ChatGPT is OpenAI's consumer AI assistant app and website, operated by OpenAI OpCo, LLC under the OpenAI Group PBC (a public benefit corporation controlled by the nonprofit OpenAI Foundation, per OpenAI's own restructuring announcement). OpenAI's privacy policy discloses broad collection of account, content, log, device, and location data, and states that consumer conversations are used by default to train its models unless the user opts out; the policy also discloses that, for Free and Go-tier users, some usage and advertising data is shared with marketing partners for targeted/cross-context behavioral advertising, with an opt-out. Apple's App Store privacy label confirms data linked to identity is used for third-party advertising. OpenAI publicly documented a March 2023 Redis-library bug that exposed some users' chat titles and, for a subset of ChatGPT Plus subscribers, payment-related information; separately, Italy's data protection authority (Garante) issued a live regulatory order in March 2023 temporarily limiting OpenAI's processing of Italian users' data, citing lack of a legal basis for training on personal data and no age verification.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-03-30]
Italy's data protection authority (Garante) issued an order dated March 30, 2023 imposing an immediate provisional limitation on OpenAI L.L.C.'s processing of Italian users' personal data via ChatGPT, citing the absence of any information notice to users, no adequate legal basis for using personal data to train the algorithms behind ChatGPT, and no age-verification mechanism despite a stated 13+ minimum age.
The service's policy indicates your personal data may be sold or otherwise transferred as part of a bankruptcy proceeding or other type of financial transaction.
OpenAI's Help Center states that for consumer services such as ChatGPT, conversations are used by default to further train its models, and that users must actively opt out (via 'do not train on my content' in the privacy portal or the Data Controls settings) to stop new conversations from being used for training.
OpenAI's U.S. privacy policy states it collects a broad set of personal data from ChatGPT users, including Account Information (name, contact info, credentials, date of birth, payment info), User Content (prompts and uploaded files/images/audio/video), Communication Information, Log Data, Usage Data, Device Information, and Location Information.
OpenAI's own 'Our structure' page states OpenAI was founded in 2015 as a nonprofit, and describes a 2025 restructuring under which the nonprofit (now called the OpenAI Foundation) controls the for-profit arm, now a public benefit corporation called OpenAI Group PBC, with the Foundation appointing the PBC's board of directors and holding a 26% equity stake.
OpenAI's privacy policy states it does not 'sell' Personal Data, but discloses it may share limited data with select marketing partners to promote its products on third-party properties, which it labels 'targeted advertising' or cross-context behavioral advertising sharing under certain state privacy laws, offering an opt-out via account settings or Global Privacy Control; separately, the policy discloses routine disclosure to vendors, service providers, and marketing partners for hosting, analytics, and support functions.
OpenAI's own incident postmortem states a bug in the open-source redis-py library caused a ChatGPT outage on March 20, 2023 and allowed some active users to see another user's chat titles, and, for about 1.2% of ChatGPT Plus subscribers active in a specific nine-hour window, exposed payment-related information (name, email, payment address, card type, last four digits, and expiration date).
Italy's data protection authority (Garante) issued an order dated March 30, 2023 imposing an immediate provisional limitation on OpenAI L.L.C.'s processing of Italian users' personal data via ChatGPT, citing the absence of any information notice to users, no adequate legal basis for using personal data to train the algorithms behind ChatGPT, and no age-verification mechanism despite a stated 13+ minimum age.
Apple's App Store privacy label for the ChatGPT app (developer: OpenAI OpCo, LLC) discloses that data linked to a user's identity — Usage Data, Product Interaction data, and Advertising Data — is collected and used for the purpose of 'Third-Party Advertising,' and the listing separately flags the app as 'Contains Advertising.'