The policy states that OpenRouter does not control or bear responsibility for how large language model providers handle user Inputs or Outputs transmitted through the Service, including potential use for model training by those providers.
This analysis describes what OpenRouter's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personal data or sensitive content embedded in user Inputs may be processed by third-party AI providers under terms and data practices that OpenRouter neither governs nor warrants, creating a compliance boundary that enterprise and regulated-industry customers should evaluate independently.
The updated policy raises the minimum age to use OpenRouter from 13 to 18 years old, meaning users under 18 are no longer eligible. For users who upload files through the Files API feature, the revised terms establish specific handling procedures: files are encrypted at rest and in transit, transmitted to model providers you select, retained until deletion or account closure, and not used for training or marketing purposes. The policy specifies that access is restricted to automated systems necessary to operate the service, and manual access occurs only for investigating violations, responding to legal process, or providing support. You can delete uploaded files at any time, which triggers removal efforts from active systems and backups within timeframes specified in the Data Processing Agreement.
View change record →Under this clause, users transmitting Inputs through OpenRouter's Service should be aware that those Inputs are governed by each individual AI provider's terms once routed, and that OpenRouter has disclaimed responsibility for downstream handling including model training use.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"We do not control, and are not responsible for, LLMs' handling of your Inputs or Outputs, including for use in their model training. To understand how your Inputs are used by AI models, check the terms of the providers here.Excerpt from OpenRouter's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR data processor and controller allocation obligations, as EU users' personal data embedded in Inputs may be transferred to third-party providers who act as independent controllers or sub-processors without clearly …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that personal data or sensitive content embedded in user Inputs may be processed by third-party AI providers under terms and data practices that OpenRouter neither governs nor warrants, creating a compliance boundary that enterprise and regulated-industry customers should evaluate independently.
Under this clause, users transmitting Inputs through OpenRouter's Service should be aware that those Inputs are governed by each individual AI provider's terms once routed, and that OpenRouter has disclaimed responsibility for downstream handling including model training use.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenRouter.