Anthropic Updates Privacy Policy: What Claude Users Need to Know

June 16, 2026

Anthropic, the AI safety company behind the Claude family of models, has rolled out a significant update to its Privacy Policy for consumer users — effective July 8, 2026. The changes introduce new rules around identity verification, data sharing for agentic AI tasks, and law enforcement cooperation, building on an earlier round of updates from late 2025 that first introduced model training consent. Here is a comprehensive breakdown of what has changed, what it means for users, and what remains the same.

Background: The 2025 Policy Shift

The current wave of changes doesn't exist in a vacuum. In August 2025, Anthropic quietly but significantly altered its relationship with user data. The company introduced a consent toggle — "You can help improve Claude" — giving Claude Free, Pro, and Max users a choice over whether their conversations could be used to train future AI models. Users were given until October 8, 2025 to make their selection; those who missed the deadline had to choose before they could continue using Claude.

The 2025 update also extended data retention from 30 days to five years for users who opted into model training. This was a dramatic shift: a 60-fold increase in how long Anthropic could hold conversation data. For those who opted out, the 30-day retention period remained unchanged. Feedback submitted about Claude's responses was also brought under the extended retention window.

Anthropic was clear that these changes applied only to consumer accounts (Free, Pro, and Max plans), not to Enterprise, Team, API, Amazon Bedrock, or Google Cloud Vertex AI customers, who operate under separate commercial terms with stronger privacy protections.

What's New in the July 2026 Update

1. Identity and Age Verification

Perhaps the most striking addition in the July 2026 policy is explicit language permitting Anthropic to request age and identity verification from users. According to the updated policy, Anthropic may ask users to confirm their age or identity in order to keep its services "safe and secure."

To carry out this verification, Anthropic is partnering with Yoti, a third-party age verification service. Users flagged for verification may choose between:

• A facial age estimate from a selfie
• An ID document scan (such as a passport or driver's licence)
• An "over 18" proof from the Yoti app

If a user passes verification, their Claude account will be reinstated. Verification data — which may include government ID details, facial photographs or video, and facial geometry templates — falls under a new "Verification Data" clause in the policy, explaining how such sensitive information is collected and handled.

This move signals a shift toward what analysts are calling a "know-your-customer" approach for higher-risk uses of AI, aligning with broader regulatory trends in AI and digital services. Individual developers are understood to be the first group brought into scope for these checks.

2. Agentic Task Data and Third-Party Services

A second major addition addresses a gap that was growing increasingly relevant: what happens to data when Claude acts across third-party apps on a user's behalf, rather than simply answering a question?

The updated policy now explicitly covers agentic task data flows. When users connect third-party services and Claude executes multi-step tasks on their behalf — booking appointments, managing files, interacting with external platforms — the policy now explains what Claude receives from those services and what may be shared back. This is a legal and compliance framework being put in place ahead of anticipated regulatory pressure on agentic AI systems.

For developers and businesses building on top of Claude through the API, these clarifications define the compliance perimeter for products that involve Claude operating across external apps.

3. Law Enforcement Data Sharing

A third and more contentious change concerns the circumstances under which Anthropic may share user conversation data with authorities. The updated policy — published June 8, 2026, and effective July 8 — permits Anthropic to proactively share user conversation data with law enforcement based on an internal "good faith belief" determination, without necessarily requiring a court order.

Privacy advocates have flagged this clause as worthy of close attention, noting that it gives Anthropic considerable discretion over when disclosures are made. The policy applies to Claude Free, Pro, and Max subscribers, and explicitly excludes Enterprise, Team, API, and Claude for Work accounts.

What Stays the Same

Amid the changes, Anthropic has reaffirmed several longstanding commitments:

• Anthropic does not sell user data to third parties.
• Claude remains ad-free — advertisers do not influence Claude's responses, and conversations are not monetised through advertising.
• Users retain control over whether their conversations are used to train AI models. This setting can be changed at any time in Privacy Settings.
• API users continue to receive stricter defaults: as of September 2025, standard API log retention was reduced to just 7 days, and API data is never used for model training.
• Enterprise and Team customers retain the stronger protections of their commercial agreements, including Data Processing Addendums and, for qualifying customers, Zero Data Retention mode.

GDPR and International Privacy Considerations

For users in the European Union and European Economic Area, Anthropic uses EU-approved Standard Contractual Clauses (SCCs) for data transfers outside Europe. EU users retain the full suite of GDPR rights: access, deletion, portability, objection to processing, and rectification.

However, the 2025 opt-in interface drew criticism from privacy researchers, who described the large "Accept" button with a pre-toggled "On" setting as a potential dark pattern that could conflict with GDPR's requirements for freely given and unambiguous consent. As of June 2026, no formal regulatory action has been taken on this point, but the debate continues.

Key Dates at a Glance

What Should Users Do?

Check your Privacy Settings. If you are a Free, Pro, or Max user, visit claude.ai/settings/data-privacy-controls to review your current model training preference and adjust it at any time.

Understand your account type. If your organisation uses Claude through a Team, Enterprise, or API arrangement, the July 2026 consumer policy changes do not apply to you — but it is worth reviewing your specific commercial agreement.

Stay alert to verification prompts. If Anthropic flags your account for age or identity verification, the process will be handled through the Yoti platform. Completing it will reinstate your access.

Consider your agentic workflows. If you use Claude integrations that connect to third-party apps, be aware that the updated policy now governs how that data flows and is shared.

The Bigger Picture

Taken together, Anthropic's policy evolution over the past year reflects a company navigating the tension between building increasingly powerful and integrated AI products, and maintaining the trust of users who chose it partly for its safety-first reputation. The introduction of identity verification, agentic data rules, and law enforcement sharing provisions are not unique to Anthropic — they mirror shifts happening across the AI industry as regulators in the EU, UK, and US push for greater accountability.

Whether these changes represent a necessary maturation of AI governance or a retreat from earlier privacy commitments is, for now, a matter of perspective. What is clear is that users of Claude's consumer products are operating under a meaningfully different set of rules than they were a year ago — and understanding those rules is increasingly important.

This article is based on publicly available information from Anthropic's official announcements and independent policy analyses. It is intended for informational purposes only and does not constitute legal advice.