Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy prohibits using OpenAI services to aggregate, monitor, profile, or distribute individuals' private or sensitive information without authorization, and specifically prohibits emotion inference in workplace and educational settings (with a medical or safety exception) and criminal risk prediction based on personal traits or profiling.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision prohibits emotion inference in workplace and educational contexts and criminal risk prediction based on personal traits, both of which are among the prohibited AI practices enumerated in the EU AI Act, creating a policy-level alignment with that regulation that developers and enterprise customers must independently evaluate for legal compliance.
Interpretive note: The exception for emotion inference 'when necessary for medical or safety reasons' is not defined in the policy, and the qualifier 'solely' in the criminal risk prediction prohibition may require legal interpretation for systems using multiple data inputs.
This provision establishes that OpenAI services may not be used to build systems that infer emotions in workplace or educational settings (outside medical or safety contexts), predict criminal risk from personal traits or profiling, or aggregate and distribute individuals' private information without their authorization.
Cross-platform context
See how other platforms handle Prohibition on Privacy Aggregation and Profiling and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Respect privacy. People are entitled to privacy. So, we don't allow attempts to compromise the privacy of others, including to aggregate, monitor, profile, or distribute individuals' private or sensitive information without their authorization. And, you may never use our services for: facial recognition databases without data subject consent real-time remote biometric identification in public spaces use of someone's likeness, including their photorealistic image or voice, without their consent in ways that could confuse authenticity evaluation or classification of individuals based on their social behavior, personal traits, or biometric data (including social scoring, profiling, or inferring sensitive attributes) inference regarding an individual's emotions in the workplace and educational settings, except when necessary for medical or safety reasons assessment or prediction of the risk of an individual committing a criminal offense based solely on their personal traits or on profilingExcerpt from OpenAI's Usage Policies
(1) REGULATORY LANDSCAPE: This provision engages GDPR provisions on processing sensitive personal data and special categories, the EU AI Act's prohibited practices provisions relating to emotion recognition and criminal risk prediction, and the FTC Act's framework for unfair data practices. In the US, use of AI for criminal risk prediction engages civil rights frameworks including the Equal Protection Clause and Title VII in employment contexts. Relevant enforcement authorities include the EU AI Office, national data protection authorities, and the FTC. (2) GOVERNANCE EXPOSURE: High. The prohibition on emotion inference in workplace and educational settings mirrors an EU AI Act prohibited practice. The exception for 'medical or safety reasons' is not defined in the policy, creating interpretive uncertainty for developers building applications in those adjacent domains. The prohibition on criminal risk prediction 'based solely on personal traits or on profiling' uses qualified language ('solely') that may require legal interpretation for systems using multiple input types. (3) JURISDICTION FLAGS: EU and EEA operators face direct exposure under the EU AI Act for any application involving emotion recognition or criminal risk assessment. Illinois BIPA and Washington's My Health MY Data Act create additional state-level obligations for systems processing biometric or health-adjacent data. Applications involving employment screening face heightened regulatory scrutiny in the US under EEOC guidance on AI-based hiring tools. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers using OpenAI services for any HR, educational, or public safety application should conduct a use-case review against this provision. The policy does not specify what technical controls OpenAI implements to prevent prohibited profiling use cases at the API level, meaning contractual compliance responsibility rests with the operator. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether any internal or customer-facing applications using OpenAI services involve emotion inference, behavioral profiling, or individual risk scoring. For EU operations, a Data Protection Impact Assessment may be required under GDPR for any system processing behavioral or biometric signals. Legal teams should define the scope of the medical or safety exception internally before relying on it to justify emotion inference applications.
This provision prohibits emotion inference in workplace and educational contexts and criminal risk prediction based on personal traits, both of which are among the prohibited AI practices enumerated in the EU AI Act, creating a policy-level alignment with that regulation that developers and enterprise customers must independently evaluate for legal compliance.
This provision establishes that OpenAI services may not be used to build systems that infer emotions in workplace or educational settings (outside medical or safety contexts), predict criminal risk from personal traits or profiling, or aggregate and distribute individuals' private information without their authorization.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.