1. What the document is: Anthropic's consumer-facing Privacy Policy. Unusually, this capture bundles a second, separate document into the same file: Anthropic's "Non-User Privacy Policy" notice (starting partway through), which explains in detail how Claude's models are pre-trained and post-trained, and how personal data sourced from third parties feeds into that pipeline.

What this wiki found — complete, every page

AI trainingRoyalty-freeSublicensablePerpetual / irrevocableTransferableDerivative works

Presence facts, not verdicts — each flagged term links to its definition and the exact clause on this page. Absence of a badge means the term isn't currently flagged here, not that the page is risk-free.

Claude.ai – Privacy Policy

Dataset: GenGA (Generative AI Governance Archive) — 11 AI services, 2025–present

GenGA (Generative AI Governance Archive) is this wiki’s Generative-AI dataset: raw policy snapshots captured by the Open Terms Archive genai-eu project across 11 GenAI providers (ChatGPT, Claude.ai, DeepSeek, Google Generative AI Services, Le Chat, Llama API, Meta AI, Microsoft Copilot, Perplexity, Qwen Chat, xAI). Unlike PGAv2, GenGA has no pre-tagged risk scores — all risk scoring and keyword tagging on these pages is LLM-assigned by direct reading, spanning 2025–present.

Note: This page contains documented policy clauses. Risk assessment is qualitative and context-dependent. For analysis of patterns across platforms, see:

Source: sources/GenGA/Claude.ai/Privacy Policy/ (raw Markdown captures, Open Terms Archive genai-eu dataset — no pre-tagged JSONL exists for this source) Last updated: 2026-04-17

Note on methodology: No pre-computed risk_score/keyword fields exist for this source. Keyword tags and clause analysis on this page are LLM-assigned, using the same rubric/vocabulary as the PGAv2 pages plus new GenAI-specific tags (input license, gdpr). Treat as first-pass analysis, not externally verified ground truth. This wiki’s risk-scoring system was retired project-wide on 2026-06-21 (see methodology.md §4) — no page, GenGA included, computes or displays a numeric risk score.

Data-quality note: This doc type has the densest snapshot history processed in this dataset — 91 raw captures collapsing to only 3 genuinely distinct content states. 88 of the 91 inter-snapshot diffs are a confirmed scraper artifact: a rotating tracking token embedded in the “Privacy Settings” redirect link (claude.ai/redirect/website.v1.{uuid}/settings/privacy), which changes on nearly every capture even when no policy text changes — the same pattern previously documented for Facebook’s/Instagram’s CDN-link rotation in the PGAv2 wiki. A handful of dates also flicker between two equivalent date formats (“August 28, 2025” vs. “28 August 2025”) for the same effective-date stamp, which is also cosmetic. Every individual capture date is still listed below per this wiki’s “diff every snapshot” convention, but only the 3 genuine transitions are quoted in full.

Overview

1. What the document is: Anthropic’s consumer-facing Privacy Policy. Unusually, this capture bundles a second, separate document into the same file: Anthropic’s “Non-User Privacy Policy” notice (starting partway through), which explains in detail how Claude’s models are pre-trained and post-trained, and how personal data sourced from third parties feeds into that pipeline.

2. Input rights: Claude trains on your Inputs/Outputs by default, with an account-settings opt-out — but two carve-outs always apply regardless of your opt-out status: safety-flagged conversations, and content you’ve explicitly reported through feedback mechanisms. This is structurally the same as OpenAI’s consumer opt-out model (see ChatGPT_Privacy_Policy.md), but more explicit about exactly when the opt-out doesn’t apply.

3. Output restrictions: Not addressed in this document (governed by the Usage Policy/Commercial Terms instead).

4. Non-explicit predatory clauses: The processing-purposes table splits “To improve the Services and conduct research (excluding model training)” from “(including model training)” — a notable transparency feature. Anthropic explicitly separates research-only data use from training data use in its legal-basis table, which is more granular than most providers in this dataset.

5. Regulatory references: GDPR explicitly cited (Article 45 adequacy decisions, Article 46 Standard Contractual Clauses). Also names region-specific laws: South Korea’s Personal Information Protection Act (Article 31-2) and its Act on Promotion of Information and Communications Network Utilization and Data Protection (Article 32-5), plus a reference to Washington State’s consumer health data law. No EU AI Act reference found.

6. Regional variation: Extensive, and growing over this dataset’s timeframe — starts with Canada/Brazil-specific sections, adds a dedicated Republic of Korea section (with a named local data-protection representative and data-processor table) on 2025-11-24, then folds all of this into a unified “Regional Supplemental Disclosures” section on 2026-01-12 while also adding a new Washington-specific Consumer Health Data Privacy Policy cross-reference.

7. Key risk to users: The default opt-out (not opt-in) training model is the central risk — the same kind of risk as OpenAI’s consumer policy — but Anthropic is more transparent about the safety-flagging exception that survives an opt-out.

Flagged Keywords & Risks (LLM-assigned)

input license, train AI/models — default opt-out training on Inputs/Outputs, with safety-flagged and self-reported content always eligible for training regardless of opt-out. Why it matters: the central risk clause on this page — structurally close to OpenAI’s equivalent, but more explicit about its own exceptions.
gdpr — Article 45/46 GDPR citations for international transfers. Why it matters: concrete regulatory grounding, useful for comparing providers.

Regulatory & Research Context

Pandit et al. (2026) found that all six GenAI services they coded, including Anthropic’s Claude, used inputs and outputs “for other purposes beyond” the immediate service; the default opt-out training clause here — with safety-flagged and self-reported conversations always eligible regardless of opt-out status — is a direct instance of that pattern, made more explicit about its own exceptions than most providers’ equivalent clauses. Davidson et al. (2026), who studied Anthropic directly, would note the page’s unusually granular regional build-out (Korea-specific representative disclosures, a Washington consumer-health-data cross-reference) as the kind of jurisdiction-by-jurisdiction compliance layering their comparative analysis associates with providers operating across multiple regulatory regimes simultaneously.

Changes Summary

Date	What changed
2025-11-11 → 2025-11-15	Baseline content state (4 captures, differing only by the redirect-token rotation artifact).
2025-11-24	Genuine addition: new “Supplemental Disclosures for Residents of the Republic of Korea” section (local data-protection representative, data-processor table) and a corresponding “if you are located in the Republic of Korea…” pointer sentence.
2025-11-25 → 2026-01-11	Content state unchanged from 2025-11-24 (47 captures, all differing only by the redirect-token rotation artifact).
2026-01-12 (23:31 capture)	Genuine addition/restructure: Canada/Brazil/Korea regional sections merged into a single “11. Regional Supplemental Disclosures” section; new pointer to a separate Washington-specific “Consumer Health Data Privacy Policy”; consent legal-basis wording broadened to mention “health app integrations.”
2026-01-13 → 2026-04-17	Content state unchanged from 2026-01-12 (16 captures; 2 of these — 2026-01-17 23:31 and 2026-02-05 — additionally flicker the “Effective {date}” stamp between two equivalent date formats, a second confirmed cosmetic artifact).

Version History

2025-11-11 (capture 2025-11-11T15-22-48Z)

Explicit AI clause: YES
Non-explicit predatory: NO
Flagged keywords: input license, train AI/models, gdpr

Clause: input license, train AI/models

We may use your Inputs and Outputs to train our models and improve our Services, unless you opt out through your account settings. Even if you opt-out, we will use Inputs and Outputs for model improvement when: (1) your conversations are flagged for safety review to improve our ability to detect harmful content, enforce our policies, or advance AI safety research, or (2) you’ve explicitly reported the materials to us (for example via our feedback mechanisms).

Clause: gdpr

Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognise that a country outside of the EEA offers an adequate level of data protection. […] Standard contractual clauses. The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA.

2025-11-12 (capture 2025-11-12T00-34-21Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-12 (capture 2025-11-12T12-34-03Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-13 (capture 2025-11-13T00-33-49Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-13 (capture 2025-11-13T12-33-55Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-14 (capture 2025-11-14T00-33-58Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-14 (capture 2025-11-14T12-33-50Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-15 (capture 2025-11-15T12-33-56Z)

All clauses unchanged from 2025-11-11 — this capture’s only difference is the redirect-token rotation artifact (and, on a few dates, a cosmetic date-format flicker), not a real policy change.

2025-11-24 (capture 2025-11-24T15-51-40Z)

input license/train AI/models/gdpr unchanged from 2025-11-11.

Clause: regional variation (new) — Republic of Korea section first added

13. Supplemental Disclosures for Residents of the Republic of Korea. Domestic Representative in the Republic of Korea: The domestic representative of Anthropic PBC for data protection and related regulatory purposes under Article 31-2 of the Personal Information Protection Act and Article 32-5 of the Act on Promotion of Information and Communications Network Utilization and Data Protection, Etc. in the Republic of Korea is as follows: Entity Name and Representative: Anthropic Korea, Limited (Representative Patrick Azubike Ekeruo). Registered Address: (Yeoksam-dong), 41F, 152 Teheran-ro, Gangnam-gu, Seoul, South Korea.