Methodology

Terms of (Ab)Use: An Analysis of GenAI Services

The goal of our study was to analyse the terms that GenAI services require consumers to accept, and to assess whether they are transparent and fair to users. To implement this, we developed a codebook and used it to identify information from the terms. We then analysed and discussed the findings to identify implications regarding consumer experiences and the law.

On this page you can find our scoping methodology, list of analysed documents, and our annotation codebook.

Scope

For this study, we limited the scope to only analyse consumer uses of GenAI services, and excluded enterprise services and features. We chose two providers each for the following criteria: established big-tech actors -- Google (Gemini), Microsoft (Copilot), emergent non-US providers -- Mistral (LeChat, France), Deepseek (China), and new prominent providers -- OpenAI (ChatGPT), Anthropic (Claude).

To identify relevant terms, we used the links provided in the web interface of each service. When the linked terms document involved hyperlinks to other documents, we only included the linked documents if they were clearly mentioned as being `part of the terms'. We specifically did not consider linked documents that were mentioned as informational or providing guidance, as our goal was to study the terms as a contractually binding provision. Following this rule, we only included `privacy policies', `acceptable use', and similar documents only when they were referenced as being part of the terms.

Analysed Terms

Claude (Anthropic) https://claude.ai/
1. Consumer Terms https://www.anthropic.com/legal/consumer-terms (dated 8 October 2025)
2. Privacy Policy https://www.anthropic.com/legal/privacy
3. Usage Policy https://www.anthropic.com/legal/aup
DeepSeek https://chat.deepseek.com
1. Terms of Use https://cdn.deepseek.com/policies/en-US/deepseek-terms-of-use.html (dated 28 April 2025)
2. Privacy Policy https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
3. Open Platform Terms of Service https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html
Gemini (Google) https://gemini.google.com
1. Policies and Terms https://policies.google.com/ which provides link to terms
2. Terms of Service https://policies.google.com/terms (dated 22 May 2024)
3. Generative AI-Prohibited Use Policy https://policies.google.com/terms/generative-ai/use-policy
4. Service-specific additional terms and policies https://policies.google.com/terms/service-specific which contains entry for ‘Gemini Apps’ and provides same links to Terms and Generative AI Policy as above
Copilot (Microsoft) https://www.copilot.com/
1. ‘terms’ link https://www.bing.com/new/termsofuse?utm_source=copilot.com is redirected to landing page https://www.microsoft.com/en-ie/microsoft-copilot/for-individuals?form=MA13YT. On this page, the link to ‘Copilot Terms’ https://aka.ms/consumercopilotterms redirects to the same landing page. Another link ‘Terms of Use’ https://go.microsoft.com/fwlink/?LinkID=206977 redirects to terms https://www.microsoft.com/en-us/legal/terms-of-use (dated 2 February 2022)
2. Privacy Statement http://go.microsoft.com/fwlink/?linkid=248681 which is redirected to https://www.microsoft.com/en-gb/privacy/privacystatement
3. Services Agreement https://www.microsoft.com/en-us/servicesagreement
4. Bing Image Creator and Bing Video Creator Terms of Use https://www.bing.com/new/termsofuseimagecreator
5. Web search (using Bing) led to ‘Copilot Terms of Use’ https://www.microsoft.com/en-us/microsoft-copilot/for-individuals/termsofuse which were not linked in any of the above pages
Le Chat (Mistral) https://chat.mistral.ai/
1. Legal terms and conditions https://mistral.ai/terms/#terms-of-service which redirects to https://legal.mistral.ai/terms (dated 27 May 2025)
ChatGPT (OpenAI) https://chatgpt.com/
1. Terms & Policies https://openai.com/policies/ which provides links to Europe Terms of Use https://openai.com/policies/terms-of-use/ (dated 29 April 2025)
2. Service Terms https://openai.com/policies/service-terms/
3. Usage Policies https://openai.com/policies/usage-policies/
4. Sharing & Publication Policy https://openai.com/policies/sharing-publication-policy/
5. Service Credit Terms https://openai.com/policies/service-credit-terms/
6. Transparency & Content Moderation https://openai.com/transparency-and-content-moderation/
7. How your data is used to improve model performance https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/
8. Privacy Policy https://openai.com/policies/eu-privacy-policy/ was linked but not included for analysis as the terms stated: “Although it does not form part of these Terms...”

Codebook

The codebook fields each have an assigned ID, Field/Question, columns ‘Info on main page’ and ‘Info on secondary page’ to document whether information was found in the terms document other (secondary) linked documents, Notes for annotator to record observations, and Example provide indicative phrases that may be used in terms to find this information. The two info columns contain an enumerated list of options for most questions from which annotators select the most applicable option if present, and use the notes column to record additional information.

Metadata
1. Timestamp of annotation
2. Annotator identifier
3. Target
4. Link to archived terms (folder)
5. Additional Links found during annotation
6. Terms structure
  1. Single page / monolithic
  2. Paginated / multiple pages
  3. Single page with links to other non-terms pages
7. Same terms used for free or paid services? (Sample: If you are a free user…; If you have an account with us)
  1. Terms apply for free services
  2. Terms apply for paid services
  3. Same terms apply for free and paid services
Service Provision
1. Is what constitutes as the ‘Service’ described with a specific name? Sample: These terms relate to ChatGPT, Service is defined as xyz
  1. Yes, the Service is described + text field
  2. No, the Service is not described
2. If the Service is described, are specific features or functionalities described as part of the Service? Sample: By service we mean the ability to use the model; Features such as image generation
  1. Yes, the Service is described + text field
  2. No, the Service is not described
3. Do the terms mention how user will be informed and can control changes to the service? Sample: We may change the Service at our discretion without prior notice or warning; Where we change our model, we will allow users to opt-in to the model
  1. Yes, the terms explicitly mention that the Service will not change unless the User enables it
  2. No, the terms explicitly mention that the Service will change and the User will be given a notice period
  3. No, the terms explicitly mention that the Service will change but do not state how the User will be informed about this
  4. No, the terms do not state whether the Service will change
4. Do the terms describe the Service in terms of specific quality? Sample: We have a 99% uptime; Our models are guaranteed to provide correct output 99% of the time Note: Mentioning the model hallucinates is NOT a quality metric unless it is accompanied with information on when/how much
  1. Yes, quality metrics are described regarding (e.g. speed of responses)
  2. Yes, quality metrics are described regarding accuracy (e.g. accuracy of responses)
  3. Yes, quality metrics are described regarding availability (e.g. uptime)
  4. Yes, other quality metrics are provided + text
  5. No, quality metrics are not provided
5. If quality metrics are described, do the terms provide any assurances or claims or guarantees regarding them? Sample: We guarantee xyz with %, We will provide xyz with %
  1. Yes, assurances or guarantee is mentioned
  2. No, assurances or guarantee is not mentioned
Service Usage - Inputs
1. Combined concept for both inputs and outputs?
2. Are inputs and outputs declared as personal data?
3. What forms or modalities can the User provide their input as? Sample: You can provide input through the service or by uploading a picture
  1. Text
  2. Images
  3. Videos
  4. Audio
  5. Not mentioned
4. What sources can the User provide their input as?
  1. Directly entering it into the Service (e.g. typing, uploading)
  2. Through the use of their Device (e.g. Camera, GPS)
  3. Third Party (e.g. Siri)
  4. Not mentioned
5. Are there restrictions regarding what input is exclusively permitted? Sample: We only allow you to upload; We only accept input
  1. Yes, the terms mention exclusively what input is permitted + text
  2. “Everything is permitted” is explicitly mentioned
  3. Not mentioned
6. Are there restrictions regarding what input is prohibited? Sample: We prohibit content where; We do not accept input
  1. Yes, the terms mention prohibited input + text
  2. “No prohibitions” is explicitly mentioned
  3. Not mentioned
7. Is reverse engineering explicitly prohibitied?
8. Are there restrictions regarding the scope of input such that the Service is only described as intended for the scope?
  1. Yes, specific input categories are described as the scope + text
  2. Nothing is out of scope is explicitly mentioned
  3. Not mentioned
9. How do the terms describe the ownership and retention of rights regarding the provided User input?
  1. User retains ownership, and Service provider is granted rights only for the Service
  2. User retains ownership, and Service provider is granted rights for the Service as well as any other use
  3. Rights are transferred from the User to the Service Provider
  4. Not mentioned
10. How do the terms describe the use of User input for further training or refinement of Model by the service provider?
  1. Inputs will be used for training/refinement
  2. Inputs will not be used for training/refinement
  3. Not mentioned
11. If User input will be used for further training or refinement of the Model, what options or controls does the User have?
  1. User has no controls
  2. User must opt-in and information is provided on how to do this
  3. User must opt-in but no information is provided on how to do this
  4. User must opt-out and information is provided on how to do this
  5. User must opt-out but no information is provided on how to do this
  6. Not mentioned
12. Will the User input be used for other purposes beyond training or refinement of the Model?
  1. Inputs will be used for analysis or measurements regarding the Service
  2. Inputs will be used for research and product development
  3. Other + text
  4. Not mentioned
13. Will the User input be shared with Third Parties?
  1. Yes
  2. No
  3. Not mentioned
14. If User input will be shared with Third Parties, are these third parties identified?
  1. Yes, the identities of Third Parties are provided
  2. Yes, the categories of Third Parties are provided
  3. Not mentioned
15. If User input will be shared with Third Parties, are the specific purposes for why they will be shared mentioned?
  1. Yes + text
  2. Not mentioned
16. If User input will be shared with Third Parties, will it be in a privacy preserving form?
  1. Yes, and specific measures are provided + text
  2. Yes, but specific measures are not provided
  3. Not mentioned
17. When submitting input, what responsibilities are allocated to the User regarding the validity of inputs?
  1. Copyright violation does not occur
  2. Input meets safety standards and these are mentioned + text
  3. Input meets safety standards but these not mentioned
  4. Other + text
  5. Not mentioned
18. If the input does not meet the validity requirements, is the resulting liability explicitly clarified?
  1. Yes, User assumes liability
  2. Yes, User and Service share liability
  3. Yes, Service assumes liability
  4. Not mentioned
19. Does the service provider use filtering or detection mechanisms over user input?
  1. Yes, and specific measures are provided + text
  2. Yes, but specific measures are not provided
  3. Not mentioned
20. What happens if the filtering/detection mechanism detects a violation or problem regarding the user input?
  1. User may lose access to the Service
  2. User assumes liability
  3. Other + text
  4. Not mentioned
Service Usage - Outputs
1. What forms or modalities will the output be provided as?
  1. Text
  2. Images
  3. Videos
  4. Audio
  5. Not mentioned
2. How can the User access the output?
  1. Directly through the Service (e.g. see it on the website)
  2. Third Party (e.g. Siri)
  3. Publish (e.g. public access via Service)
  4. Not mentioned
3. Are there restrictions regarding what output is exclusively permitted? Sample: We will only provide; We only generate output
  1. Yes, the terms mention exclusively what output is permitted + text
  2. “Everything is permitted” is explicitly mentioned
  3. Not mentioned
4. Are there restrictions regarding what output is prohibited? Sample: We prohibit content where; We do not produce output
  1. Yes, the terms mention prohibited output + text
  2. “No prohibitions” is explicitly mentioned
  3. Not mentioned
5. Are there restrictions regarding the scope of output such that the Service is only described as intended for the scope?
  1. Yes, specific output categories are described as the scope + text
  2. Nothing is out of scope is explicitly mentioned
  3. Not mentioned
6. How do the terms describe the ownership and retention of rights regarding the output?
  1. User retains ownership with no information about rights of Service Provider
  2. User retains ownership, and Service provider is granted rights for the Service as well as any other use
  3. Rights are retained by the Service Provider
  4. Not mentioned
7. How do the terms describe the use of output for further training or refinement of Model by the Service Provider?
  1. Outputs will be used for training/refinement
  2. Outputs will not be used for training/refinement
  3. Not mentioned
8. If Output will be used for further training or refinement of the Model, what options or controls does the User have?
  1. User has no controls
  2. User must opt-in and information is provided on how to do this
  3. User must opt-in but no information is provided on how to do this
  4. User must opt-out and information is provided on how to do this
  5. User must opt-out but no information is provided on how to do this
  6. Not mentioned
9. Will the Output be used for other purposes beyond training or refinement of the Model?
  1. Outputs will be used for analysis or measurements regarding the Service
  2. Outputs will be used for research and product development
  3. Other + text
  4. Not mentioned
10. Will the Output be shared with Third Parties?
  1. Yes
  2. No
  3. Not mentioned
11. If Output will be shared with Third Parties, are these third parties identified?
  1. Yes, the identities of Third Parties are provided
  2. Yes, the categories of Third Parties are provided
  3. Not mentioned
12. If Output will be shared with Third Parties, are the specific purposes for why they will be shared mentioned?
  1. Yes + text
  2. Not mentioned
13. If Output will be shared with Third Parties, will it be in a privacy preserving form?
  1. Yes, and specific measures are provided + text
  2. Yes, but specific measures are not provided
  3. Not mentioned
14. When generating output, what responsibilities are allocated to the User regarding the validity of outputs?
  1. Copyright violation does not occur
  2. Output meets safety standards and these are mentioned + text
  3. Output meets safety standards but these not mentioned
  4. Other + text
  5. Not mentioned
15. If the output does not meet the validity requirements, is the resulting liability explicitly clarified?
  1. Yes, User assumes liability
  2. Yes, User and Service share liability
  3. Yes, Service assumes liability
  4. Not mentioned
16. Will the generated Output be subject to any form of filtering or detection?
  1. Yes and details are provided + text
  2. Yes but details are not provided
  3. Not mentioned
17. What happens if the filtering/detection mechanism detects a violation or problem regarding the outputs?
  1. User may lose access to the Service
  2. User assumes liability
  3. Other + text
  4. Not mentioned
18. For automated methods related to filtering and detection of validity, will the decision involve human oversight or confirmation, and will the user have the ability to request human review of the decision?
19. Are specific ‘risks’ or ‘issues’ identified regarding the output that would reduce the quality or cause detriments?
  1. Inaccuracy
  2. Bias
  3. Hallucination
  4. Other + text
  5. Not mentioned
20. Are there specific restrictions on the use of outputs for training or refinement of outside of the Service?
  1. No restrictions
  2. User can reuse outputs for training or refinement
  3. User cannot reuse outputs for training or refinement
  4. Not mentioned
21. Do the terms inform or warn the User regarding specific harms that may arise from the use of the service ?
  1. Yes, regarding risks to safety (e.g. mental health)
  2. Yes, regarding risks of the Service (e.g. inaccurate, unreliable)
  3. Yes + text
  4. Not mentioned
Legal
1. Is the use of the Service restricted to a specific jurisdiction? E.g. EU/EEA
  1. Yes, to EU
  2. Yes, to USA
  3. Yes, to China
  4. No restrictions
  5. Other + text
  6. Not mentioned
2. Are specific laws mentioned governing the Service? E.g. GDPR
  1. Yes, GDPR and other EU laws
  2. Other + text
  3. Not mentioned
3. Does the User’s location or jurisdiction affect the laws applicable to the Service?
  1. Yes, laws in User’s jurisdiction apply
  2. No, only those jurisdictions mentioned in the terms apply
  3. Not mentioned
4. Are there restrictions on where arbitration or legal proceedings can take place?
  1. Dispute resolution + text
  2. Arbitration + text
  3. Enforcement via courts + text
  4. Other + text
5. Do the terms explicitly include statements that create exceptions based on applicable law without specifiying which laws exist and whether they are applicable for the user in this context?