored, reviewed by employees, and used for AI training — creating significant privacy risk for information that users may consider highly confidential.

View original clause language

We collect information you provide directly to us, such as when you create an account, submit or post content through our Services, communicate with us, or otherwise interact with us. The types of information we may collect include your name, email address, account credentials, payment card information, and any other information you choose to provide. Depending on your use of our Services, this may include health or medical information, information about your financial situation, or other sensitive details you share in conversations.

Institutional analysis (Compliance & legal intelligence)

(1) REGULATORY FRAMEWORK: This provision implicates CCPA/CPRA Cal. Civ. Code §1798.121 (right to limit use of sensitive personal information, defined in §1798.140(ae)); state biometric privacy laws including Illinois BIPA (740 ILCS 14) if voice data is processed; HIPAA 45 CFR §164.502 if any conversations contain PHI and OpenAI qualifies as a business associate; FTC Act Section 5 for inadequate disclosure of sensitive data collection practices; and potentially FERPA (20 U.S.C. §1232g) if students share educational records. The CPPA, FTC, HHS OCR, and state AGs are relevant enforcement authorities. (2)

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC has enforcement authority over unfair or deceptive collection and use of sensitive personal information including health data under FTC Act Section 5 and the Health Breach Notification Rule.
File a complaint →
Hhs Ocr

If health-related information shared in ChatGPT conversations constitutes PHI and OpenAI functions as a business associate, HHS OCR has HIPAA enforcement jurisdiction.
File a complaint →

Provision details

Document information

Document

OpenAI Privacy Policy

Entity

OpenAI

Document last updated

March 24, 2026

Tracking information

First tracked

April 27, 2026

Last verified

April 27, 2026

Record ID

CA-P-003158

Document ID

CA-D-00010

Evidence Provenance

Source URL

https://openai.com/policies/privacy-policy

Wayback Machine

View archived versions →

SHA-256

8d0fc75b2591d6a033bfeb50a1e7b57bb62cb682a52fcbbd714621617a7525af

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: OpenAI | Document: OpenAI Privacy Policy | Record: CA-P-003158
Captured: 2026-04-27 09:30:04 UTC | SHA-256: 8d0fc75b2591d6a0…
URL: https://conductatlas.com/platform/openai/openai-privacy-policy/sensitive-personal-information-collection/
Accessed: April 29, 2026

Classification

Severity

High

Sensitive Personal Information Collection