Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Unless a user opts out, the agreement grants Upwork an irrevocable, perpetual, royalty-free, worldwide license to use all content exchanged on the platform, including work product owned by the user under a service contract, to train AI models for platform personalization. This license is stated to survive account termination with respect to content exchanged prior to termination.
This analysis describes what Upwork's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a perpetual and irrevocable license over user-generated content and work product for AI training purposes that continues after account closure, and legal teams should evaluate whether the opt-out framing satisfies GDPR lawful basis requirements and whether the scope of the license as applied to third-party work product creates intellectual property exposure for users who incorporate client-owned or licensed material.
Interpretive note: Whether the opt-out default satisfies GDPR lawful basis requirements or CPRA consent standards depends on regulatory interpretation and applicable supervisory authority guidance.
The updated terms establish that when clients fund, release, or pay bonuses for multiple milestones in a single transaction session (a 'Bulk Payment Action'), each transaction is treated as a separate, independent, and irrevocable authorization to Payment Escrow. The revised language explicitly states that each transaction receives its own unique transaction identifier, is independently recorded in transaction history, is subject to its own service fees, and is independently subject to dispute assistance rights. Clients must review and confirm all individual transactions before submitting a bulk action. Additionally, the updated Fee and ACH Authorization Agreement states that unused ACH payment methods will be inactivated after 24 months of non-use, with advance notification provided.
View change record →The updated terms establish a new beta feature allowing invited users to connect third-party AI agents to their Upwork accounts. Agents can read information and draft communications (proposals, job posts, messages) without per-action confirmation, but cannot autonomously move money or finalize contracts; those actions require the user to authenticate and confirm on Upwork directly. Users are responsible for all agent actions and must ensure agent-generated content carries mandatory disclosure labels; submitting proposals through agents consumes Connects and incurs fees regardless of whether the user approves the draft-confirm action. You can revoke agent access by visiting the App Authorization page, and these beta terms apply only until you accept replacement terms.
View change record →Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
View change record →Under this clause, content exchanged on the platform, including job posts, proposals, communications, and work product, may be used to train AI models unless the user has opted out via the site setting, and this use is stated to continue with respect to previously exchanged content even after account termination.
Cross-platform context
See how other platforms handle AI Training License for User Content and similar clauses.
Compare across platforms →Monitoring
Upwork has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Unless you opt-out on the Site, you agree to grant Upwork an irrevocable, perpetual, non-exclusive, royalty-free, and worldwide license to use all User Content that you send or receive through the Upwork platform, including Work Product that you own or come to own under a Service Contract, to improve AI models exclusively provided to personalize your Upwork experience, for any other AI-related uses consistent with preferences you set or control, or as otherwise outlined in Upwork's Privacy Policy. Termination of this Agreement by either you or Upwork does not terminate or otherwise affect Upwork's license with respect to User Content, including Work Product, that you exchanged through the Upwork platform prior to termination.Excerpt from Upwork's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles 6 and 9 regarding lawful basis for processing, Article 13 regarding transparency at the point of data collection, and Article 17 regarding the right to erasure, insofar as the stated irrevocable and perpetual nature of the license may be in tension with erasure rights; it also implicates CCPA and CPRA regarding whether AI training constitutes a secondary use of personal data requiring disclosure or opt-in consent. The relevant enforcement authorities are EU data protection supervisory authorities, the UK ICO, the California Privacy Protection Agency, and the FTC. (2) GOVERNANCE EXPOSURE: High. The irrevocable and perpetual nature of the AI training license, combined with its application to work product that may contain third-party intellectual property or personal data of individuals other than the account holder, creates layered compliance exposure across data protection and intellectual property frameworks; the opt-out framing rather than opt-in may not satisfy GDPR consent or legitimate interests standards depending on how the processing is characterized by supervising authorities. (3) JURISDICTION FLAGS: EU and EEA users face heightened exposure because GDPR may require a specific lawful basis such as explicit consent or documented legitimate interests for AI model training use of personal data, and the opt-out default may not satisfy those requirements; California users may have rights under CPRA to limit use of personal information for cross-context behavioral purposes that overlap with AI personalization training; UK users face similar considerations under UK GDPR. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise clients and agencies that use Upwork should assess whether work product submitted through the platform on behalf of their own clients may be included in training data without those clients' consent; procurement teams should review whether the Global Data Processing Agreement covers AI training use as a distinct processing activity and whether controller-processor obligations are adequately allocated. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether Upwork's opt-out mechanism is sufficiently prominent and documented to support a legitimate interests basis under GDPR; they should map which categories of work product are in scope for AI training, assess whether data subject rights requests including erasure can be honored given the irrevocable license language, and evaluate whether contractual indemnification obligations on users for third-party IP claims are proportionate and insurable.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a perpetual and irrevocable license over user-generated content and work product for AI training purposes that continues after account closure, and legal teams should evaluate whether the opt-out framing satisfies GDPR lawful basis requirements and whether the scope of the license as applied to third-party work product creates intellectual property exposure for users who incorporate client-owned or …
Under this clause, content exchanged on the platform, including job posts, proposals, communications, and work product, may be used to train AI models unless the user has opted out via the site setting, and this use is stated to continue with respect to previously exchanged content even after account termination.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Upwork.