Perplexity AI Privacy Policy: What It Actually Says, What It Doesn't, and What the Lawsuits Revealed

The Perplexity AI privacy policy is one of the most scrutinized documents in the AI industry right now, and for good reason. A $22.6 billion valuation, a class-action lawsuit alleging data was routed to Meta and Google, a separate scraping suit from Reddit, and a German data-protection analysis that found no GDPR-compliant consent mechanism. If you use Perplexity or are evaluating it, the privacy policy is the document you need to read with precision. This piece does that reading for you, section by section, with citations.

Key Takeaways

• Perplexity collects every search query, every AI response, uploaded files, and standard account information. AI model training on consumer data is opt-out, not opt-in, by default.
• A class-action lawsuit alleged Perplexity embedded tracking pixels that sent user conversations to Meta and Google even in "incognito mode." The suit was voluntarily dismissed in May 2026 without resolving the underlying claims.
• Enterprise customers get a no-training guarantee, but downgrading to a free or non-enterprise plan reverts you to the standard consumer policy. The API side maintains a zero-data-retention policy that the consumer product does not.
• Independent European analysis found Perplexity relies on "legitimate interest" rather than granular consent for GDPR purposes, and no third-party audit report has been made public.
• Retention timelines are vague: deleted accounts are purged within 30 days, but the policy does not specify how long search queries or "deidentified" data persist.

What Data Does Perplexity Actually Collect?

Everything you type, everything it responds with, and everything you upload. The current policy, effective February 5, 2026, covers account information (email, payment details), every search query entered, every AI-generated response returned, and any files you attach. This is comprehensive collection. If you interact with the product, the interaction is logged.

Standard metadata is collected too: IP addresses, device identifiers, browser type, rough geolocation. None of this is unusual for a web application. What makes it worth flagging is the combination: conversational content plus behavioral metadata plus the training defaults described below.

Is Your Data Used to Train Perplexity's Models?

Yes, by default, if you are on a consumer plan. The policy provides an opt-out toggle in your account settings, but you have to find it and flip it yourself. This is a design choice, not a technical constraint. We know it is a design choice because Perplexity's own API documentation describes a zero-data-retention policy for its Chat Completions API, where data sent through the API is not retained and not used for training. The technical capability for stricter defaults exists. It is applied to the API tier. It is not applied to the consumer product.

This is the opt-out vs. opt-in distinction that matters most. An opt-out default means every user who does not actively change their settings contributes their queries to training data. Given that most users never touch settings pages, this is effectively a universal-training-consent architecture for the consumer base.

What About Enterprise Accounts?

Enterprise customers get a stronger guarantee: organizational data is not used for AI training under any circumstances. This is the clearest line in the policy. But there is a catch. If an enterprise user downgrades to a free or non-enterprise plan, the standard consumer policy takes effect. The no-training guarantee evaporates with the subscription.

This two-tier structure (strict for enterprise, permissive for consumer) is common across the industry. It is worth understanding because it reveals the business logic: enterprise customers pay enough to justify data isolation, consumer users pay with their data. Neither arrangement is hidden. Both are stated in the policy. But the asymmetry is significant if you assumed your Pro subscription carried the same protections as an enterprise agreement.

How Long Does Perplexity Retain Your Data?

The policy is vague on this, and the vagueness itself is the finding. The one concrete timeline: deleted accounts are purged within 30 days. Beyond that, the policy does not specify exact retention periods for search queries or clarify when "deidentified" data reaches a state that could genuinely be called anonymous.

"Deidentified" is doing heavy lifting here. In privacy engineering, deidentification ranges from trivially reversible (strip the email, keep everything else) to genuinely irreversible (differential privacy with strong epsilon bounds). The policy does not say which end of that spectrum applies. Without that specificity, "deidentified" is a label, not an assurance.

Compare this to the API's zero-data-retention stance, where no data is retained beyond the immediate request. The consumer product could adopt a similar posture. It has not.

What Did the Class-Action Lawsuit Allege?

A class-action suit filed in San Francisco federal court on March 31, 2026, alleged that Perplexity embedded Meta Pixel, Google Ads, DoubleClick, and Meta's Conversions API trackers into its product. According to the complaint, these trackers transmitted user conversations (prompts, responses, email addresses, IP addresses, device information) to Meta and Google. The complaint specifically alleged this happened even when users activated Perplexity's "incognito mode," which the filing called a "sham."

This is a technical claim worth understanding. Browser-level incognito modes and product-level "incognito" toggles are not the same thing, and neither protects against server-side tracking pixels. If a company embeds a Meta Pixel on the page where you type a query, the pixel fires when the page loads or when you submit the form. Your browser's incognito mode prevents local cookie storage. It does not prevent the pixel from sending data to Meta's servers. A product-level incognito mode could, in theory, suppress those pixels, but only if the product explicitly disables them in that mode.

The allegation, in short, was that Perplexity's incognito mode did not suppress third-party trackers, and that users were misled into believing their conversations were private when they were being forwarded to advertising platforms.

Was the Lawsuit Resolved?

No. The class action was voluntarily dismissed on May 1, 2026. Voluntary dismissal means the plaintiffs withdrew the case. It does not mean the claims were adjudicated, disproven, or settled. The core privacy questions remain unresolved. A voluntary dismissal without prejudice typically allows refiling, so this story may not be over.

Perplexity subsequently updated its terms of service to add detail about cookies and first-party advertising measurement, and explicitly stated that it does not sell personal data or send queries, prompts, or conversation content to advertisers. This update reads as a direct response to the tracker allegations. Whether the technical implementation matches the updated terms is a question that only an independent audit could answer.

What About the Reddit Scraping Lawsuit?

Reddit filed a separate suit alleging Perplexity unlawfully scraped Reddit content to train AI models despite explicit technical blocks. The complaint included a notable detail: Reddit allegedly set a hidden "trap" post, accessible only via Google's licensed search index, to prove that Perplexity was bypassing access restrictions. Third-party scraping firms were named as co-defendants.

This is a different flavor of privacy concern. It is not about user data within Perplexity's product. It is about Perplexity's data-acquisition practices for the content it uses to generate answers. If the tool you rely on for information was built by circumventing other platforms' access controls, that is a supply-chain trust question. The data in Perplexity's answers has a provenance, and that provenance is now disputed in court.

What Does the Amazon Comet Browser Case Add?

Amazon sued Perplexity in November 2025 over its Comet browser, alleging that AI agents built into the browser accessed Amazon's marketplace without authorization. A federal court issued a preliminary injunction on March 9, 2026, blocking access to password-protected account sections. Perplexity appealed on April 1, 2026. Major publishers backed Amazon in an amicus brief filed April 29, 2026 via Digital Content Next.

This case expands the privacy boundary. It is not just about what data Perplexity collects from you. It is about what data Perplexity's AI agents collect from other platforms on your behalf (or on its own behalf), and whether that collection is authorized. If an AI agent logs into your Amazon account and pulls data, whose privacy policy governs that interaction? Amazon's? Perplexity's? Yours? The preliminary injunction suggests courts are leaning toward treating unauthorized AI-agent access the same as unauthorized human access.

Does Perplexity Comply with GDPR?

Not convincingly, according to at least one independent European analysis. A German data-protection review by heyData found that Perplexity lacks a GDPR-compliant granular consent mechanism. Instead, the company relies on "legitimate interest" as its legal basis for data processing. Under GDPR, legitimate interest is one of six lawful bases, but it requires a balancing test: the company's interest must not override the fundamental rights of the data subject. For AI training on conversational data, that balancing test is difficult to pass, especially when users do not clearly understand what data is being processed.

More critically, no EU data protection authority has documented an official audit of Perplexity. No publicly available audit report exists for GDPR or HIPAA compliance. Every compliance claim currently rests on self-disclosure. This is the gap between "we comply" and "a qualified third party verified that we comply." The two are not equivalent.

California's CPPA has indicated that AI systems are a priority enforcement area in 2026, which means U.S. regulatory attention is coming too, not just European.

What Is the Difference Between Self-Attested and Audited Compliance?

Self-attested compliance means a company writes a privacy policy, publishes a security page, and says "we follow these standards." Audited compliance means an independent third party (typically a SOC 2 Type II auditor, or a DPA-recognized certification body in the EU) has examined the company's actual systems, tested controls, and issued a report. Perplexity has a security hub and recently founded a "Secure Intelligence Institute" for privacy and safety research. These are positive signals. They are not audit reports.

For a user deciding whether to type sensitive queries into an AI tool, the distinction matters. A security page describes intent. An audit report describes verified state. If you are making decisions about where your data goes, look for the audit report, not the marketing page.

How Does All of This Compare to What Privacy-First Should Look Like?

A genuinely privacy-first architecture would look different from what Perplexity's policy describes. Training on user data would be opt-in, not opt-out. Retention periods would be specified in concrete terms, not left vague. "Deidentified" would be defined with technical precision. Third-party tracking pixels would not exist on pages where users type sensitive queries. And compliance claims would be backed by independent audits, not self-attestation.

Some of these are hard engineering problems. Most are not. Opt-in vs. opt-out is a boolean in a settings table. Specifying retention periods is a policy decision, not a technical constraint. Removing third-party trackers from sensitive pages is a few lines of configuration. The fact that these choices are made in the permissive direction is a business decision, not a technical limitation.

At Selina, we built a different set of defaults. Memory is adaptive and encrypted at rest. Files and transfers via SelinaSEND are end-to-end encrypted. We run on a stack of frontier models, routed per task, via API. The account is protected, not a black box. Delete means gone. Actually gone. We are not perfect, and memory is not end-to-end encrypted (a slice of each request reaches a frontier provider at inference). But the defaults point in the other direction: toward the user, not toward the training pipeline.

What Should You Do Right Now?

If you use Perplexity on a consumer plan, go to your settings and check whether AI training is toggled on. It almost certainly is. Decide whether that is acceptable to you. If you are on an enterprise plan, confirm your contract includes the no-training clause and understand what happens if you ever downgrade.

Read the actual policy, not a summary. The privacy policy and terms of service are the binding documents. Blog posts (including this one) are commentary.

Consider what you type. Every query in a consumer AI tool with default training enabled is, functionally, a contribution to a training dataset. Treat the input field accordingly. If you would not put it in a public forum post, reconsider typing it into a tool that trains on your input by default.

And if the defaults bother you, look for tools where the defaults point the other way. Start a free 7-day trial of Selina, no card required, and see what privacy-first defaults feel like in practice.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io