Worth Knowing

The change itself is small. The placement is the story.

The US version of OpenAI's privacy policy added a new "Your Other Rights" section this week — a four-item enumeration: the right to know, the right to request deletion, the right to correct, and "the right to be free from retaliation relating to the exercise of any of your privacy rights." It closes with a new disclosure link: "Review our California privacy rights reporting here," pointing to a dedicated California rights reporting page that wasn't previously published.

Read on its own, this looks like routine compliance clean-up. Read in context, it's a more deliberate move.

The new section was inserted directly after the paragraph defining "targeted advertising" and "cross-context behavioral advertising" and the opt-out mechanism for it — the same paragraph we built the prior issue's RED story around. The rights enumeration now sits as a companion paragraph to the disclosure that ChatGPT Free and Go users participate in cross-context behavioral advertising.

That placement is editorial. Rights enumerations usually float at the top of a privacy policy's rights section, alongside the access-and-deletion mechanics. This one was inserted further down, directly into the ad-infrastructure section. OpenAI is supplementing the ad disclosure with rights infrastructure, not its general consumer-protections framing. The dedicated California rights reporting URL — a fresh piece of public-facing compliance content — landed in the same revision.

This is the kind of placement choice that tends to appear when a disclosure starts attracting regulatory attention. The ad infrastructure didn't change this week. The protective scaffolding around the ad disclosure did.

Why this matters: OpenAI is layering rights language directly into the section where its cross-context advertising practices are disclosed, and publishing a dedicated California rights reporting page in the same revision. Both moves suggest the ad infrastructure we've been tracking is now operating under closer compliance attention — which historically precedes either voluntary tightening or formal regulatory action.

In human terms: A privacy officer at a creative agency is doing an annual review of which AI tools their team can use for client work. They open OpenAI's US privacy policy. The cross-context advertising disclosure is still there. But now, directly underneath it, sits an enumerated rights list and a California-specific reporting page. The policy reads differently than it did six weeks ago — not because OpenAI changed what it does with user data, but because OpenAI is now more carefully showing its work around the rights it has to provide.