Your Data, Their AI: What 575 Top US Privacy Policies Say About AI Training
We read the privacy policies of the most visited websites in the United States and compared each one with the version the same site published in late 2024. One in five now says it uses, or may use, your personal information to train AI. Most added that language in the last two years, and very few let you opt out.
Quick answer
Of 575 privacy policies from the most visited US websites, 20% say the company trains, or may train, AI or machine learning models on users' personal information. On the 441 sites we could compare with a late 2024 copy, that share rose from 8% to 19%. 87% of the policies that mention AI training give no way to opt out of it.
- Policies read
- 575 of the 682 top US sites
- Compared with
- Late 2024 copies of 441 policies
- Method
- Every AI clause quoted and checked
Reviewed against official sources on November 12, 2026. This guide is general information, not legal advice.
- FTC, AI (and other) companies: quietly changing your terms of service could be unfair or deceptive (February 2024)
- Connecticut Public Act 25-113 (SB 1295), amendments to the Connecticut Data Privacy Act
- Chrome UX Report (CrUX), Google
- CrUX top sites lists by country (zakird/crux-top-lists)
- Internet Archive Wayback Machine
Key findings
20%
of top US sites' privacy policies say they train, or may train, AI on your data
8% → 19%
say it, late 2024 compared with today (same sites)
51 of 84
of those policies added the AI training language after late 2024
87%
of policies that mention AI training give no way to opt out of it
68%
only say "personal information", without naming which data
5%
promise not to train AI on your data
1. One in five top sites says it trains AI on your data
117 of the 575 policies say personal information or what you post is used to train, develop or improve AI or machine learning models. 74 say so directly, often as one line in a list of purposes. The other 43 say they "may" do it, which still reserves the right. They include some of the largest companies online: Microsoft, Meta, Amazon, LinkedIn, TikTok, PayPal, Walmart and Costco.
Counting each company once, since some publish one policy for several sites, the share is 17%. Google's policy says it uses publicly available information to train its models; we count that separately because it does not name its users' own data.
What each privacy policy says about training AI on your data (575 policies)
2. Most of it was written in the last two years
For 441 sites we found the policy as it stood in late 2024 in the Internet Archive. On those sites, mentions of AI rose from 15% of policies to 37%, and statements about training AI on user data rose from 8% to 19%. Of today's AI training policies that had a 2024 copy, 51 of 84 did not say it in late 2024.
Companies that added it include Amazon, Roblox, Spotify, Airbnb, eBay, PayPal, Capital One, Walmart, Costco, Kroger, CVS, McDonald's, Verizon and GitHub. In February 2024 the US Federal Trade Commission warned that adopting more permissive data practices, such as training AI on data people already shared, only through a quiet change to a privacy policy could be unfair or deceptive.
The same 441 sites, late 2024 and today
3. Almost nobody lets you opt out
Of the 117 policies that mention AI training, 11 describe a way to opt out of it or object to it, and 4 say they ask for consent first. The other 102 offer nothing specific to AI. They list the usual rights to see or delete your data, which do not stop it being used for training while it is held. The opt-outs we found were at AI companies such as OpenAI and Anthropic, and at a handful of platforms including Airbnb, Booking.com, eBay, Discord, X, Canva and Grammarly. Some are narrower than they sound: eBay says its right to object applies to "certain users", and X's opt-out covers sharing your data with outside companies that may train their own AI, not X's own training.
Choice offered by policies that mention AI training (117 policies)
4. Which data, and which AI
68% of these policies only say "personal information" or "your data", without naming what goes into training. Where they are specific, the data is most often your chats with the site's own AI assistant, or what you post and upload. 78% say the models are the company's own. 43% say the AI is generative (chatbots or large language models), 24% describe machine learning for things like recommendations and fraud, and the rest just say "AI models".
Data named for training (117 policies, more than one can apply)
5. What the policies say, in their own words
These are well-known companies from the study. Each quote is copied from the privacy policy we collected on 11 and 12 November 2026; the link opens the current policy. "In late 2024" shows whether the policy said it then.
| Company | What the privacy policy says | Opt-out | In late 2024 | Policy |
|---|---|---|---|---|
| Microsoftbing.com, microsoft.com, office.com, xbox.com, msn.com, live.com | “For example, we use data, often de-identified, to better understand our customers’ computing and productivity needs, and to train and fine-tune AI models, which can shape the development of new products.” | No | Yes | November 2026 |
| Metafacebook.com, instagram.com, threads.com | “Develop and improve AI at Meta for Meta Products and for third parties.” | No | No copy | July 23, 2026 |
| Amazonamazon.com, audible.com, primevideo.com, imdb.com | “This includes using data to develop or deploy our generative AI models and services.” | No | No | June 30, 2026 |
| LinkedInlinkedin.com | “We may use your personal data to improve, develop, and provide products and Services, develop and train artificial intelligence (AI) models, develop, provide, and personalize our Services”(says it may) | No | Yes | November 3, 2025 |
| TikToktiktok.com | “To review, support, improve, and develop the Services, and train, test, and improve technology, such as machine learning models and algorithms, including by analyzing how people are using the Services;” | No | Yes | Policy |
| Xx.com | “We may use the information we collect and publicly available information to help train our machine learning or artificial intelligence models for the purposes outlined in this policy.”(says it may) | Yes | Yes | January 15, 2026 |
| Snapchatsnapchat.com | “For example, our algorithms and machine learning models take into account the conversations Snapchatters are having with My AI to improve the responses from My AI.” | No | Yes | September 21, 2026 |
| Pinterestpinterest.com | “For example, using information to train, develop and improve our technology such as our machine learning models, regardless of when Pins were posted. This includes, for example, Pinterest’s body type technology, which is trained on images in Pins posted to our Services.” | No | Yes | April 30, 2025 |
| Robloxroblox.com | “we will collect, process, and store that content only for as long as needed to accomplish the purpose of the feature, AI training, and improving products.” | No | No | November 1, 2026 |
| Spotifyspotify.com | “This includes development and training of algorithmic and machine learning models, which help us to keep our service safe and enhance our users’ experience.” | No | No | July 1, 2026 |
| Airbnbairbnb.com | “We use personal information to carry out the processing described in the sub-sections below. This includes using AI technologies that we develop and improve using your personal information.” | Yes | No | February 5, 2026 |
| Booking.combooking.com | “We may use your personal data to develop, train, and fine-tune AI systems which are used in the following ways:”(says it may) | Yes | No copy | October 2026 |
| eBayebay.com | “Development and improvement of AI models and technology. You will find more information on AI and your corresponding rights below under section 9.” | Yes | No | Effective November 26, 2026 |
| PayPalpaypal.com | “We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.”(says it may) | No | No | October 12, 2026 |
| Cash Appcash.app | “Protecting your, our, or our other customers’ rights or property, or the security or integrity of our Services, including by using and training AI and other machine learning models to protect our services and maintain a trusted environment;” | No | No copy | June 8, 2026 |
| Capital Onecapitalone.com | “improving existing products and services or developing new products and services, including by developing and training models to be used in connection with our products and services (e.g., to protect against fraud and other harm or to personalize your experiences).” | No | No | May 5, 2026 |
| Intuitintuit.com, creditkarma.com | “Improve and develop our products and services by analyzing how they are used and interacted with, by training our artificial intelligence models and other machine learning models, as well as by assessing the use of and interactions with our Platform” | No | Yes | March 9, 2026 |
| Walmartwalmart.com, samsclub.com | “Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them, such as training our AI.” | No | No | August 20, 2026 |
| Costcocostco.com | “conduct research, including training Artificial Intelligence tools and Large Language Models used to support our business operations.” | No | No | October 22, 2026 |
| Krogerkroger.com | “This may include using your information to develop, test, and improve models that are designed for specific, limited purposes-such as translating your search queries into relevant results or enhancing features you use.”(says it may) | No | No | September 9, 2026 |
| CVScvs.com | “To communicate with you, such as through bots (which may be powered by third party vendors and be trained on your inputs through AI-based technology), including to respond to your inquiries/requests and request feedback from you”(says it may) | No | No | July 1, 2026 |
| McDonald'smcdonalds.com | “to train algorithms and AI models that we use in the context of providing you with products and services;” | No | No | July 1, 2026 |
| Domino'sdominos.com | “Improvements. We collect and use information to develop new features, enhance functionality, and train our models and algorithms.” | No | No copy | August 2026 |
| Taco Belltacobell.com | “We use this information to respond to your questions or comments, to evaluate and improve our products and services, including for AI training purposes,” | No | No copy | September 1, 2026 |
| T-Mobilet-mobile.com, metrobyt-mobile.com | “We use personal data to provide, develop, customize, and personalize products and services, including to train artificial intelligence models (e.g., to improve our network, enhance customer service, etc.).” | No | Yes | June 26, 2026 |
| Verizonstraighttalk.com | “we may use machine learning techniques to train algorithmic models with information we have about you and other customers to provide more relevant marketing messages or predict what services might be of interest.”(says it may) | No | No | October 2026 |
| Indeedindeed.com, glassdoor.com | “In support of these goals, we use personal data to develop, train, build and use statistical models, including artificial intelligence (“AI”), which allows Job Seekers and Employers to quickly and easily find one another and determine if they are a good match.” | No | Yes | November 4, 2026 |
| GitHubgithub.com | “We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models.” | No | No | April 27, 2026 |
| The Weather Channelweather.com, wunderground.com | “Legitimate Interest - to improve the AI features, including training our AI models” | No | No | April 30, 2026 |
| Fox Newsfoxnews.com | “This may involve using your information to train our technologies, including through large language models, to enhance our services for you.”(says it may) | No | No | October 22, 2026 |
| USA Todayusatoday.com | “Unless prohibited by law, we may use your information as well as publicly available information to help train our and our partners’ and providers’ machine learning or artificial intelligence systems and models”(says it may) | No | No copy | February 10, 2025 |
| UPSups.com | “Like many companies, we use personal information we collect to operate and improve our business. This may include the use of personal information to support the improvement of large language models.”(says it may) | No | No copy | June 30, 2026 |
| Grammarlygrammarly.com | “We also use information we collect to train our AI models. You can decide whether Superhuman can use your user content to train our AI models by adjusting the available training control(s) in your account settings.” | Yes | Yes | July 6, 2026 |
| Canvacanva.com | “We may analyze your activity, content, media uploads and related data in your account to provide and customize the Service, including generating and storing that data as Memories, and to train our algorithms, models and AI products and services using machine learning”(says it may) | Yes | Yes | November 2, 2026 |
| OpenAI (ChatGPT)chatgpt.com | “Improve and develop our Services and conduct research, including using your Content to train our models (subject to your control)” | Yes | Yes | September 10, 2026 |
| Targettarget.com | “Enhance technology and enable innovation, including development, deployment, and training of AI models and services” | No | No | August 15, 2026 |
| The New York Timesnytimes.com | “Your chat session will be recorded for quality assurance and training and may be used for training AI models.”(says it may) | No | No copy | November 9, 2026 |
| Samsungsamsung.com | “we may also use personal information about United States residents for other purposes, such as to develop and train our artificial intelligence algorithms and models.”(says it may) | No | Yes | July 20, 2026 |
| Yelpyelp.com | “For example, we may use such AI Technologies to analyze and process your contributions and interactions to provide you with personalized experiences, content recommendations, and relevant information based on your activity on Yelp; develop new products and features; train or fine-tune AI models;”(says it may) | No | No copy | October 1, 2025 |
| Twitchtwitch.tv | “This includes using data to develop or deploy our generative AI models and services.” | No | No copy | August 12, 2026 |
6. The ones that say no
27 policies (5%) promise not to use personal information to train AI. Apple says private personal data is not used to train its foundational AI models. Several education services, such as Kahoot!, ParentSquare, PrairieLearn and Zearn, say they do not train AI on users' data, and some also bar their AI vendors from doing so. 7 of the promises only cover outside AI vendors, not the company itself.
4 promises are made to Connecticut residents only. Since July 1, 2026 Connecticut has required privacy notices to say whether personal data is used to train large language models, and some companies answered that question for Connecticut alone.
What this means for your own site
- • Say it plainly if you train on user data. One clear sentence beats a line hidden in a list of purposes.
- • Name the data. Chats with your AI assistant, uploads, usage data: say which, not just "personal information".
- • Offer a real choice. An opt-out for AI training, or asking first, is what most policies in this study lack.
- • Tell people before the change, not after. The FTC has warned against adding AI training through a quiet policy update.
- • Check your state disclosures. Connecticut now expects a statement on training large language models.
Get it right on your site
A privacy policy that says what you do with AI
Create a privacy policy that covers the AI tools you use, whether user data trains any models, and the choices you offer, in plain language you can keep up to date.
- Covers AI and machine learning
- Plain language
- Free to start
How we did it
Sites. We took the 1,000 most visited websites in the United States from Google's Chrome UX Report for October 2026 and grouped them by registered domain, which gave 682 sites after removing government, education, military and adult sites.
Policies. On 11 and 12 November 2026 we opened each homepage in a real Chromium browser through a US connection and followed its privacy policy link, opening collapsed sections so the full text was read. Where a site blocked automated browsers, we used the address its homepage links to, or the latest Internet Archive copy. We found and read a privacy policy for 575 of the 682 sites; the rest blocked us, had no policy we could find, or were login pages.
Late 2024 copies. For each policy we took the Internet Archive copy closest to November 1, 2024 (between June 2024 and February 2025), at the same address or, if the address had changed, the one the 2024 homepage linked to.
Reading. Policies with no mention of AI, machine learning or training models anywhere in the text were recorded as silent. Every other policy was read in full by an AI model against a fixed written rulebook, which had to quote the exact sentence behind each answer. A script checked that every quote appears in the policy, and we reviewed every quote behind an AI training answer by hand. A second, independent reading of a random 40 policies agreed on whether the policy says it trains AI on user data in 40 of 40 cases.
Definitions. "Trains" means the policy says personal information or user content is used to train, develop or improve AI or machine learning models, including as one item in a list of purposes. "May train" means the sentence itself is hedged. An opt-out counts only when it is specific to AI training. Public data alone, such as Google's statement about publicly available information, is not counted as training on users' data.
Limits. A privacy policy says what a company reserves the right to do, not what it does. Some companies describe AI training in separate documents we did not read, so the figures are a floor. Where several sites share one policy, each site counts once in the totals.
Use these figures
The figures and charts are free to reuse in articles, reports and talks. Please credit PolicyForge and link to this page.
PolicyForge (2026). Your Data, Their AI: What 575 Top US Privacy Policies Say About AI Training. https://policyforge.co/research/ai-training-privacy-policy-study
Download the totals (CSV)Frequently asked questions
Do websites use my data to train AI?
Many now say so. Of 575 privacy policies from the most visited websites in the United States, 20% say the company trains, or may train, AI or machine learning models on users' personal information. Most of them do not say which information, and 87% give no way to opt out of that use.
Has this changed since 2024?
Yes. On the 441 sites where we could compare today's policy with an Internet Archive copy from late 2024, the share saying they train AI on user data rose from 8% to 19%. Of the policies that say it today and had a 2024 copy, 51 of 84 added the language after late 2024.
Can I opt out of AI training?
Rarely, going by the policies. Only 11 of the 117 policies that mention training offer a specific way to opt out or object, and 4 say they ask for consent first. The rest describe general privacy rights, such as deletion, that are not tied to AI training.
What does "may train" mean in a privacy policy?
Some policies say the company "may" use personal information to train AI. We count those separately from direct statements (43 of the 117 policies use "may"), but in both cases the policy reserves the right to do it.
Why do some policies only promise Connecticut residents that their data will not train AI?
Connecticut amended its privacy law in 2025 (Public Act 25-113). From July 1, 2026, a privacy notice must say whether the company collects, uses or sells personal data to train large language models. Some companies answered with a statement limited to Connecticut residents.
Can I use these figures?
Yes. The figures and charts are free to reuse in articles, reports and talks, as long as you credit PolicyForge and link to this page. The totals are available as a CSV download.
Sources
- FTC, AI (and other) companies: quietly changing your terms of service could be unfair or deceptive (February 2024)
- Connecticut Public Act 25-113 (SB 1295), amendments to the Connecticut Data Privacy Act
- Chrome UX Report (CrUX), Google
- CrUX top sites lists by country (zakird/crux-top-lists)
- Internet Archive Wayback Machine
This study describes what privacy policies said when we collected them. It is general information, not legal advice, and it does not say whether any company complies with the law or what it does in practice.