What do OpenAI, Anthropic and Google's API terms mean for my product?

If your product sends prompts to a model from OpenAI, Anthropic, Google or another provider, you’ve signed up to their terms, usually by clicking through. Those terms decide who owns the output, what the provider does with your customers’ data, what your users may not do, and what protection you get if someone claims the output infringes their rights. You can’t promise your customers more than your provider promises you.

Provider terms change often. What follows reflects the terms on each provider’s site as we read them on October 30, 2026. Check the current version before relying on it, and check which version you accepted.

Who owns the output?

As between you and the provider, the major business terms give output to the customer:

• OpenAI. The Services Agreement says the customer retains ownership of input and owns output, to the extent permitted by law, and OpenAI assigns its rights in output, if any. It also says output may not be unique.
• Anthropic. The Commercial Terms say the customer retains its rights to inputs and owns its outputs, and Anthropic assigns its rights in outputs, if any, subject to the customer complying with the terms.
• Google. The Gemini API Additional Terms say Google won’t claim ownership of generated content, and that it may generate the same or similar content for others.

These are contract allocations between you and the provider. They don’t decide whether the output is protected by copyright at all, which Canadian law hasn’t settled. See who owns AI-generated content.

Does the provider train on our API data?

On the terms we reviewed:

Provider	What the terms say about training
OpenAI	Will not use customer content to develop or improve its services unless the customer explicitly agrees. Its privacy page says API data isn’t used for training by default.
Anthropic	Commercial terms say Anthropic may not train models on customer content from the services.
Google Gemini API	For unpaid services, Google uses submitted content and responses to improve its products, and human reviewers may read them. For paid services, Google says it doesn’t use prompts or responses to improve its products.

The Google distinction matters for startups prototyping on free quota. If customer data, especially personal information, goes through an unpaid tier, it may be used in ways your privacy policy doesn’t describe.

What about retention, zero data retention and residency?

Not training on data isn’t the same as not keeping it. OpenAI’s enterprise privacy page says it may retain API inputs and outputs for up to 30 days to provide the services and identify abuse, with exceptions for some endpoints, and that eligible customers can request zero data retention for qualifying use cases. Google’s terms say it logs paid-service prompts and responses for a limited period to detect policy violations.

Data residency options vary by provider, product and plan, and change frequently. If customers ask where data is processed, get the answer in writing from your provider for your account, not from a marketing page. Under Principle 4.1.3 of PIPEDA’s Schedule 1, you stay responsible for personal information you transfer to a provider for processing. If you handle Quebec residents’ information, section 17 of Quebec’s private sector act requires a privacy impact assessment before communicating it outside Quebec. See can we store Canadian data outside Canada.

Do the provider’s usage policies bind our customers?

In practice, yes. OpenAI’s agreement requires the customer not to let its end users break the law or OpenAI’s policies, Anthropic’s terms require the customer and its users to comply with its Usage Policy, and Google’s terms incorporate its Prohibited Use Policy. If your customer misuses your product in a way that breaches the provider’s policy, it’s your account at risk. Your acceptable use policy should pass those restrictions down, and your terms should let you suspend users who breach them.

Will the provider cover IP claims about output?

Some providers offer an indemnity, with conditions:

• Anthropic’s Commercial Terms say it will defend the customer against third-party claims that the customer’s paid, authorized use of the services, or outputs generated through that use, infringe intellectual property rights, with listed exclusions.
• OpenAI’s Services Agreement includes an indemnity for claims that the services infringe third-party IP rights, with exclusions such as customer content and combinations with non-OpenAI products, and incorporates a separate service-specific indemnity.

Both run in the other direction too: you indemnify the provider for claims arising from your inputs and from use that breaks their policies. Read the exclusions closely, and don’t give customers an output indemnity broader than the one you receive. See indemnity clauses.

How do we mirror this in our own terms?

• Ownership. Give customers ownership or a licence of output, and say output may not be unique.
• Training. State your own training position, and make sure it’s no broader than your provider’s commitment allows you to promise.
• Sub-processors. List each model provider on your sub-processor list with what it does and where it processes data, and give notice before you add or switch providers.
• DPA. Your data processing agreement should flow down terms your provider’s DPA actually supports.
• Liability. Keep output-related claims within your limitation of liability, and line up any indemnity with the provider’s.
• Model changes. Reserve the right to change underlying models, with notice where customers rely on specific behaviour.

What to do next

Pull the terms you actually accepted with each provider, note the version date, and compare them with your customer terms and privacy policy. We prepare AI product terms, SaaS agreements and privacy policies that line up with your model providers, at fixed fees on our fees page. See also terms for AI products and our AI Law Tracker.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your model stack, book a free 15-minute consult.