This US policy version is dated September 10, 2026
The page shows the policy as updated on September 10, 2026 and links to a previous version. The supplied text does not say what changed from that earlier version.
Supporting quotations
Updated: September 10, 2026
Qualifications & exceptions
This analysis covers only the version dated September 10, 2026.
Not stated here
The previous version is linked but its text is not supplied here, so what changed is unknown.
Legal Rights & Agreement Rules · Restriction or exception
Content processed for business customers, such as the API, is outside this policy
The policy does not apply to content that OpenAI processes on behalf of customers of its business offerings, with the API given as an example. For that data, OpenAI's use is governed by its customer agreements for those offerings instead. Other sections of this policy still describe some business-account situations, such as administrators of a ChatGPT Enterprise or business account being able to access your Content, so the exclusion is for content processed on behalf of business customers and not for every business-related account.
Supporting quotations
This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our API.
Our use of that data is governed by our customer agreements covering access to and use of those offerings.
Qualifications & exceptions
Applies to content processed on behalf of customers of business offerings.
The API is an example, not a complete list of business offerings.
Not stated here
The customer agreements that govern this data are not supplied.
The policy does not define which products other than the API are business offerings.
People in the EEA, UK and Switzerland are pointed to a separate privacy policy
This US policy tells individuals in the European Economic Area, the United Kingdom and Switzerland that they can read a separate version of the Privacy Policy. The sentence offers that version to them; by itself it does not say this US policy stops applying to them. A later section of this policy names controllers by where you live, including the EEA and Switzerland.
Supporting quotations
For individuals in the European Economic Area, United Kingdom, and Switzerland, you can read
Qualifications & exceptions
Region named: European Economic Area, United Kingdom and Switzerland.
Not stated here
The separate EU version is linked but not supplied, so how it differs from this policy is unknown.
The sentence does not say whether this US policy still applies to people in those regions.
A table gives extra disclosures for U.S. state privacy laws and cross-refers to the earlier sections
Because some U.S. state privacy laws require specific disclosures, this section adds a table with information about the categories of Personal Data OpenAI collects and how it uses and discloses them. It points back to the earlier sections on collection, use, disclosure and retention for more detail. The table summarizes those sections; it does not replace them.
Supporting quotations
9. Additional U.S. state disclosures
require specific disclosures. The following table provides additional information about the categories of Personal Data we collect and how we use and disclose that information.
Qualifications & exceptions
The text describes the table as additional information for U.S. state privacy law disclosures; it does not name particular states or laws.
Not stated here
The linked help article on state privacy laws is not supplied.
Legal Rights & Agreement Rules · Context
The state disclosures table is one row of three lists: categories collected, purposes, and disclosures
The table has three columns: Category of Personal Data, Use of Personal Data and Disclosure of Personal Data. Its single body row holds a list in each column: the categories OpenAI says it collects, the purposes for which it uses this information, and the circumstances in which it may disclose it. The table does not pair individual categories with individual purposes or recipients, so no purpose or recipient can be read as applying to one category only. Each column should be read as a list that applies to the information as a whole.
Supporting quotations
Category of Personal Data
Use of Personal Data
Disclosure of Personal Data
Qualifications & exceptions
One header row and one body row, three columns.
Items in a column are not matched to items in other columns.
Not stated here
Because the table is not matched row by row, it does not show which category goes to which recipient or purpose.
Legal Rights & Agreement Rules · Company practice
OpenAI may update the policy and will publish the new version and date on the page, unless the law requires other notice
OpenAI may update the policy from time to time. When it does, it says it will publish an updated version and effective date on the page, unless another type of notice is required by applicable law. The sentence does not promise direct notice such as an email for changes the law does not require notice of.
Supporting quotations
We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.
Qualifications & exceptions
Notice is publication on the page unless applicable law requires another type of notice.
Not stated here
The policy does not say how far in advance changes take effect.
Legal Rights & Agreement Rules · Context
The controller is OpenAI Ireland Limited for EEA and Swiss residents, and OpenAI OpCo, LLC for everyone else
If you live in the European Economic Area or Switzerland, OpenAI Ireland Limited, in Dublin, is the controller responsible for processing your Personal Data as described in this policy. If you live anywhere else, OpenAI OpCo, LLC, in San Francisco, California, is the controller. This section names EEA and Switzerland in the first sentence, while the opening of this US policy directs the EEA, UK and Switzerland to a separate version; the UK is not named in either controller sentence.
Supporting quotations
If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy.
If you live anywhere else, OpenAI OpCo, LLC, with its registered office at 1455 Third Street, San Francisco, California 94158, United States, is the controller and is responsible for the processing of your Personal Data as described in this policy.
Qualifications & exceptions
Controller depends on where you live.
The opening of the policy points EEA, UK and Switzerland residents to a separate version; the controller section is part of this version.
Not stated here
The separate EU version is not supplied, so how it assigns controllers is unknown.
The text does not say which sentence applies to people in the UK.
Legal Rights & Agreement Rules · Context
Linked resources include a privacy portal and a separate Health Privacy Notice, which are not supplied
The policy ends with a list of useful resources: a help article on how your data is used to improve model performance, a Data Controls FAQ, a privacy portal, a Memories FAQ, a Voice Mode FAQ and a Health Privacy Notice. The linked pages, including the separate Health Privacy Notice, are not part of the supplied text, so how they apply to your data is unknown.
Supporting quotations
How your data is used to improve model performance
Privacy Portal
Health Privacy Notice
Qualifications & exceptions
Links are provided as resources; the policy does not say these documents form part of the policy.
Not stated here
None of the linked documents are supplied, including the Health Privacy Notice.