The policy states that OpenRouter does not control or bear responsibility for how large language model providers handle user Inputs or Outputs transmitted through the Service, including potential use for model training by those providers.
This analysis describes what OpenRouter's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personal data or sensitive content embedded in user Inputs may be processed by third-party AI providers under terms and data practices that OpenRouter neither governs nor warrants, creating a compliance boundary that enterprise and regulated-industry customers should evaluate independently.
Provision name changed from 'Disclaimer of Responsibility for LLM Provider Handling of User Inputs' to 'Disclaimer of Responsibility for Third-Party AI Provider Data Handling'; content remains identical.
View full change record →Under this clause, users transmitting Inputs through OpenRouter's Service should be aware that those Inputs are governed by each individual AI provider's terms once routed, and that OpenRouter has disclaimed responsibility for downstream handling including model training use.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"We do not control, and are not responsible for, LLMs' handling of your Inputs or Outputs, including for use in their model training. To understand how your Inputs are used by AI models, check the terms of the providers here.Excerpt from OpenRouter's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR data processor and controller allocation obligations, as EU users' personal data embedded in Inputs may be transferred to third-party providers who act as independent controllers or sub-processors without clearly …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that personal data or sensitive content embedded in user Inputs may be processed by third-party AI providers under terms and data practices that OpenRouter neither governs nor warrants, creating a compliance boundary that enterprise and regulated-industry customers should evaluate independently.
Under this clause, users transmitting Inputs through OpenRouter's Service should be aware that those Inputs are governed by each individual AI provider's terms once routed, and that OpenRouter has disclaimed responsibility for downstream handling including model training use.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenRouter.