OpenAI Privacy Policy Update
What they're not telling you: OpenAI's Privacy Policy Revision Exposes Data Retention Gaps That CFPB Has Failed to Regulate OpenAI modified its privacy policy without public announcement, preserving data retention practices that federal regulators have not subjected to binding enforcement despite years of consumer complaints about AI training datasets. The policy revision, surfaced through technical comparison of archived versions, maintains OpenAI's broad claim to retain user conversation data "to improve our services" without specifying retention periods, deletion procedures, or the scope of internal distribution—categories that would trigger disclosure requirements under Federal Trade Commission guidance if applied to other technology platforms with comparable user bases. The company's previous version contained identical language, indicating policy stability rather than meaningful tightening in response to regulatory pressure.
What the Documents Show
OpenAI's data retention framework operates without the contractual limitations imposed on other major tech platforms. Google, under a 2011 FTC settlement, agreed to concrete deletion timelines and third-party auditing of privacy practices. Meta accepted similar restrictions in a 2020 order. OpenAI has faced no equivalent enforcement action, though the Federal Trade Commission launched a nonpublic investigation into the company's practices in 2023, according to publicly available docket filings. The status of that investigation remains undisclosed.
Follow the Money
The revised policy continues to specify that OpenAI may retain conversation data indefinitely if the user has not explicitly deleted their account and opted into data deletion requests—a passive consent model that differs from the affirmative-consent frameworks regulators have required from financial institutions and healthcare providers handling sensitive personal information. Users retain no automated means to verify what data OpenAI holds, how long specific conversations remain in corporate databases, or whether their information has been incorporated into training datasets for subsequent model versions. What distinguishes this revision from industry standard practice is the absence of technical detail regarding what "improving our services" encompasses. Internal OpenAI documents obtained by researchers indicate the company has fed user conversations into training pipelines—a practice disclosed in corporate communications but not explicitly detailed in consumer-facing privacy documentation. The policy revision does not clarify whether retained data is used for model training, quality assessment, safety evaluation, or commercial product development, categories that trigger different regulatory obligations under state privacy statutes including California's Consumer Privacy Act. The Consumer Financial Protection Bureau has authority to regulate companies offering financial services integrated with AI systems.
What Else We Know
OpenAI's partnership with Microsoft to embed GPT capabilities into banking-adjacent services—including financial advisory functions—falls within CFPB jurisdiction. The Bureau has issued no guidance establishing what privacy obligations apply to AI training on financial conversation data, nor has it opened enforcement proceedings against OpenAI or comparable AI platform operators for data retention practices. --- THE TAKE --- What strikes me about this pattern is not that OpenAI changed its policy, but that the institutional mechanisms designed to catch these changes have atrophied. The FTC investigation languishes in nonpublic status. The CFPB has not articulated what privacy standards apply to AI training data drawn from financial conversations. State attorneys general have filed no coordinated enforcement actions.
Primary Sources
- Source: Hacker News
- Category: Tech & Privacy
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.