The DPA requires Customer to represent and warrant that all Personal Data provided to Perplexity was lawfully collected, that Customer holds all necessary consents and authorizations, and that Customer's actions do not render Perplexity's processing a Sale or Share under US Privacy Laws.
This analysis describes what Perplexity AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision shifts compliance responsibility for upstream data collection and lawful basis to Customer, and requires Customer to ensure that data sharing with Perplexity does not trigger Sale or Share classification under CCPA or equivalent US state laws, which would affect Perplexity's Service Provider status.
Business customers using Perplexity services are now governed by an updated DPA with two material operational changes. First, subprocessor disclosures have shifted from a static document attachment (Annex 2) to a live online list maintained at https://trust.perplexity.ai/subprocessors, with notifications of changes coming through in-product notification or email rather than through formal amendment. Second, certain Perplexity services (specifically Embeddings API and Perplexity Search) now operate under product-specific data postures and terms that control over the main DPA, meaning the data handling for those services may differ from the baseline agreement. Business customers should review the Trust Center list regularly and check for in-product notifications regarding subprocessor changes, as the updated terms no longer require static amendment cycles.
View change record →This addition shifts compliance burden to the customer by requiring representations that data collection and disclosure were lawful, providing Perplexity with contractual indemnification against misuse of customer-provided data.
View full change record →The agreement requires Customer to warrant that all Personal Data provided to Perplexity was collected and processed in compliance with applicable Privacy Laws and that Customer holds all necessary consents, placing responsibility for upstream data legality on the Customer.
Cross-platform context
See how other platforms handle Customer Obligations and Representations and similar clauses.
Compare across platforms →"Customer represents and warrants that (a) all Personal Data was collected and at all times processed and maintained by or on behalf of Customer in compliance with all Privacy Laws, including with respect to any obligations to provide notice to and/or obtain consent from individuals and (b) Customer has complied with Privacy Laws in (including having a lawful basis for), and otherwise has all necessary rights, permissions, consents and authorizations for, disclosing the Personal Data to Perplexity and enabling Perplexity to process the Personal Data as set out in the Agreement and this DPA. Customer shall not take any action that would render the provision of Personal Data to Perplexity hereunder a Sale or Share under US Privacy Laws or otherwise render Perplexity not a Service Provider or Processor under US Privacy Laws.Excerpt from Perplexity AI's Perplexity Data Processing Addendum
REGULATORY LANDSCAPE: This provision engages GDPR Article 28(3) (controller instruction requirements), CCPA Service Provider definitions, and equivalent US state law provisions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision shifts compliance responsibility for upstream data collection and lawful basis to Customer, and requires Customer to ensure that data sharing with Perplexity does not trigger Sale or Share classification under CCPA or equivalent US state laws, which would affect Perplexity's Service Provider status.
The agreement requires Customer to warrant that all Personal Data provided to Perplexity was collected and processed in compliance with applicable Privacy Laws and that Customer holds all necessary consents, placing responsibility for upstream data legality on the Customer.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Perplexity AI.