In short. A Directory plugin privacy policy must explain its personal data categories, purposes, recipients, retention timelines, and user controls.
Definition: A ChatGPT Directory plugin privacy policy is the published notice that explains what personal data the plugin collects, why it uses it, who receives it, how long it keeps it, and what controls it offers. OpenAI's submission guidelines require these disclosures at minimum.
Key facts
- OpenAI requires each plugin submission to include a clear, published privacy policy covering the categories of personal data collected, purposes of use, categories of recipients, retention timelines, and user controls in its plugin submission guidelines.
- Users can review the policy before installing the plugin, and the plugin must follow the policy at all times.
- The same guidelines require collection of only the minimum data needed for the plugin's function. They also require tracking or behavioral profiling, including metadata such as timestamps, IP addresses, or query patterns, to be explicitly disclosed, narrowly scoped, and subject to meaningful user control.
- Article 13 of the GDPR on EUR-Lex requires information about the controller, purposes and legal basis, recipients, and certain international transfers when personal data is collected from the data subject.
- Article 13 also names retention, access and erasure rights, consent withdrawal where relevant, complaints, whether data provision is required, and automated decision-making information as further notice elements.
What does OpenAI require for a Directory submission?
OpenAI's submission guidelines describe a privacy policy as a publication requirement for plugins in the universal directory shared by ChatGPT and Codex. The minimum content is specific: categories of personal data, purposes of use, recipient categories, retention timelines, and controls offered to users. The policy is part of the experience a user can review before installation, and the plugin is expected to follow it throughout its operation.
The page also connects the policy to the plugin's data collection. It requires only the minimum data needed for the function and says that inputs should be specific, narrowly scoped, and explicitly linked to the task. For sensitive or special category data, the guidelines require strict necessity, legally adequate consent, and explicit, prominent disclosure at or before collection.
Which data practices need particular explanation?
The policy should describe any tracking, surveillance, or behavioral profiling in terms that match the actual implementation. OpenAI's guidelines expressly include metadata collection such as timestamps, IP addresses, and query patterns. These practices are permitted by the guidelines only when they are explicitly disclosed, narrowly scoped, subject to meaningful user control, and aligned with OpenAI's usage policies.
Tool inputs and outputs also affect the disclosure. The guidelines say not to request full conversation history, raw chat transcripts, or broad contextual fields merely in case they become useful. A task-specific intent field is acceptable only when it meaningfully improves execution and stays within the purposes described in the privacy policy. Responses must return only data directly relevant to the request and stated tool purpose.
What additional fields can Article 13 require?
Article 13 of the GDPR states that, when personal data is collected from the data subject, the controller provides information at the time of collection. The listed fields include the controller's identity and contact details, the data protection officer's contact details where applicable, the purposes and legal basis, recipients, and certain transfers to a third country or international organisation.
The article adds a retention period or the criteria used to determine it. It also names rights of access, rectification, erasure, restriction, objection, and data portability, plus consent withdrawal where the legal basis is consent and the right to complain to a supervisory authority. Where applicable, the notice covers whether providing the data is required and meaningful information about automated decision-making, including profiling.
A compact review checklist is:
Categories of personal data collected
Purposes of use and legal basis
Categories of recipients
Data retention timeline or criteria
Controls and applicable user rights
Tracking, profiling, transfers, and automated decision-making where applicable
Related terms
FAQ
What five items must you include for OpenAI's minimum?
You need the categories of personal data collected, purposes of use, categories of recipients, retention timelines, and controls offered to users. OpenAI also requires the policy to be clear, published, and followed by the plugin.
Does the policy need an exact retention period?
OpenAI requires retention timelines. Article 13 allows a retention period or, where that is not possible, the criteria used to determine the period.
Do you have to describe analytics or tracking?
Yes, when the plugin uses surveillance, tracking, or behavioral profiling. OpenAI's guidelines identify timestamps, IP addresses, and query patterns as examples of metadata and require explicit disclosure and meaningful user control for those practices.
Sources
- OpenAI Developers, "Plugin guidelines - Plugins", undated
- EUR-Lex, "Regulation - 2016/679 - EN - gdpr", 27 April 2016
Check how a page reads to answer engines. Open the GEO score analyzer