Query and Conversation Data Shared with Third-Party AI Model Providers

What it is

The policy authorizes Perplexity to share user query content and conversation history with external AI model providers in order to generate responses. These third-party providers may process the submitted content under their own terms.

Why it matters (compliance & governance perspective)

This provision establishes that sensitive user query content and conversation history are transmitted to third-party organizations beyond Perplexity, creating a data sharing chain that extends Perplexity's privacy obligations into downstream provider relationships. Compliance teams should assess whether adequate data processing agreements govern these transfers and whether the processing basis is sufficient under applicable law.

Consumer impact (what this means for users)

Under this clause, query content and conversation history submitted by users may be processed by third-party AI model providers, not solely by Perplexity. The specific identity and data handling practices of those third-party providers are not fully enumerated in the policy text reviewed.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles governing data controller and processor relationships and international data transfers, CCPA provisions on sharing personal information with service providers and third parties, and FTC Act standards on material disclosures to consumers. EU/EEA data transfers to third-party AI providers located outside the EEA require valid transfer mechanisms such as Standard Contractual Clauses. The enforcement authority in the EU is the lead supervisory authority under GDPR; the FTC has jurisdiction in the US. 2) GOVERNANCE EXPOSURE: High. The sharing of query content with third-party AI model providers creates complex data processing chain obligations. If the third-party providers use the data for their own model training or analytics, additional disclosure and consent obligations may arise. The policy does not enumerate specific third-party AI providers by name, limiting users' ability to assess downstream data handling. 3) JURISDICTION FLAGS: EU/EEA users face the highest exposure, as GDPR requires explicit lawful bases for data transfers to third countries and mandates data processing agreements with all processors. California users are protected by CCPA service provider restrictions. Healthcare or legal query content submitted by users could attract additional regulatory scrutiny in any jurisdiction. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should verify that data processing agreements with all third-party AI model providers are in place, covering purpose limitation, retention, security, and sub-processing restrictions. The policy's lack of named providers creates due diligence gaps for enterprise customers seeking to assess supply chain data risk. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain an updated list of third-party AI model providers, ensure DPAs or equivalent agreements are executed, and verify that transfer mechanisms are valid for cross-border flows. User-facing disclosures should be reviewed to confirm they satisfy GDPR transparency requirements regarding the identity of recipients.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• AI Model Training Data Use high
• Voice Audio Data Collection high
• Advertising Partner Data Sharing medium
• California Resident Privacy Rights medium
• EU/EEA User Rights and GDPR Disclosures medium
• Children's Data and Minimum Age medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.