Skip to content

Is It Legal to Send My Users' Data to OpenAI or Claude?

6 min read

Yes, it is legal to send your users' text and data to an AI API like OpenAI or Anthropic's Claude. It is a routine thing to do. But it is a data transfer to a third party, and that comes with three obligations: you must disclose it in your privacy policy, you must accept the provider's data processing agreement, and you should turn off training on your data. Most vibe-coded apps do none of these, because the agent wired up the API call and stopped there.

Why this happens

When you asked your AI agent to "add a chatbot" or "summarise what the user typed," it added a call to OpenAI or Claude and moved on. That call takes your user's words, ships them to a company in another country, and gets a response back. From a privacy-law point of view that provider is now a data processor handling your users' personal data on your behalf.

The agent built the feature you asked for. It did not write the privacy policy line that says "we send your messages to OpenAI," and it did not accept the paperwork that makes the arrangement lawful, because you didn't ask, and the demo worked without it.

How to check

  1. Find every LLM call in your code. Search your project for openai, anthropic, api.openai.com, and claude. Each hit is a place user data may leave your app.
  2. Look at what you send. For each call, check the content of the prompt. Is it just a fixed template, or does it include what the user typed, their name, their uploaded file, their email? Anything personal counts.
  3. Read your privacy policy. Search it for "OpenAI," "Anthropic," "AI," or "third parties we share data with." If your policy does not mention sending data to an AI provider, you have an undisclosed transfer.

The fix

  1. Disclose it in your privacy policy. Add a plain line naming the provider and the purpose, for example: "When you use our chat feature, your messages are sent to OpenAI to generate a response." If you don't have a privacy policy yet, start with do I need a privacy policy for a beta app.
  2. Accept the provider's DPA. OpenAI and Anthropic both offer a Data Processing Addendum that makes them your lawful processor. For OpenAI it is on their Trust portal; for Anthropic it is available through their commercial terms. Accepting it is the paperwork that keeps you compliant under GDPR. Do I need a DPA with Supabase, Stripe, and OpenAI walks through this.
  3. Turn off training on your data. Data sent through the OpenAI and Anthropic APIs is not used for training by default, which is the setting you want. Confirm you are on the API (not pasting user data into the consumer ChatGPT or Claude apps, which have different rules) and check your account settings to be sure.
  4. Send the minimum. Strip out what the model does not need. If the feature works without the user's real name or email in the prompt, leave them out. Less personal data in the request is less to disclose and less to leak.

The trap to avoid

Do not assume "the API is private, so I'm fine" and skip the disclosure. The technical fact that OpenAI won't train on your API data is not the same as the legal fact that your users were told their data goes there. GDPR and similar laws care about disclosure and lawful basis, not just whether the pipe is encrypted. Silence is the violation, even when the provider behaves perfectly.

Where this fits

An undisclosed AI data transfer is invisible in every demo and obvious to the first user who reads your privacy policy, or the first regulator who asks. It is exactly the kind of gap the free Readiness Report catches: your agent finds the LLM calls in your code and checks whether what they send is actually disclosed. If GDPR applies to your app, this is not optional. When you want the policy language and the DPA steps handed to you in order, that is what the Finishing Pass is for.