OpenAI Usage Policies

OpenAI's Usage Policies, updated October 29, 2025, define what users and developers may and may not do when using OpenAI products and services. The terms explicitly prohibit a range of activities including real-time remote biometric identification in public spaces, automation of high-stakes decisions in financial, medical, legal, and law enforcement contexts without human review, creation of facial recognition databases without data subject consent, and any use involving child sexual abuse material. The policy also states that violating or circumventing its rules and safeguards may result in loss of access to OpenAI systems or other unspecified penalties, and that users may appeal enforcement decisions.

This document establishes OpenAI's Usage Policies, effective October 29, 2025, governing permissible and prohibited uses of OpenAI products and services across all user categories. The agreement states that users must not use OpenAI services for enumerated prohibited activities including threats, harassment, weapons development, biometric identification in public spaces, CSAM, academic dishonesty, and automation of high-stakes decisions in sensitive areas without human review; the terms also reserve OpenAI's right to withhold access where it reasonably believes such action necessary to protect its service, users, or third parties. The policy's prohibition on automation of high-stakes decisions across domains including financial activities, law enforcement, medical services, and national security without human review, and its explicit prohibition on real-time remote biometric identification in public spaces, reflect alignment with regulatory postures adopted under the EU AI Act and related frameworks, though the terms do not specify how 'human review' is defined or what threshold satisfies that requirement. The policy engages regulatory frameworks including the EU AI Act, GDPR, COPPA, and FTC Act, given its provisions on biometric data, minor protections, privacy aggregation prohibitions, and consumer-facing deception restrictions; applicability of specific regulatory obligations depends on jurisdiction, user category, and the nature of the downstream application built on OpenAI services. Compliance teams operating in the EU or California should evaluate how these use restrictions interact with operator-level obligations under the EU AI Act's prohibited practices provisions and CCPA data minimization principles.

The agreement establishes a set of prohibited use categories that apply to all users of OpenAI services, including restrictions on using the services for harassment, biometric profiling, manipulation, academic dishonesty, and automation of decisions in sensitive domains such as employment, credit, and healthcare without human review. Under these terms, users who violate or circumvent the stated policies may lose access to OpenAI systems or face other penalties as determined by OpenAI. The document states that users may appeal enforcement decisions if they believe a policy enforcement action was made in error.