OpenAI Zero Data Retention Still Keeps CSAM Images

What OpenAI announced about Zero Data Retention

On August 19, 2026, OpenAI restated its Zero Data Retention promise and previewed Private Safety Processing as a way to keep that promise while improving safety checks. ZDR is the arrangement for eligible API customers: OpenAI does not retain their prompts or model responses after a request is processed. Customer content is not available to OpenAI personnel for review, and enterprise customer data is not used to train OpenAI's models unless the customer explicitly opts in.

The post is titled "Offering Zero Data Retention for frontier models". Its subtitle says the preview strengthens safeguards across interactions while remaining compatible with ZDR.

For a security or procurement owner who holds a ZDR agreement, the post is mainly a statement about an existing promise rather than a new product launch. One category of content falls outside the promise, and a later section covers it.

Single-interaction checks miss cross-interaction risk

ZDR-compatible safety systems judge each interaction on its own, and OpenAI says some serious risks only become visible when several interactions are read together. The company ties this to models taking on longer, more complex tasks. A single request can look harmless while the pattern around it is not.

OpenAI gives three examples of such patterns: bad actors repeatedly probing safeguards, coordinating across accounts, or disguising threats as routine research. A fourth example comes from AI agents, which can drift from what the user intended by continuing to act after being told to stop.

OpenAI says seeing the wider context helps separate legitimate activity from misuse and keep agents inside the authority they were given. Private Safety Processing is OpenAI's proposal for getting that wider view without OpenAI personnel reading customer content.

How Private Safety Processing works

OpenAI says automated systems look across related interactions and that it receives only a narrow signal about the type of activity, not the content. A signal here is a narrowly defined indication of the activity involved, not a copy of the prompt or response. The design builds on automated protections already used in ZDR and other deployments, and it extends them from single interactions to related ones.

Where the content sits depends on the setup. In ZDR deployments it remains on infrastructure the customer controls. OpenAI is also developing an option that stores content on OpenAI infrastructure, encrypted with keys the customer controls, and OpenAI personnel hold no copy of those keys.

When a risk is identified, the signal can be used to decide whether enforcement is necessary, and personnel get no access to the content even when it is flagged. Customers can investigate alerts and enforcement decisions with information in their own systems. They then choose whether to share relevant information to appeal, clarify legitimate activity, or support an investigation into verified abuse.

CSAM-flagged images are still retained under ZDR

Images flagged as possible child sexual abuse material (CSAM) are still retained under ZDR, exactly as they are today. OpenAI's footnote says that, like other frontier model providers, it is required by law to report apparent CSAM. Flagged images are kept for manual review and reporting.

The footnote is attached to the sentence saying customer content is not available to OpenAI personnel for review, so it qualifies that promise. It is the one exception the announcement states, and the preview does not change it.

For anyone answering a compliance questionnaire, the practical question is whether the workload sends images. The footnote speaks only of images, so that is where an answer of "nothing is retained" needs the qualification.

Private Safety Processing vs. retention-based monitoring

OpenAI says Private Safety Processing is designed so ZDR can continue, while some recent frontier-model deployments have required customers to let the provider retain sensitive content for safety monitoring. For many organizations, the post adds, such a requirement conflicts with their security obligations or their commitments to the people they serve.

The post names no provider, and the contrast it draws is about method. Retention-based monitoring keeps sensitive content with the provider, while OpenAI says Private Safety Processing finds patterns without giving staff access to customer content.

Keeping ZDR available is the aim OpenAI states for the design. The post presents it as a goal, not a tested result, so the technical white paper OpenAI promised matters for judging it.

When Private Safety Processing becomes available

OpenAI added an update to the post on September 22, 2026: it is rolling out Private Safety Processing to API customers, with access expanding in phases. The August 19 post had described a preview tested with early customers and a plan to start the rollout and share that white paper in September. OpenAI said it shared the preview because customers need predictability about how their content will be protected as AI systems become more capable.

The update points readers to a developer guide but does not mention the white paper, and it gives no schedule for each phase. A team waiting for access should read the developer guide rather than assume it already has the feature.

The August 19 post also promised that OpenAI would keep customers informed, explain what updates mean for existing commitments, and give customers time to plan. A team can use that promise as a checkpoint: record the commitments it relies on today, then compare them with what OpenAI explains.

What Zero Data Retention customers should check now

Check whether workloads send images, compare the agreement wording with the announcement, and keep a dated copy of the wording relied on. Images come first because the CSAM retention applies there, and it already applies today.

Next, read the agreement and the eligibility wording against the announcement. ZDR is offered to eligible API customers, so the question to settle is whether the organization qualifies.

Read the technical white paper, if it has been published, before relying on the design; until then the mechanism is OpenAI's description. OpenAI's page gained a September 22 update after its first publication, which shows why a dated copy is useful when a claim is questioned later.