Mandatory individual arbitration, combined with class action and jury trial waivers, severely restricts access to justice. The initiating party bears all filing fees, and potential venue requirements in San Francisco or Dublin create geographic and financial barriers.
Security commitments and independent audit reports are strong, but the document defers to a separate DPA for personal data handling and omits explicit breach notification timelines or direct consumer rights invocation.
Customer indemnification is reasonably scoped to breaches, applications, and customer content, excluding OpenAI’s own negligence. However, the asymmetry leaves customers bearing broader third-party claim risks than OpenAI.
Fees are strictly non-refundable and minimum commitments are non-cancellable, creating significant financial lock-in. While price changes require 14 days' notice, the lack of proration or transparent cancellation mechanics harms consumer flexibility.
Explicit clickwrap agreement is present, but silent acceptance via "use of the Services" introduces browsewrap risk. The scope is narrowly defined to business and developer accounts, explicitly excluding general consumers.
Material changes require at least 30 days’ advance notice and apply prospectively, with a clear right to terminate if the customer disagrees. Silent acceptance via continued use is standard but slightly less protective than active re-consent.
Suspension can occur immediately for policy violations or security emergencies without a cure period, and the contract lacks explicit data export rights upon termination. Account closure relies on a 30-day deletion window rather than proactive data portability.
Liability caps are reasonable and tied to actual payments, with clear carve-outs for gross negligence, willful misconduct, and non-waivable statutory rights. The language is conspicuous and preserves meaningful remedies.
Customers retain full ownership of input and output, with OpenAI granted only a narrow license necessary to deliver the service. The contract explicitly prohibits training models on customer content without separate consent.