Content License Grant

What it is

When you submit content to Stability AI's platform, such as prompts or uploaded images, you grant the company a license to use that content. The exact scope of this license, including whether it covers use for model training, is a key operational question this provision raises.

Why it matters (compliance & governance perspective)

The license granted over user-submitted content may extend beyond what is necessary to operate the service, and may interact with data subject rights under GDPR if submitted content contains personal data.

Consumer impact (what this means for users)

Users who submit prompts, images, or other content to Stability AI's services grant the company a license over that content. If submitted content includes personal data, users may retain rights under GDPR or CCPA to request deletion or object to processing, but the practical scope of those rights in this context depends on how the license is structured and whether applicable law limits its reach.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: A content license clause that covers user-submitted inputs engages GDPR Articles 5, 6, and 17 regarding lawful basis for processing, purpose limitation, and the right to erasure. The UK ICO and EU data protection authorities are the primary enforcement bodies. Where user inputs constitute personal data, the assertion of a broad license may interact with the requirement to identify a lawful basis for each processing purpose, including any use for model training. GOVERNANCE EXPOSURE: Medium. The primary exposure arises from uncertainty about whether the license extends to AI model training and whether personal data embedded in user submissions is processed in a manner consistent with GDPR obligations. No specific enforcement actions are cited here as the clause text was not fully available for review. JURISDICTION FLAGS: EU and UK users have the most significant exposure given GDPR and UK GDPR data subject rights. California residents may have rights under CCPA regarding the sale or sharing of personal information. The enforceability of a broad content license against EU consumers may be limited by mandatory consumer protection rules. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers and API integrators should assess whether a Data Processing Agreement is required under GDPR Article 28 for any user data submitted through their downstream applications. The license clause may also affect IP ownership of outputs derived from submitted content, which is a due diligence trigger for procurement teams. COMPLIANCE CONSIDERATIONS: Compliance teams should map what categories of data users are likely to submit, assess whether Stability AI's privacy policy identifies an adequate lawful basis for each processing purpose, and determine whether the license clause is compatible with data minimization and purpose limitation obligations. Where the platform is deployed in an enterprise context involving employee data, additional consent or legitimate interest assessments may be required.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Acceptable Use Policy medium
• Account Suspension and Termination high
• Liability Limitation medium
• Intellectual Property Ownership of Outputs medium
• Indemnification by User medium
• Governing Law and Dispute Resolution medium

Related Analysis

• Robinhood's Agreement Authorizes Position Liquidation Without Prior Notice

  Buried in Robinhood's customer agreement is broad authority to close your positions, suspend your account, and force arbitration. Here is what it actually says.

• Stripe's Reserve and Hold Authority: What the Terms Authorize

  Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business owners should review.