AI App Privacy Policy Checklist: What AI Apps Must Disclose
AI apps face privacy requirements that go beyond standard app privacy policies. If your app sends user prompts, images, or audio to an AI model provider like OpenAI, Anthropic, or Google, your privacy policy must disclose what data is sent, which providers process it, how long it is retained, and whether it is used for model training. This article is a companion to our general privacy policy requirements guide, focused specifically on the additional disclosures AI apps need.
Quick checklist: AI-specific privacy disclosures
| Disclosure | Required? |
|---|---|
| What user data is sent to AI providers | Yes |
| Which AI provider(s) process the data | Yes |
| Whether data is used for model training | Yes |
| Data retention period for AI inputs/outputs | Yes |
| Whether AI is used for automated decisions | If applicable |
| How users can opt out of data processing | Yes |
| Account deletion mechanism | Yes (if accounts exist) |
Why AI apps need a different privacy policy
Standard app privacy policies cover data collection, usage, and sharing. AI apps add another layer: user inputs (prompts, images, audio) are sent to third-party AI providers for processing. This creates additional data sharing that must be disclosed. Users have a right to know that their prompts, photos, or voice recordings are being sent to OpenAI, Anthropic, or Google — and whether those providers use the data to train their models.
Both Apple and Google have increased scrutiny of AI apps' privacy disclosures. The Google Play Data Safety form requires you to declare data sharing with third parties, including AI providers. App Store privacy labels require you to declare data linked to the user and used for tracking — AI processing often falls into both categories.
Implementation checklist
1. List every AI provider
Document every AI service your app uses: OpenAI, Anthropic, Google Gemini, Stability AI, local models. For each provider, state what data is sent (text prompts, images, audio) and what the provider's data retention and training policy is. Link to each provider's privacy policy.
2. Disclose data retention
State how long you retain AI inputs and outputs. If your provider retains data for 30 days, disclose that. If you store conversation history in your own database, state the retention period and how users can request deletion.
3. Address model training
Explicitly state whether user data is used to train AI models. If you use an API provider that does not use customer data for training (like OpenAI's API tier), state that. If your provider may use data for training, disclose it and provide an opt-out mechanism.
4. Disclose automated decision-making
If your AI app makes decisions that affect users (e.g., automated content moderation, AI-powered eligibility checks), disclose this and explain how users can appeal or request human review.
5. Align with store privacy labels
Ensure your App Store privacy labels and Google Play Data Safety form match your privacy policy. If your policy says you share data with AI providers, the store forms must reflect that. Mismatches trigger rejection.
6. Provide opt-out and deletion
Give users a way to opt out of AI processing (e.g., use a non-AI fallback mode) and a way to delete their AI data (conversation history, uploaded images). Link to your account deletion flow if applicable.
Common rejection mistakes
- Undeclared AI provider: The app sends prompts to OpenAI but the privacy policy doesn't mention it.
- Training data ambiguity: The policy doesn't clearly state whether user data is used for model training.
- Store label mismatch: The privacy policy mentions AI data sharing, but the App Store privacy labels say "no data sharing."
- No retention policy: The policy doesn't state how long AI inputs/outputs are stored.
- Missing opt-out: Users have no way to opt out of AI processing or delete their AI data.
Before you submit
AI app privacy compliance is under increasing scrutiny from both Apple and Google. Run a free Launch Score check to audit your app's privacy disclosures, SDK data collection, and AI provider integration before submitting.
Frequently asked questions
What should an AI app privacy policy include?
An AI app privacy policy must disclose what user data is sent to AI providers, which providers process it, whether data is used for model training, data retention periods, and how users can opt out. It should also cover automated decision-making if applicable.
Do I need to disclose which AI provider my app uses?
Yes. Your privacy policy must list every AI provider your app sends data to (OpenAI, Anthropic, Google, etc.), what data is sent, and link to each provider's privacy policy. This must also match your App Store privacy labels and Google Play Data Safety form.
Can users opt out of AI processing in my app?
Your app should provide a way for users to opt out of AI processing, such as a non-AI fallback mode, and a way to delete their AI data (conversation history, uploaded images). If you offer account creation, link the AI data deletion to your account deletion flow.