This US policy version is dated September 10, 2026
The page shows the policy as updated on September 10, 2026 and links to a previous version. The supplied text does not say what changed from that earlier version.
Supporting quotations
Updated: September 10, 2026
Qualifications & exceptions
This analysis covers only the version dated September 10, 2026.
Not stated here
The previous version is linked but its text is not supplied here, so what changed is unknown.
Use & Processing · Context
The policy covers personal data from your use of OpenAI's website, apps and services
This US privacy policy describes OpenAI's practices for personal data it collects from or about you, and how it uses that data, when you use its website, applications and services, which the policy calls the "Services". "OpenAI", "we", "our" and "us" include OpenAI's affiliates, so the policy speaks for the group and not only one company. The opening text names ChatGPT as an example tool but defines Services broadly.
Supporting quotations
This Privacy Policy describes our practices with respect to personal data that we collect from or about you, and how we use it when you use our website, applications, and services (collectively, “Services”).
We at OpenAI (together with our affiliates, “OpenAI”, “we”, “our” or “us”)
Qualifications & exceptions
"OpenAI", "we", "our" and "us" cover OpenAI together with its affiliates.
"Services" collectively means the website, applications and services.
Not stated here
The policy does not list which specific products count as Services beyond the examples given.
Security & Safeguards · Company commitment
OpenAI states a general commitment to respect privacy and keep information secure
OpenAI says it is committed to respecting your privacy and strongly committed to keeping secure any information it obtains from or about you. This is a general statement of intent; the specific protections and their limits are described in the Security section of the policy.
Supporting quotations
are committed to respecting your privacy and are strongly committed to keeping secure any information we obtain from you or about you
Qualifications & exceptions
General statement of commitment; concrete measures and their limits appear in section 8 (Security).
Not stated here
This sentence does not itself describe a specific measure or remedy.
Legal Rights & Agreement Rules · Restriction or exception
Content processed for business customers, such as the API, is outside this policy
The policy does not apply to content that OpenAI processes on behalf of customers of its business offerings, with the API given as an example. For that data, OpenAI's use is governed by its customer agreements for those offerings instead. Other sections of this policy still describe some business-account situations, such as administrators of a ChatGPT Enterprise or business account being able to access your Content, so the exclusion is for content processed on behalf of business customers and not for every business-related account.
Supporting quotations
This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings, such as our API.
Our use of that data is governed by our customer agreements covering access to and use of those offerings.
Qualifications & exceptions
Applies to content processed on behalf of customers of business offerings.
The API is an example, not a complete list of business offerings.
Not stated here
The customer agreements that govern this data are not supplied.
The policy does not define which products other than the API are business offerings.
People in the EEA, UK and Switzerland are pointed to a separate privacy policy
This US policy tells individuals in the European Economic Area, the United Kingdom and Switzerland that they can read a separate version of the Privacy Policy. The sentence offers that version to them; by itself it does not say this US policy stops applying to them. A later section of this policy names controllers by where you live, including the EEA and Switzerland.
Supporting quotations
For individuals in the European Economic Area, United Kingdom, and Switzerland, you can read
Qualifications & exceptions
Region named: European Economic Area, United Kingdom and Switzerland.
Not stated here
The separate EU version is linked but not supplied, so how it differs from this policy is unknown.
The sentence does not say whether this US policy still applies to people in those regions.
Training details and choices are in a separate help article, plus statements in this policy
For how OpenAI collects and uses training information to develop its language models, and the choices people have, the policy points readers to this policy and to a linked help center article, which is not supplied here. This policy itself says OpenAI collects publicly available internet information to develop the models that power its Services, and that it may use Content you provide to improve the Services, for example to train the models that power ChatGPT, with linked instructions for opting out of that use of your Content.
Supporting quotations
For information about how we collect and use training information to develop our language models that power ChatGPT and other Services, and your choices with respect to that information, please see this policy as well as
We also collect information from other sources, like information that is publicly available on the internet, to develop the models that power our Services.
we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT
on how you can opt out of our use of your Content to train our models
Qualifications & exceptions
The opt-out described applies to OpenAI's use of your Content to train its models, per the linked instructions.
Information collected from the public internet for model development is separate from Content you provide.
Not stated here
The help center articles are linked but not supplied, so the detail of training sources and the opt-out steps is unknown.
The policy does not say here whether the opt-out covers publicly collected internet information.
Data Access & Collection · Context
OpenAI collects personal data you provide, data from your use, and data from other sources
Section 1 defines "Personal Data" as personal data relating to you that OpenAI collects in three ways: data you provide when you create an account or communicate with OpenAI, data OpenAI receives when you visit, use or interact with the Services, and information from other sources. The detailed cards that follow describe each type.
Supporting quotations
We collect personal data relating to you (“Personal Data”) as follows:
We collect Personal Data if you create an account to use our Services or communicate with us as follows:
When you visit, use, or interact with the Services, we receive the following information about your visit, use, or interactions:
Qualifications & exceptions
"Personal Data" in this policy means personal data relating to you that is collected as the section describes.
Data Access & Collection · Company practice
Creating an account means OpenAI collects your name, contact details, credentials, birth date and payment information
When you create an account, OpenAI collects account information including your name, contact information, account credentials, date of birth, payment information and transaction history, which the policy calls "Account Information". Some Services may also let you upload a profile picture, a username or other information as part of that Account Information.
Supporting quotations
When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, date of birth, payment information, and transaction history, (collectively, “Account Information”).
Qualifications & exceptions
Some Services only: profile picture, username or other information may be uploaded as part of Account Information.
Not stated here
The list says "including", so it may not be exhaustive.
Data Access & Collection · Company practice
Your prompts, uploads and interactions with other users are collected as Content
OpenAI collects the personal data you provide as input to the Services, which the policy calls "Content". That includes your prompts and other content you upload, such as files, images, audio and video, and data from connected services, depending on the features you use. If a Service lets you interact with other users by posting, commenting or sending messages, those interactions are also treated as Content. Later sections say how Content can be used, for example to improve models, and how you can control that.
Supporting quotations
We collect Personal Data that you provide in the input to our Services (“Content”), including your prompts and other content you upload, such as
depending on the features you use
Some of our Services allow you to interact with other users, such as post, comment, or send messages, and we treat those interactions as Content, too.
Qualifications & exceptions
What is collected depends on the features you use.
Interactions with other users are Content only in Services that allow them.
Not stated here
Which connected services and features exist is described only in linked help articles that are not supplied.
Messages you send to OpenAI, including by email or social media, are collected
If you communicate with OpenAI, for example by email or through its pages on social media sites, OpenAI may collect personal data such as your name, contact information and the contents of the messages you send. The policy calls this "Communication Information".
Supporting quotations
If you communicate with us, such as via email or our pages on social media sites, we may collect Personal Data like your name, contact information, and the contents of the messages you send (“Communication Information”).
Qualifications & exceptions
Applies when you communicate with OpenAI; the verb is "may collect".
Data Access & Collection · Company practice
If you connect your device contacts, OpenAI uploads your address book and checks which contacts use its Services
This applies only if you choose to connect your device contacts. OpenAI then uploads information from your device address books and checks which of your contacts also use the Services. For contacts who are not yet using the Services, OpenAI says it will update you if they sign up later. This involves personal data about other people from your address book, including people who do not use the Services; how OpenAI uses the uploaded information of non-users is explained only in a linked help article.
Supporting quotations
If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services.
If any of your contacts aren’t yet using our Services, we’ll update you if they sign up for our Services later.
Qualifications & exceptions
Only if you choose to connect your device contacts.
Not stated here
The linked help article on how uploaded contact information of non-users is used is not supplied.
The policy does not say here how long uploaded contact data is kept or whether contacts are notified.
Data Access & Collection · Company practice
Event, survey and identity or age verification information you provide is collected
OpenAI collects other information you provide, such as when you take part in its events or surveys, or when you give OpenAI, or a vendor working on its behalf, information to establish your identity or age. The policy groups this as "Other Information You Provide".
Supporting quotations
We collect other information that you provide to us, such as when you participate in our events or surveys, or when you provide us or a vendor operating on our behalf with information to establish your identity or age (collectively, “Other Information You Provide”).
Qualifications & exceptions
Identity or age information may be given to a vendor operating on OpenAI's behalf.
Not stated here
The policy does not say here what identity or age evidence may be requested.
Data Access & Collection · Company practice
Browser and device information is collected automatically when you use the Services
OpenAI collects log data that your browser or device sends automatically, including your IP address, browser type and settings, the date and time of requests, and how you interact with the Services. It also collects device information such as the device name, operating system, device identifiers and browser, and what is collected depends on the device type and its settings.
Supporting quotations
We collect information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services.
We collect information about the device you use to access the Services, such as the name of the device, operating system, device identifiers, and browser you are using. Information collected depends on the type of device you use and its settings.
Qualifications & exceptions
Device information collected depends on the type of device and its settings.
Data Access & Collection · Company practice
Usage data covers your activity and feedback; Free and Go users also have ad history and interests collected
OpenAI collects information about your use and activity across the Services, such as the content you view or engage with, features you use and actions you take, feedback you give on a model response, people you interact with, and technical details like time zone, country, access times, user agent and device type. For Free and Go users only, OpenAI also collects information about your ads history and interests, such as the types of ad content you view or engage with. If you use the in-app browser, OpenAI may also collect your browser data according to your controls and your use of the service.
Supporting quotations
We collect information about your use and activity across the Services, such as the types of content that you view or engage with, the features you use and the actions you take, when you submit feedback to a model response, the people with whom you interact, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection.
users, we also collect information about your ads history and interests, such as the types of ad content that you view or engage with.
If you use the in-app browser we may also collect your browser data according to your controls and use of the service.
Qualifications & exceptions
Ads history and interests are stated for Free and Go users only.
In-app browser data is collected "according to your controls and use of the service".
Not stated here
The policy does not say what in-app browser data includes or which controls apply.
Data Access & Collection · Company practice
OpenAI estimates your general location from IP address and may collect precise location if you provide it
OpenAI determines the general area from which your device accesses the Services based on information like its IP address, for security reasons and to make the product experience better, for example detecting unusual login activity or giving more accurate responses. Some Services also let you choose to provide more precise location information from your device, such as GPS.
Supporting quotations
We determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to make your product experience better, for example to protect your account by detecting unusual login activity or to provide more accurate responses.
some of our Services allow you to choose to provide more precise location information from your device, such as location information from your device’s GPS.
Qualifications & exceptions
General location is determined from IP address and similar information; precise location only if you choose to provide it.
Data Access & Collection · Company practice
Cookies and similar technologies are used to run the Services and store some of your information
OpenAI uses cookies and similar technologies to operate and administer the Services and improve your experience, and stores some of the information described in this policy with cookies, for example to keep your preferences across sessions when you are not logged in, or to help with authentication and customer support. Details about cookie use are in a separate Cookie Notice.
Supporting quotations
We use cookies and similar technologies to operate and administer our Services, and improve your experience. We store some of the information described in this Policy with cookies, for example to help maintain your preferences across sessions if you’re not logged in, or to assist with authentication and customer support.
Qualifications & exceptions
Examples given are preferences when not logged in, authentication and customer support.
Not stated here
The Cookie Notice is linked but not supplied, so specific cookies and purposes are unknown.
Data Access & Collection · Company practice
OpenAI also receives information from security partners, marketing vendors, advertisers and the public internet
OpenAI receives information from other sources: trusted security and safety partners (to protect safety and prevent fraud, abuse and other threats), marketing vendors who provide information about potential customers of its business services, advertisers and other data partners (for example, information about purchases you make from those advertisers), and publicly available internet information used to develop its models. Data from advertisers and partners is used for purposes described in the policy, including measuring and improving the effectiveness of the Services, including ads shown to Free and Go users.
Supporting quotations
We receive information from other sources, such as our trusted security and safety partners to protect safety and prevent fraud, abuse, and other threats to our Services, and from marketing vendors who provide us with information about potential customers of our business services.
We receive information from advertisers and other data partners, which we use for purposes described in this Policy including to help us measure and improve the effectiveness of our Services, including ads shown to Free and Go users on our Services. For example, we could receive information about purchases you make from these advertisers.
We also collect information from other sources, like information that is publicly available on the internet, to develop the models that power our Services.
Qualifications & exceptions
Advertiser and data-partner information is tied to measuring effectiveness, including ads shown to Free and Go users.
Public internet information is described as being collected to develop models.
Not stated here
The policy gives examples ("for example, we could receive") rather than a full list of partners or data.
Use & Processing · Company practice
Data from advertisers, partners and the public internet is used to measure effectiveness and develop models
Information OpenAI receives from advertisers and other data partners is used for the purposes described in the policy, including to measure and improve the effectiveness of the Services, including ads shown to Free and Go users. Separately, OpenAI says it collects information from other sources such as publicly available internet information to develop the models that power its Services; a linked help article gives more on the sources used for ChatGPT and other Services.
Supporting quotations
which we use for purposes described in this Policy including to help us measure and improve the effectiveness of our Services, including ads shown to Free and Go users on our Services.
We also collect information from other sources, like information that is publicly available on the internet, to develop the models that power our Services.
Qualifications & exceptions
The ad-effectiveness example is stated for ads shown to Free and Go users.
Public internet information is described as being used to develop models.
Not stated here
The help article on model-development sources is linked but not supplied.
The policy does not list which advertisers or data partners provide data.
Use & Processing · Company practice
OpenAI uses personal data to run, improve and personalize the Services and for research
OpenAI lists these purposes for using Personal Data: to provide, analyse and maintain the Services (for example answering your questions in ChatGPT), to improve and develop the Services and conduct research (for example developing new features), and to personalize and customize your experience (for example giving you more relevant Content). These are stated as examples of broader purposes.
Supporting quotations
We use Personal Data for the following purposes:
To provide, analyse, and maintain our Services, for example to respond to your questions for ChatGPT;
To improve and develop our Services and conduct research, for example to develop new features;
To personalize and customize your experience across our Services, for example to provide you with more relevant Content;
Qualifications & exceptions
Each purpose is given with an example, not an exhaustive scope.
Not stated here
The policy does not say which data types are used for which purpose here; the state disclosures table repeats the purposes at a summary level.
Use & Processing · Company practice
For Free and Go users, personal data is used to personalize and measure ads, subject to your settings
For Free and Go users, OpenAI uses personal data to personalize the ads they see on the Services, subject to their settings, and to measure how effective the ads shown on the Services are. This ties to the earlier statement that, for Free and Go users, OpenAI collects information about their ads history and interests. A linked help article gives more on ads in ChatGPT.
Supporting quotations
For Free and Go users, to personalize the ads you see on our Services (subject to your settings), and to measure the effectiveness of ads shown on our Services.
users, we also collect information about your ads history and interests, such as the types of ad content that you view or engage with.
Qualifications & exceptions
Stated for Free and Go users.
Ad personalization is subject to your settings.
Not stated here
The help article on ads in ChatGPT is linked but not supplied; the available settings are not described here.
Use & Processing · Company practice
OpenAI uses personal data to communicate with you, including information about the Services and events
OpenAI uses personal data to communicate with you, including to respond to your questions and to send you information about its Services and events, for example about changes or improvements to the Services.
Supporting quotations
To communicate with you, including to respond to your questions, and send you information about our Services and events, for example about changes or improvements to the Services;
Qualifications & exceptions
Examples are not exhaustive.
Not stated here
How to stop these communications is covered in the data controls section, not here.
Sharing & Disclosure · Company practice
OpenAI promotes its products through direct marketing and third-party properties, subject to your choices
OpenAI uses personal data to promote its products and services to you through direct marketing and on third-party properties, and to assess how effective those efforts are, subject to your choices and controls. For promotion on third-party properties, the disclosure section says OpenAI shares limited information with select marketing partners who are not service providers, and some of these partners may receive information through cookies and similar technologies.
Supporting quotations
To promote our products and services to you through direct marketing and on third-party properties, and to assess the effectiveness of those efforts, subject to your choices and controls
We also share limited information with select marketing partners who are not service providers in order to promote our products and services on third-party properties and help us assess the effectiveness of those efforts. Some of these partners may receive information through cookies and similar technologies.
Qualifications & exceptions
Subject to your choices and controls.
Sharing is described as limited information with select marketing partners.
Not stated here
Which information is shared with marketing partners is not listed here; a linked help article covers choices and is not supplied.
Use & Processing · Company practice
Connected contacts are used to identify which of your contacts use the Services and to update you
When you choose to connect your contacts, OpenAI uses that information to identify which of your contacts use the Services and to update you if they join later.
Supporting quotations
Identify your contacts who use our Services when you choose to connect your contacts and update you if they join our Services later;
Qualifications & exceptions
Only when you choose to connect your contacts.
Use & Processing · Company practice
Personal data and submitted Content are used to prevent fraud and misuse, including by monitoring Content
OpenAI uses personal data to prevent fraud, illegal activity or misuse of the Services and to protect the security of its systems and Services. The policy says this includes monitoring any Content submitted or exchanged on its platforms, so prompts and other Content you provide may be reviewed for these purposes. A linked page on transparency and content moderation gives more.
Supporting quotations
To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services, including by monitoring any Content submitted or exchanged on our platforms
Qualifications & exceptions
Monitoring is described as covering any Content submitted or exchanged on its platforms.
Not stated here
The linked transparency and content moderation page is not supplied, so who reviews Content and how is unknown.
Use & Processing · Company practice
Personal data is used to meet legal duties, protect rights and safety, and estimate age
OpenAI uses personal data to comply with legal obligations and to protect the rights, privacy, safety or property of its users, OpenAI or third parties, for instance to prevent harm to you or others, or to estimate your age to give you an age-appropriate experience.
Supporting quotations
To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, OpenAI, or third parties, for instance to prevent harm to you or others, or to estimate your age to give you an age-appropriate experience.
Qualifications & exceptions
Age estimation is given as an example of this purpose.
Not stated here
How age is estimated is not described in this passage.
Use & Processing · Company commitment
Aggregated or de-identified data is used for the same purposes and kept de-identified, unless required by law
OpenAI aggregates or de-identifies personal data so it no longer identifies you and uses that information for the purposes described above, such as analyzing how the Services are used, improving and adding features, and conducting research. It says it will maintain and use de-identified information in de-identified form and not try to re-identify it, unless required by law.
Supporting quotations
We also aggregate or de-identify Personal Data so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Services are being used, to improve and add features to them, and to conduct research.
We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.
Qualifications & exceptions
Commitment not to re-identify has an exception where required by law.
Not stated here
The policy does not say what de-identification method is used.
Use & Processing · Permission or license
Your Content may be used to improve the Services, including training models, with an opt-out
OpenAI says it may use Content you provide to improve its Services, for example to train the models that power ChatGPT. It links instructions on how you can opt out of this use of your Content to train its models. The opening of the policy also refers readers to a help article for how training information is collected and used and the choices available, which is not supplied.
Supporting quotations
we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT
on how you can opt out of our use of your Content to train our models
For information about how we collect and use training information to develop our language models that power ChatGPT and other Services, and your choices with respect to that information, please see this policy as well as
Qualifications & exceptions
The opt-out is for OpenAI's use of your Content to train its models, per the linked instructions.
The sentence says "may", not that all Content is always used.
Not stated here
The linked instructions are not supplied, so the opt-out steps and any exceptions are unknown.
The policy does not say here whether other data types besides Content are used for training.
Sharing & Disclosure · Context
OpenAI discloses personal data in listed circumstances
Section 3 introduces a list of circumstances in which OpenAI discloses your Personal Data: vendors and service providers (and marketing partners), business transfers, government authorities and other third parties, affiliates, business account administrators, a teen's parent or guardian, other users and third parties you choose to share with, and aggregated or de-identified data. The cards that follow explain each.
Supporting quotations
We disclose your Personal Data in the following circumstances:
Qualifications & exceptions
The lead-in covers the circumstances listed after it; other sections add related disclosure statements.
Sharing & Disclosure · Company practice
Personal data goes to vendors and service providers who may use it only on OpenAI's instructions
To meet business needs, OpenAI discloses Personal Data to vendors and service providers, including providers of hosting, customer service, cloud, content delivery, support and safety, email software, web analytics, payment and transaction processing, search and shopping, and information technology services. It also works with service providers on age and identity verification. The policy says that when OpenAI works with Service Providers, they access, process or store Personal Data based on OpenAI's instructions and only in the course of performing their duties to OpenAI. That limit is stated for Service Providers and not for the marketing partners described separately.
Supporting quotations
To assist us in meeting business operations needs and to perform certain services and functions, we disclose Personal Data to vendors, service providers, and marketing partners, including providers of hosting services, customer service vendors, cloud services, content delivery services, support and safety services, email communication software, web analytics services, payment and transaction processors, search and shopping providers, and information technology providers.
We also work with service providers who help us with age and identity verification, and you can learn more
When we work with Service Providers, these parties will access, process, or store Personal Data based on our instructions and only in the course of performing their duties to us.
Qualifications & exceptions
The instructions-only limit applies to Service Providers; marketing partners who are not service providers are described separately.
The list of provider types is introduced with "including" and is not stated as complete.
Not stated here
The policy names provider categories, not specific vendors.
A linked help article on age prediction is not supplied.
Sharing & Disclosure · Company practice
Limited information is shared with select marketing partners; you can opt out of this sharing
OpenAI shares limited information with select marketing partners who are not service providers, to promote its products and services on third-party properties and to help it assess how effective that promotion is. Some of these partners may receive information through cookies and similar technologies. OpenAI says elsewhere that this promotion is subject to your choices and controls, and the state disclosures section describes it as targeted advertising or cross-context behavioral advertising under certain state privacy laws, with an opt-out through account settings and other mechanisms. OpenAI also says it does not engage in these activities for users it knows to be under 18.
Supporting quotations
We also share limited information with select marketing partners who are not service providers in order to promote our products and services on third-party properties and help us assess the effectiveness of those efforts. Some of these partners may receive information through cookies and similar technologies.
subject to your choices and controls
This is known as “targeted advertising” or sharing for “cross-context behavioral advertising” under certain state privacy laws. You can opt out using the marketing privacy control in your account settings.
We don’t engage in these activities for users we know to be under 18 years of age.
Qualifications & exceptions
Marketing partners are described as not being service providers, so the service-provider instructions-only limit is not stated for them.
Promotion is subject to your choices and controls; opt-out mechanisms are described in the state disclosures section.
Not done for users OpenAI knows to be under 18.
Not stated here
Which information is shared, and which partners receive it, is not specified; the linked help article is not supplied.
Your personal data may be disclosed and transferred if OpenAI is involved in a business transaction
If OpenAI is involved in strategic transactions, reorganization, bankruptcy, receivership, or a transition of service to another provider (a "Transaction"), your Personal Data may be disclosed during due diligence to counterparties and others assisting with the Transaction. It may also be transferred to a successor or affiliate as part of the Transaction along with other assets.
Supporting quotations
If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a “Transaction”), your Personal Data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
Qualifications & exceptions
Applies if OpenAI is involved in a Transaction as defined; the wording is "may".
Not stated here
The policy does not say whether you would be told before such a transfer or whether the successor must follow this policy.
Sharing & Disclosure · Permission or license
Personal data may be shared with government authorities, industry peers or others for legal, rights and safety reasons
OpenAI may share Personal Data, including information about your interaction with the Services, with government authorities, industry peers or other third parties in compliance with the law in six listed cases: to comply with a legal obligation or a good-faith belief one applies; to protect and defend its rights or property; if it determines, in its sole discretion, that there is a violation of its terms, policies or the law; to detect or prevent fraud or other illegal activity; to protect the safety, security and integrity of its products, employees, users or the public; or to protect against legal liability. Two of the reasons rest on OpenAI's own determination or protection of its own interests rather than a legal demand.
Supporting quotations
We may share your Personal Data, including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so to comply with a legal obligation, or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, users, or the public, or (vi) to protect against legal liability.
Qualifications & exceptions
The sharing is stated to be "in compliance with the law" and for the six listed reasons.
One reason depends on OpenAI's determination in its sole discretion.
Not stated here
The policy does not say whether you are notified of such sharing or who counts as an "industry peer".
Sharing & Disclosure · Company practice
Personal data is disclosed to OpenAI affiliates, who may use it consistently with this policy
OpenAI discloses Personal Data to its affiliates, defined as entities that control, are controlled by or are under common control with OpenAI. The affiliates may use this Personal Data in a manner consistent with the policy.
Supporting quotations
We disclose Personal Data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use this Personal Data in a manner consistent with this policy.
Qualifications & exceptions
"Consistent with this policy" is the stated limit on affiliate use.
Sharing & Disclosure · Company practice
Administrators of business accounts can access your account and Content; employers may be told you have an account
When you join a ChatGPT Enterprise or business account, the administrators of that account may access and control your OpenAI account, including being able to access your Content. Separately, if you create an account with an email address belonging to your employer or another organization, OpenAI may share the fact that you have an account and certain account information, such as your email address, with that employer or organization, for example to enable you to be added to their business account.
Supporting quotations
When you join a ChatGPT Enterprise or business account, the administrators of that account may access and control your OpenAI account, including being able to access your Content.
if you create an account using an email address belonging to your employer or another organization, we may share the fact that you have an account and certain account information, such as your email address, with your employer or organization to, for example, enable you to be added to their business account.
Qualifications & exceptions
Administrator access applies when you join a ChatGPT Enterprise or business account.
Employer sharing applies when you create an account with an email address belonging to your employer or another organization.
Not stated here
The policy does not say what controls the organization has beyond access, or whether you are notified when your employer is told.
Sharing & Disclosure · User right or choice
Teens and parents or guardians can link accounts, giving the parent settings control and safety alerts
Teen users and their parents or guardians can choose to link their accounts. Linking allows the parent or guardian to manage certain settings and to receive alerts if OpenAI detects a serious safety concern. The accounts can be unlinked at any time.
Supporting quotations
Teen users and their parents or guardians can choose to link their accounts, allowing the parent or guardian to manage certain settings, and receive alerts if we detect a serious safety concern. These accounts can be unlinked at any time.
Qualifications & exceptions
Linking is a choice by the teen and parent or guardian; unlinking is possible at any time.
Not stated here
Which settings a parent can manage and what a safety alert contains are described only in a linked help article that is not supplied.
Sharing & Disclosure · Restriction or exception
Information you share with other users or third-party partners is governed by their own terms
Some Services let you interact or share information with other users or third parties, for example by sharing ChatGPT conversations or sharing information with third-party search and shopping partners. Information you share with third-party partners is governed by their own terms and privacy policies, and the policy tells you to make sure you understand those terms before sharing.
Supporting quotations
Certain Services allow you to interact or share information with other users or third parties.
Information you share with third-party partners is governed by their own terms and privacy policies, and you should make sure you understand those terms and policies before sharing information with them.
Qualifications & exceptions
Applies to sharing you initiate with third-party partners; this policy does not govern what those partners do with it.
Not stated here
The shared-link and shopping help articles are linked but not supplied.
Sharing & Disclosure · Company practice
Aggregated or de-identified data may be shared with third parties
OpenAI aggregates or de-identifies Personal Data so that it no longer identifies you, and shares it with third parties for the purposes described above, such as to help improve the Services.
Supporting quotations
We also aggregate or de-identify Personal Data so that it no longer identifies you and share it with third parties for the purposes described above, such as to help improve our Services.
Qualifications & exceptions
Applies to data that no longer identifies you, according to OpenAI.
Not stated here
The recipients and the de-identification method are not described here.
Retention & Deletion · Company practice
OpenAI keeps personal data only as long as needed, depending on data type, use and your settings
OpenAI says it retains Personal Data only as long as it needs to in order to provide the Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with legal obligations. How long a given item is kept depends on the type of data, how it is used and, in many cases, your settings. The policy gives no single retention period.
Supporting quotations
4. Retention
We’ll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data depends on the type of data, how we use it, and in many cases your settings:
Qualifications & exceptions
The purposes listed (disputes, safety, security, legal obligations) are examples of legitimate business purposes.
Retention depends on data type, use and in many cases your settings.
Not stated here
The policy does not give a retention period for most data types.
Retention & Deletion · Company commitment
After you delete data it is removed within 30 days, with exceptions for longer retention and de-identified data
Some Services let you delete Personal Data stored in your account, such as specific or all ChatGPT conversations, specific Memories, or your account. Once you choose to delete, OpenAI says it will remove the data from its systems within 30 days. Two exceptions apply: it may retain data for longer as described in the later retention reasons, and the 30-day removal does not cover data that has already been de-identified and disassociated from your account when you allow OpenAI to use your Content to improve its models. The policy separately says de-identified information is kept and used in de-identified form.
Supporting quotations
Some of our Services allow you to delete Personal Data stored in your account. For example, you can delete specific, or all, of your ChatGPT conversations, delete specific
or delete your account.
Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content to
We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.
Qualifications & exceptions
Applies to data you delete using the Services' deletion features.
Exception: longer retention reasons described later in the section.
Exception: data already de-identified and disassociated from your account when you allow Content to be used to improve models.
Not stated here
The policy does not say when or how Content is de-identified and disassociated, so which deleted data falls in that exception is unknown.
Retention & Deletion · Company commitment
Temporary Chats are deleted automatically within 30 days, unless kept for safety or legal reasons
In some cases Personal Data is deleted automatically. As an example, Temporary Chats will be automatically deleted within 30 days, unless OpenAI has to retain them for safety or legal reasons as described further below.
Supporting quotations
In some cases, Personal Data will be deleted automatically.
will be automatically deleted within 30 days (unless we have to retain them for safety or legal reasons, as described further below).
Qualifications & exceptions
Exception for safety or legal retention.
Not stated here
Other data types that are deleted automatically are not listed.
Retention & Deletion · Permission or license
Data can be kept after deletion for banned content, legal requirements, fraud and security
OpenAI says it may need to keep Personal Data longer, even after you delete it, for example because it is legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping. The examples are: if specific Content or your account is banned for violating the usage policies, OpenAI may retain that data to protect its services from fraud, abuse or other violations; and if OpenAI is legally required to retain your data, such as under a lawful subpoena, it may keep it for the duration of the legal or regulatory obligation.
Supporting quotations
In some cases, we need to retain Personal Data for longer even after you delete it, for example because we are legally required to, to address fraud and abuse, for security reasons, or for financial record-keeping purposes.
If specific Content, or your account, is banned because of violations of our
we may retain that data for to protect our services from fraud, abuse, or other violations of our policies;
If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation;
Qualifications & exceptions
Applies even after you delete the data.
The examples (banned Content or accounts, legal requirements) are introduced with "for instance".
Not stated here
No duration is given for retaining banned Content or accounts.
The source sentence on banned Content reads "retain that data for to protect", which is unclear wording; this analysis does not guess what was meant to follow "for".
Payment records and an audit record of erasure requests are kept after deletion
When OpenAI is a party to a financial transaction, for example processing payment for a ChatGPT Plus or Pro account or facilitating a purchase on ChatGPT, it may retain payment and transaction information for accounting, dispute resolution and regulatory compliance. When you ask OpenAI to delete your Personal Data, it retains the audit record of the erasure request so it can verify it complied.
Supporting quotations
When we are a party to a financial transaction (for instance, when we process your payment for a ChatGPT Plus or Pro account, or facilitate a purchase on ChatGPT), we may retain payment and transaction related information to meet our accounting, dispute resolution, and regulatory compliance purposes;
When you ask us to delete your Personal Data, we retain the audit record of the erasure request to be able to verify that we have complied with the request.
Qualifications & exceptions
Financial retention is stated as "may"; the audit record of erasure requests is stated as retained.
Not stated here
No retention period is given for payment records or the audit record.
Retention & Deletion · Company practice
Retention periods are set by considering purpose, data sensitivity, risk of harm and legal requirements
In determining retention periods OpenAI says it considers its purpose for processing the data (such as whether it needs the data to provide the Services), the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, and any legal requirements it is subject to.
Supporting quotations
In determining these retention periods, we consider a number of factors, such as:
Our purpose for processing the Personal Data (such as whether we need to retain it to provide our Services);
The amount, nature, and sensitivity of the information;
The potential risk of harm from unauthorized use or disclosure;
Any legal requirements that we are subject to.
Qualifications & exceptions
The list of factors is introduced with "such as" and is not stated to be complete.
Not stated here
How the factors translate into specific periods is not described.
Account & Service Control · User right or choice
Account settings give you controls over how personal data is used and retained
Section 5 says the Services provide a number of controls over your Personal Data and how it is used and retained, and that you can always change these settings in your account. The controls described are listed in the cards that follow, and more information is in a linked Data Controls FAQ and the privacy portal.
Supporting quotations
Our Services provide you with a number of controls over your Personal Data and how it is used and retained. You can always change these settings in your account. These include the following controls:
You can find more information on data controls
Qualifications & exceptions
The controls described are those listed in this section.
Not stated here
The Data Controls FAQ and privacy portal are linked but not supplied.
Use & Processing · User right or choice
You can choose whether your Content is used to improve and train models; Temporary Chats are not used
You can choose whether your Content can be used to improve and train OpenAI's models, through the controls described in a linked help article. If you enable Temporary Chat in ChatGPT, those conversations will not appear in your history or be used to improve OpenAI's models. The policy's use section says OpenAI may use Content you provide to improve its Services, including to train models, and links instructions for opting out.
Supporting quotations
choose whether your Content can be used to improve and train our models
in ChatGPT, those conversations with ChatGPT will not appear in your history or be used to improve OpenAI’s models.
we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT
We collect Personal Data that you provide in the input to our Services (“Content”), including your prompts and other content you upload, such as
Qualifications & exceptions
Content here means the input you provide to the Services, such as prompts and uploads.
Temporary Chat conversations are not used to improve models, but are deleted automatically within 30 days, unless kept for safety or legal reasons.
Not stated here
The steps for the control are in a linked help article that is not supplied.
The control is described for Content; the policy does not say here whether other data types are used for training.
You can decide whether ChatGPT remembers details between chats
You can decide whether OpenAI remembers details between chats to make Content more personalized and relevant. The deletion section adds that you can delete specific Memories.
Supporting quotations
You can decide whether we will remember details between chats to make Content more personalized and relevant.
Qualifications & exceptions
A personalization control; the passage describes the choice but not the default.
Not stated here
The default setting and what is remembered are in a linked Memories help article that is not supplied.
Account & Service Control · User right or choice
You can export your ChatGPT data, delete or archive chats, and delete your account
In your account's data controls you can export your ChatGPT history and data. You can also delete or archive chats in ChatGPT, or delete your account entirely. Deleted data is then removed within 30 days subject to the exceptions in the retention section.
Supporting quotations
export your ChatGPT history and data
in your account’s data controls.
You can delete or archive chats in ChatGPT, or
Qualifications & exceptions
Deleting is subject to the longer-retention and de-identification exceptions in section 4.
Not stated here
The export format and what an export includes are in linked help articles that are not supplied.
Account & Service Control · User right or choice
Cookie choices depend on law; Free and Go users have ad controls; you can unsubscribe from marketing
Depending on applicable law, you may be able to choose which cookies are used. For Free and Go users, advertising controls in account settings let you control what data OpenAI uses to personalize the ads shown to you. You can also unsubscribe from marketing communications using the choices provided in those communications.
Supporting quotations
Depending on applicable law, you may be able to choose which cookies are used when you use our Services.
For Free and Go users, you can use the advertising controls in your account settings to control what data we use to personalize the ads we show you on our Services.
You can unsubscribe from marketing communications you receive from us by using the choices provided in those communications.
Qualifications & exceptions
Cookie choice depends on applicable law.
Advertising controls are stated for Free and Go users.
Not stated here
The policy does not say which jurisdictions give cookie choice.
Account & Service Control · User right or choice
Depending on where you live, you may have statutory rights such as access, correction, deletion and portability
The policy says that, depending on where you live, you may have certain statutory rights over your Personal Data. As examples it lists the rights to access your data and information about how it is processed, to rectify or update it, to delete it from OpenAI's records, to restrict how it is processed, to transfer it to a third party (data portability), to withdraw consent where OpenAI relies on consent as the legal basis, and to lodge a complaint with your local data protection authority. This general list is not tied to a specific place; the state disclosures section later lists rights for some U.S. residents.
Supporting quotations
Depending on where you live, you may have certain statutory rights in relation to your Personal Data. For example, you may have the right to:
Access your Personal Data and information relating to how it is processed.
Rectify or update your Personal Data
Delete your Personal Data from our records.
Restrict how we process your Personal Data.
Transfer your Personal Data to a third party (right to data portability).
Withdraw your consent—where we rely on consent as the legal basis for processing.
Lodge a complaint with your local data protection authority.
Qualifications & exceptions
Rights depend on where you live ("you may have" and "for example").
The right to withdraw consent applies where OpenAI relies on consent as the legal basis.
Not stated here
The policy does not say which places give which rights, or which legal bases OpenAI relies on.
Any exceptions to these rights are not stated in this list.
Account & Service Control · Procedure
You can use account tools, the privacy portal or email to exercise rights, and contact the data protection officer
You can exercise some of these rights through your OpenAI account using the tools in the data controls section, or by submitting a request through the privacy portal or by email to the data subject request address. OpenAI also gives an email address for its data protection officer. The wording "some of these rights" means not every listed right is available through the account tools.
Supporting quotations
You can exercise some of these rights through your OpenAI account using the tools described in the
or to dsar@openai.com
You can contact our data protection officer at dpo@openai.com
Qualifications & exceptions
Account tools cover only some of the rights.
Not stated here
Response times and any verification steps are not stated here; the later state-law section describes verification.
Account & Service Control · User right or choice
ChatGPT output can be wrong; you can request correction or removal of inaccurate information about you
OpenAI explains that ChatGPT generates responses by predicting the words most likely to appear next, which may not be the most factually accurate, and tells you not to rely on the factual accuracy of its output. If ChatGPT output contains factually inaccurate information about you, you can request a correction or removal through the privacy portal or by email, and OpenAI says it will consider your request based on applicable law and the technical capabilities of its models. The statement is that it will consider the request, not that it will always grant it.
Supporting quotations
In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from our models.
If you notice that ChatGPT output contains factually inaccurate information about you and you would like to request a correction or removal of the information, you can submit these requests through
and we will consider your request based on applicable law and the technical capabilities of our models.
Qualifications & exceptions
OpenAI will consider requests based on applicable law and the technical capabilities of its models; the policy does not promise correction or removal.
Not stated here
The policy does not say how requests are decided or which technical limits apply.
Account & Service Control · Procedure
Rights over internet data collected to train models are explained in a help article
For how to exercise your rights over data OpenAI has collected from the internet to train its models, the policy refers you to a help center article, which is not supplied here.
Supporting quotations
For information on how to exercise your rights with respect to data we have collected from the internet to train our models, please see
Qualifications & exceptions
Refers to data collected from the internet for training.
Not stated here
The help article is linked but not supplied, so the steps and any limits are unknown.
Use & Processing · Company commitment
Data is processed on servers in various countries, including the US, under legally valid transfer mechanisms
OpenAI processes your Personal Data on servers in various jurisdictions, including in its facilities and servers in the United States and in countries where its affiliates, partners, vendors and service providers are located. It says it applies the protections in the policy to your Personal Data regardless of where it is processed and only transfers data under legally valid transfer mechanisms.
Supporting quotations
OpenAI processes your Personal Data for the purposes described in this policy on servers located in various jurisdictions, including processing and storing your Personal Data in our facilities and servers in the United States, or in countries or territories where our affiliates and partners or our vendors and service providers are located.
While data protection law varies by country, we apply the protections described in this policy to your Personal Data regardless of where it is processed, and only transfer that data pursuant to legally valid transfer mechanisms.
Qualifications & exceptions
Transfers rely on "legally valid transfer mechanisms", which the policy does not name.
Not stated here
The countries and the transfer mechanisms are not specified.
Account & Service Control · Company commitment
Services are not for children under 13; users under 18 need a parent's or guardian's permission
OpenAI says its Services are not directed to or intended for children under 13 and that it does not knowingly collect Personal Data from them. If you think a child under 13 has provided Personal Data, you can email the privacy address, and OpenAI says it will investigate and, if appropriate, delete the data. Users under 18 must have permission from a parent or guardian to use the Services. A linked help article covers account linking for teens and parents.
Supporting quotations
Our Services are not directed to, or intended for, children under 13. We do not knowingly collect Personal Data from children under 13.
If you have reason to believe that a child under 13 has provided Personal Data to OpenAI through the Services, please email us at privacy@openai.com. We will investigate any notification and, if appropriate, delete the Personal Data from our systems.
Users under 18 must have permission from their parent or guardian to use our Services.
Qualifications & exceptions
"Does not knowingly collect" is a statement about knowledge; deletion happens "if appropriate".
Users under 18 must have a parent's or guardian's permission; the policy does not describe how that is checked.
Not stated here
How age is checked at sign-up is not described here; age prediction is mentioned in the disclosure section.
Security & Safeguards · Restriction or exception
OpenAI uses commercially reasonable security measures but says no transmission is fully secure
OpenAI says it implements commercially reasonable technical, administrative and organizational measures designed to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration or destruction. It warns that no Internet or email transmission is ever fully secure or error free, so you should take special care in deciding what information you provide to the Services. It also says it is not responsible for circumvention of privacy settings or security measures on the Service or on third-party websites.
Supporting quotations
We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.
However, no Internet or email transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you provide to the Services.
In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.
Qualifications & exceptions
Measures are "designed to" protect and described as commercially reasonable; this is not a guarantee.
Disclaimer: not responsible for circumvention of privacy settings or security measures on the Service or third-party websites.
Not stated here
The specific measures are not described.
Legal Rights & Agreement Rules · Context
A table gives extra disclosures for U.S. state privacy laws and cross-refers to the earlier sections
Because some U.S. state privacy laws require specific disclosures, this section adds a table with information about the categories of Personal Data OpenAI collects and how it uses and discloses them. It points back to the earlier sections on collection, use, disclosure and retention for more detail. The table summarizes those sections; it does not replace them.
Supporting quotations
9. Additional U.S. state disclosures
require specific disclosures. The following table provides additional information about the categories of Personal Data we collect and how we use and disclose that information.
Qualifications & exceptions
The text describes the table as additional information for U.S. state privacy law disclosures; it does not name particular states or laws.
Not stated here
The linked help article on state privacy laws is not supplied.
Use & Processing · Company commitment
OpenAI says it does not process sensitive data to infer characteristics about you
In the state disclosures introduction OpenAI states that it does not process sensitive data for the purpose of inferring characteristics about you. The statement is limited to that purpose; it does not say OpenAI never collects or processes sensitive data for other purposes.
Supporting quotations
We don’t process sensitive data for the purpose of inferring characteristics about you.
Qualifications & exceptions
Limited to the purpose of inferring characteristics about you.
Not stated here
The policy does not define "sensitive data" here or say whether sensitive data is collected for other purposes.
Legal Rights & Agreement Rules · Context
The state disclosures table is one row of three lists: categories collected, purposes, and disclosures
The table has three columns: Category of Personal Data, Use of Personal Data and Disclosure of Personal Data. Its single body row holds a list in each column: the categories OpenAI says it collects, the purposes for which it uses this information, and the circumstances in which it may disclose it. The table does not pair individual categories with individual purposes or recipients, so no purpose or recipient can be read as applying to one category only. Each column should be read as a list that applies to the information as a whole.
Supporting quotations
Category of Personal Data
Use of Personal Data
Disclosure of Personal Data
Qualifications & exceptions
One header row and one body row, three columns.
Items in a column are not matched to items in other columns.
Not stated here
Because the table is not matched row by row, it does not show which category goes to which recipient or purpose.
Data Access & Collection · Company practice
Table column 1: nine categories of personal data OpenAI says it collects
The first column lists the categories of information OpenAI says it collects, as described earlier: identifiers (name, contact details, IP address, other device identifiers); commercial information such as transaction history; network activity information (interactions with the Services, including Log Data, Usage Data and device information); Content (prompts, uploads, and interactions and messages with other users); Communication Information; Contact Data if you connect your device contacts; geolocation data (general area from IP address and similar information, or precise location you choose to provide); other account information (credentials, payment information, date of birth, profile picture); and other information you provide (events, surveys, or information to establish identity or age). Contact Data and precise location are conditional on your choices.
Supporting quotations
We collect the following information, as described above:
Identifiers, such as your name, contact details, IP address, and other device identifiers
Commercial information, such as your transaction history
Network activity information, such as how you interact with our Services, including Log Data, Usage Data, and information about the device you use to access the Services
Content, including your prompts and content you upload to the Services and interactions and messages with other users
Communication Information, such as your contact information when you send us email
Contact Data if you choose to connect your device contacts
Geolocation data, such as the general area from which your device accesses our Services based on information like its IP address, or precise location information you choose to provide
Other Account Information, such as your account credentials, and payment information, date of birth, and profile picture
Other Information You Provide, such as if you choose to participate in our events or surveys or when you provide us or a vendor operating on our behalf with information to establish your identity or age.
If you choose to connect your device contacts, we upload information from your device address books and check which of your contacts also use our Services.
We determine the general area from which your device accesses our Services based on information like its IP address
We collect Personal Data that you provide in the input to our Services (“Content”), including your prompts and other content you upload, such as
Qualifications & exceptions
Contact Data only if you choose to connect device contacts.
Precise location only if you choose to provide it; general area is based on IP address and similar information.
The column cross-refers to the earlier sections; those sections hold more detail, such as Free and Go ad history and interests under Usage Data.
Not stated here
The column does not separately list ads history and interests; the earlier Usage Data text covers it.
Use & Processing · Company practice
Table column 2: eight purposes for which this information is used, including training models subject to your control
The second column lists the purposes for which OpenAI says it uses this information: to provide, analyze and maintain the Services; to improve and develop the Services and conduct research, including using your Content to train models (subject to your control); to personalize your experience; for Free and Go users, subject to controls, to personalize and measure ads; to communicate with you, including about offers or information that may interest you; to identify your contacts who use the Services when you connect contacts; to prevent fraud and misuse, including by monitoring Content; and to comply with legal obligations and protect rights, including estimating age. The table's list has eight purposes. The earlier use section also lists promoting products through direct marketing and third-party properties as a separate purpose, which this column does not list as its own item; the "offers or information that may interest you" wording in the communications entry is the nearest match, and the opt-out text after the table addresses marketing sharing. This analysis does not read the omission as a limit on the earlier section.
Supporting quotations
We use this information for the following purposes, as described above:
Provide, analyze, and maintain our Services
Improve and develop our Services and conduct research, including using your Content to train our models (subject to your
To personalize and customize your experience across our Services
For Free and Go users, subject to your controls, to personalize the ads you see on our Services and measure the effectiveness of ads shown on our Services.
Communicate with you, including to respond to your questions, and send you information about our Services and events, for example about changes or improvements to the Services or offers or information that may interest you
To identify your contacts who use our Services when you choose to connect your contacts and update you if they join our Services later.
Prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services, including by monitoring any Content submitted or exchanged on our platforms
Comply with legal obligations and protect the rights, privacy, safety, or property of our users, OpenAI, or third parties, for instance to prevent harm to you or others, and to estimate your age to give you an age-appropriate experience
Qualifications & exceptions
The ad purpose is for Free and Go users, subject to your controls.
Using Content to train models is stated as subject to your control.
The column is a list for the information as a whole, not matched to individual categories.
Not stated here
Whether the table's omission of third-party-property promotion as its own purpose changes anything is not stated; the earlier section lists it and the opt-out text covers marketing sharing.
Table column 3: six kinds of recipients, with marketing partners addressed in the text after the table
The third column lists the circumstances in which OpenAI may disclose this information: to vendors, service providers and affiliates to help with business operations and the services described above; to government authorities or other third parties for the legal reasons described above; to parties involved in Transactions; to business account administrators; to parents or guardians of teen users for account linking; and to other users and third parties you interact or share information with. Select marketing partners, described in the disclosure section, are not a separate item in this column; the paragraphs after the table cover sharing with marketing partners. The earlier disclosure section also covers sharing de-identified data, which this column does not list.
Supporting quotations
We may disclose this information in the following circumstances, as described above:
Vendors, service providers, and affiliates to assist us in meeting business operations needs and to perform certain services and functions described above
Government authorities or other third parties for the legal reasons described above
Parties involved in Transactions
Business account administrators for the reasons described above
Parents or guardians of teen users for account linking purposes described above
Other users and third parties you interact or share information with
We also share limited information with select marketing partners who are not service providers in order to promote our products and services on third-party properties and help us assess the effectiveness of those efforts.
Qualifications & exceptions
Each recipient type is stated "as described above" or by cross-reference to the disclosure section.
The column is a list for the information as a whole, not matched to individual categories.
Not stated here
The table does not say which categories go to which recipient.
Sharing & Disclosure · Company commitment
OpenAI says it does not sell personal data, but may share limited data with marketing partners depending on your choices
Under the heading Your Opt-Out Rights, OpenAI says it does not "sell" Personal Data. It adds that, depending on your choices, it may share limited data with select marketing partners to promote its products and services to you on third-party properties. The next paragraph explains that state privacy laws call this targeted advertising or sharing for cross-context behavioral advertising.
Supporting quotations
We don’t “sell” Personal Data. Depending upon your choices, we may share limited data with select marketing partners for purposes of promoting our products and services to you on third-party properties.
This is known as “targeted advertising” or sharing for “cross-context behavioral advertising” under certain state privacy laws.
Qualifications & exceptions
The no-sale statement is paired with the marketing-partner sharing described in the same passage.
Sharing depends on your choices.
Not stated here
The policy does not define "sell" in the text supplied.
Sharing & Disclosure · User right or choice
You can opt out of targeted advertising sharing in account settings, on the website or through Global Privacy Control
You can opt out of this sharing using the marketing privacy control in your account settings. If you are not logged in, you can opt out within Settings > Data Controls on ChatGPT, or using the Your Privacy Choices link on the website. You can also use a legally recognized opt-out mechanism such as Global Privacy Control. OpenAI says it does not engage in these activities for users it knows to be under 18 years of age.
Supporting quotations
You can opt out using the marketing privacy control in your account settings. If you’re not logged in, you can opt out within Settings > Data Controls on ChatGPT or using the Your Privacy Choices
You can also opt out using a legally recognized opt-out mechanism, like Global Privacy Control.
We don’t engage in these activities for users we know to be under 18 years of age.
Qualifications & exceptions
Which method applies depends on whether you are logged in.
The under-18 statement covers users OpenAI knows to be under 18.
Not stated here
A linked help article with more detail is not supplied.
Depending on where you live, you may have rights to know, delete and correct data, and to be free from retaliation
Under the heading Your Other Rights, the policy says that, depending on where you live and subject to applicable exceptions, you may have these privacy rights: to know information about OpenAI's processing of your Personal Data, including access, often in a portable format; to request deletion; to correct your Personal Data; and to be free from retaliation for exercising any of your privacy rights. A link leads to California privacy rights reporting. You can exercise some rights through your account tools, the privacy portal or the data subject request email address described earlier.
Supporting quotations
Your Other Rights. Depending on where you live and subject to applicable exceptions, you may have the following privacy rights in relation to your Personal Data:
The right to know information about our processing of your Personal Data, including the right to access your Personal Data, often in a portable format;
The right to request deletion of your Personal Data;
The right to correct your Personal Data; and
The right to be free from retaliation relating to the exercise of any of your privacy rights. Review our California privacy rights reporting
You can exercise some of these rights through your OpenAI account using the tools described in the
Qualifications & exceptions
Rights depend on where you live and are subject to applicable exceptions.
Introduced as "Your Other Rights", in addition to the opt-out right in the preceding text and the general rights list in section 6.
Not stated here
The policy does not say which states or places give which rights, or what the exceptions are.
The California privacy rights reporting page is linked but not supplied.
Account & Service Control · Procedure
OpenAI may require verification of your identity before acting on a request to know, correct or delete
To protect your Personal Data from unauthorized access, change or deletion, OpenAI may require you to verify your credentials before you submit a request to know, correct or delete. If you do not have an account, or if OpenAI suspects fraudulent or malicious activity, it may ask for additional Personal Data for verification. If OpenAI cannot verify your identity, it will not be able to honor your request.
Supporting quotations
In order to protect your Personal Data from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request to know, correct, or delete Personal Data. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional Personal Data for verification. If we cannot verify your identity, we will not be able to honor your request.
Qualifications & exceptions
Verification "may" be required; additional Personal Data may be requested if you have no account or fraud is suspected.
Consequence: if identity cannot be verified, the request is not honored.
Not stated here
The policy does not say what additional information may be requested or how long verification takes.
Account & Service Control · Procedure
Depending on where you live, an authorized agent can submit a rights request for you
Depending on where you reside, you may submit a rights request through an authorized agent. The agent must present authority to act for you, such as signed written permission, and you may also be required to verify your own identity independently with OpenAI. Authorized agent requests can be submitted to the data subject request email address.
Supporting quotations
Depending upon where you reside, you may also submit a rights request through an authorized agent. If you do so, the agent must present authority to act on your behalf, such as signed written permission, and you may also be required to independently verify your identity with us. Authorized agent requests can be submitted to dsar@openai.com.
Qualifications & exceptions
Depends on where you reside.
The agent must show authority; you may also have to verify your identity yourself.
Not stated here
Which places allow authorized agents is not stated.
Account & Service Control · User right or choice
Depending on where you live, you may appeal a decision on a rights request by email
Depending on where you live, you may have the right to appeal a decision OpenAI makes about your request to exercise your rights. To appeal, you send your request to the data subject request email address.
Supporting quotations
Appeals. Depending on where you live, you may have the right to appeal a decision we make relating to requests to exercise your rights. To appeal a decision, please send your request to dsar@openai.com.
Qualifications & exceptions
Depends on where you live.
Not stated here
Appeal deadlines and process are not described.
Legal Rights & Agreement Rules · Company practice
OpenAI may update the policy and will publish the new version and date on the page, unless the law requires other notice
OpenAI may update the policy from time to time. When it does, it says it will publish an updated version and effective date on the page, unless another type of notice is required by applicable law. The sentence does not promise direct notice such as an email for changes the law does not require notice of.
Supporting quotations
We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.
Qualifications & exceptions
Notice is publication on the page unless applicable law requires another type of notice.
Not stated here
The policy does not say how far in advance changes take effect.
Legal Rights & Agreement Rules · Context
The controller is OpenAI Ireland Limited for EEA and Swiss residents, and OpenAI OpCo, LLC for everyone else
If you live in the European Economic Area or Switzerland, OpenAI Ireland Limited, in Dublin, is the controller responsible for processing your Personal Data as described in this policy. If you live anywhere else, OpenAI OpCo, LLC, in San Francisco, California, is the controller. This section names EEA and Switzerland in the first sentence, while the opening of this US policy directs the EEA, UK and Switzerland to a separate version; the UK is not named in either controller sentence.
Supporting quotations
If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this policy.
If you live anywhere else, OpenAI OpCo, LLC, with its registered office at 1455 Third Street, San Francisco, California 94158, United States, is the controller and is responsible for the processing of your Personal Data as described in this policy.
Qualifications & exceptions
Controller depends on where you live.
The opening of the policy points EEA, UK and Switzerland residents to a separate version; the controller section is part of this version.
Not stated here
The separate EU version is not supplied, so how it assigns controllers is unknown.
The text does not say which sentence applies to people in the UK.
Account & Service Control · Procedure
Questions not covered in the policy go to OpenAI support
For questions or concerns not already addressed in the policy, OpenAI directs you to contact support through a linked help article. Other contact addresses for specific requests appear earlier in the policy.
Supporting quotations
if you have any questions or concerns not already addressed in this policy.
Qualifications & exceptions
Applies to questions or concerns not already addressed in the policy.
Not stated here
The linked support page is not supplied.
Legal Rights & Agreement Rules · Context
Linked resources include a privacy portal and a separate Health Privacy Notice, which are not supplied
The policy ends with a list of useful resources: a help article on how your data is used to improve model performance, a Data Controls FAQ, a privacy portal, a Memories FAQ, a Voice Mode FAQ and a Health Privacy Notice. The linked pages, including the separate Health Privacy Notice, are not part of the supplied text, so how they apply to your data is unknown.
Supporting quotations
How your data is used to improve model performance
Privacy Portal
Health Privacy Notice
Qualifications & exceptions
Links are provided as resources; the policy does not say these documents form part of the policy.
Not stated here
None of the linked documents are supplied, including the Health Privacy Notice.