Windsurf uses your chat conversations to train its AI models by default. You can opt out, but doing so will remove your access to all Chat features, including Cascade.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The agreement conditions opt-out from AI model training on loss of Chat Service access entirely, meaning users cannot retain both privacy from model training and full service functionality simultaneously.
Users who want their Chat conversations excluded from AI training must give up access to Windsurf's Chat and Cascade features entirely. This creates a binary choice between data use consent and core service functionality.
How other platforms handle this
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, delete, or port your data. EU and UK users may also have the right to object to or restrict certain processing. California residents may have the right to know, delete, corre...
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may use your Chat User Content to improve the generative and discriminative machine learning models we use. Any Chat User Content used for training our machine learning models is anonymized, such that any personally identifiable information is removed. To opt out of having your Chat User Content used for such purpose, you may change the code sharing options in the User Settings pane of the user's profile page. Please note that if you opt out, you will not have access to Chat Services. "Chat User Content" mean User Content provided to the Service in the operation of the Cascade or Chat features.— Excerpt from Windsurf's Windsurf Terms of Service
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 7(4), which states that consent shall not be regarded as freely given if access to a service is conditional on consent to processing not necessary for that service. The CCPA provides California residents with the right to opt out of certain data uses without being denied service, though applicability depends on whether model training constitutes a 'sale' or 'sharing' under CCPA. The FTC may scrutinize conditioning service access on data training consent under unfair or deceptive practices authority. (2) GOVERNANCE EXPOSURE: High. The structure of this clause, conditioning full service functionality on data training consent, may not satisfy GDPR's freely-given consent standard for EU users. This creates material regulatory exposure for organizations deploying Windsurf in the EU or for EU-based users. The anonymization claim is asserted but not independently verifiable from the document text. (3) JURISDICTION FLAGS: EU and EEA users face the highest exposure, as GDPR Article 7(4) directly addresses consent conditioned on service access. California users should evaluate CCPA opt-out rights. Organizations in regulated industries (healthcare, finance, legal) where chat inputs may contain sensitive or privileged information face heightened risk regardless of jurisdiction. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should assess whether the default-on Chat training posture is acceptable for their data governance policies, and whether the ZDR (Zero Data Retention) option available to Pro Users adequately addresses organizational data use concerns. Vendor assessments should include verification of the anonymization process described in this clause. (5) COMPLIANCE CONSIDERATIONS: Legal teams should map what categories of data employees input via Chat features, assess whether that data constitutes personal data under GDPR or sensitive business information, and evaluate whether opt-out is operationally feasible given the resulting loss of Chat access. A consent mechanism audit should determine whether the current structure satisfies applicable legal standards in all jurisdictions where the product is deployed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The agreement conditions opt-out from AI model training on loss of Chat Service access entirely, meaning users cannot retain both privacy from model training and full service functionality simultaneously.
Users who want their Chat conversations excluded from AI training must give up access to Windsurf's Chat and Cascade features entirely. This creates a binary choice between data use consent and core service functionality.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.