Windsurf uses your chat conversations to train its AI models by default. You can opt out, but doing so will remove your access to all Chat features, including Cascade.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The agreement conditions opt-out from AI model training on loss of Chat Service access entirely, meaning users cannot retain both privacy from model training and full service functionality simultaneously.
Users who want their Chat conversations excluded from AI training must give up access to Windsurf's Chat and Cascade features entirely. This creates a binary choice between data use consent and core service functionality.
How other platforms handle this
We may use the content you provide to us, including prompts and generated images, to train and improve our AI models and services.
After registration, you may create, upload or transmit files, documents, videos, images, data or information as part of your use of the Service (collectively, "User Content"). This includes any inputs you provide to our AI-powered support tools and outputs generated in response to your inputs. User ...
When you use AI features of the Services, you acknowledge that your inputs may be processed by third-party AI providers. ClickUp may use anonymized and aggregated data derived from your use of the Services to improve and train AI models and features.
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We may use your Chat User Content to improve the generative and discriminative machine learning models we use. Any Chat User Content used for training our machine learning models is anonymized, such that any personally identifiable information is removed. To opt out of having your Chat User Content used for such purpose, you may change the code sharing options in the User Settings pane of the user's profile page. Please note that if you opt out, you will not have access to Chat Services. "Chat User Content" mean User Content provided to the Service in the operation of the Cascade or Chat features.— Excerpt from Windsurf's Windsurf Terms of Service
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 7(4), which states that consent shall not be regarded as freely given if access to a service is conditional on consent to processing not necessary for that service. The CCPA provides California residents with the right to opt out of certain data uses without being denied service, though applicability depends on whether model training constitutes a 'sale' or 'sharing' under CCPA. The FTC may scrutinize conditioning service access on data training consent under unfair or deceptive practices authority. (2) GOVERNANCE EXPOSURE: High. The structure of this clause, conditioning full service functionality on data training consent, may not satisfy GDPR's freely-given consent standard for EU users. This creates material regulatory exposure for organizations deploying Windsurf in the EU or for EU-based users. The anonymization claim is asserted but not independently verifiable from the document text. (3) JURISDICTION FLAGS: EU and EEA users face the highest exposure, as GDPR Article 7(4) directly addresses consent conditioned on service access. California users should evaluate CCPA opt-out rights. Organizations in regulated industries (healthcare, finance, legal) where chat inputs may contain sensitive or privileged information face heightened risk regardless of jurisdiction. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should assess whether the default-on Chat training posture is acceptable for their data governance policies, and whether the ZDR (Zero Data Retention) option available to Pro Users adequately addresses organizational data use concerns. Vendor assessments should include verification of the anonymization process described in this clause. (5) COMPLIANCE CONSIDERATIONS: Legal teams should map what categories of data employees input via Chat features, assess whether that data constitutes personal data under GDPR or sensitive business information, and evaluate whether opt-out is operationally feasible given the resulting loss of Chat access. A consent mechanism audit should determine whether the current structure satisfies applicable legal standards in all jurisdictions where the product is deployed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
How 10 AI platforms describe the use of user data for model training, improvement, and development, based on archived governance provisions.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The agreement conditions opt-out from AI model training on loss of Chat Service access entirely, meaning users cannot retain both privacy from model training and full service functionality simultaneously.
Users who want their Chat conversations excluded from AI training must give up access to Windsurf's Chat and Cascade features entirely. This creates a binary choice between data use consent and core service functionality.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.