Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Vercel may share de-identified AI product information, including chat prompts, uploaded images, and design or text generations, from Hobby and Pro plan users with external AI business partners for model training and product development purposes, subject to opt-out through team settings.
This analysis describes what Vercel AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes disclosure of de-identified AI product inputs to third-party AI business partners, creating a data flow that extends beyond Vercel's internal operations; compliance teams should evaluate whether the de-identification standard applied satisfies applicable law thresholds, particularly under GDPR and US state privacy laws where re-identification risk standards vary.
Interpretive note: The operational scope of this provision depends on whether user-generated AI inputs are classified as Customer Content subject to the data processor carve-out or as information collected directly by Vercel under this Notice; this distinction is not fully resolved in the document.
The updated policy establishes a new mechanism for resolving privacy disputes related to Data Privacy Framework transfers. Users in the EU, UK, and EEA who have unresolved privacy complaints can now submit them to VeraSafe for independent review, which will be conducted free of charge. Additionally, the policy introduces an explicit Right to Restriction, permitting users to request that Vercel limit processing of their personal information or restrict further disclosures in certain instances, particularly for sensitive information. You can file a complaint with VeraSafe by submitting required information at https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/.
View change record →Under this clause, Vercel may share de-identified versions of AI product inputs such as chat prompts and uploaded images from Hobby and Pro accounts with AI business partners for training purposes, unless the user opts out through Team Preferences settings in the Vercel dashboard.
Cross-platform context
See how other platforms handle AI Product Data Sharing for Model Training and similar clauses.
Compare across platforms →Monitoring
Vercel AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"For Hobby and Pro plan users, subject to your data preferences in your team settings, we may disclose de-identified information (including de-identified AI Product Information) to AI business partners for their product improvement and development, including training and improving AI and machine learning models, with the ultimate purpose of improving the Vercel Services you use.Excerpt from Vercel AI's SDK Privacy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 4 definitions of anonymization and pseudonymization, as European data protection authorities including the EDPB have issued guidance requiring high standards for data to be treated as truly anonymized and outside GDPR scope. Under CCPA and CPRA, de-identified data is subject to specific maintenance obligations including prohibitions on re-identification; the California Privacy Protection Agency oversees enforcement. EU AI Act obligations for AI system training data governance may also be relevant depending on how Vercel classifies its AI products. (2) GOVERNANCE EXPOSURE: Medium. The provision's reliance on de-identification as the basis for third-party AI model training disclosure creates compliance exposure contingent on whether the de-identification methodology meets applicable legal standards in relevant jurisdictions; if re-identification risk is not adequately addressed, this disclosure may constitute personal data processing subject to additional legal bases under GDPR or a 'sale' or 'sharing' under CCPA. (3) JURISDICTION FLAGS: EU and EEA users face the greatest exposure given GDPR's strict anonymization threshold; UK users are similarly affected under UK GDPR. California users should evaluate whether disclosed AI product information overlaps with categories subject to sensitive data restrictions under CPRA. The provision is limited by plan type to Hobby and Pro users, which narrows but does not eliminate enterprise exposure where accounts use these tiers. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should confirm through the Data Processing Addendum whether AI product inputs processed under their Customer account are covered by this provision or excluded as Customer Content subject to the data processor carve-out; the Notice's scope exclusion for processor activities creates ambiguity about whether end-user-generated AI inputs fall under this provision or the DPA. Vendor assessments should request Vercel's de-identification methodology documentation. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit whether existing consent mechanisms and privacy notices for end users of Customer-deployed applications adequately disclose potential downstream de-identified AI data sharing by Vercel; where GDPR applies, a legitimate interest or consent assessment may be required. Teams should confirm the Team Preferences opt-out mechanism is implemented and tested for all relevant accounts.
This provision authorizes disclosure of de-identified AI product inputs to third-party AI business partners, creating a data flow that extends beyond Vercel's internal operations; compliance teams should evaluate whether the de-identification standard applied satisfies applicable law thresholds, particularly under GDPR and US state privacy laws where re-identification risk standards vary.
Under this clause, Vercel may share de-identified versions of AI product inputs such as chat prompts and uploaded images from Hobby and Pro accounts with AI business partners for training purposes, unless the user opts out through Team Preferences settings in the Vercel dashboard.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Vercel AI.