Yahoo

Users retain ownership of intellectual property rights in content they submit, but simultaneously grant Yahoo a sweeping worldwide, perpetual, irrevocable, sublicensable license to use, modify, and distribute that content. The nominal ownership retention is heavily diluted by the breadth of the license granted.

The terms do not clearly assign ownership of AI-generated outputs to the user, and expressly disclaim any responsibility or warranty for AI-generated content, warning it may be inaccurate. The absence of an explicit output ownership clause leaves this ambiguous.

The policy does not explicitly state that Yahoo uses user inputs to train its own AI models; it instead references conducting research and supporting innovation and sharing data with third-party AI providers to enhance features. It is silent on whether user content is used to train models, which is itself a risk signal for an AI-enabled platform.

Yahoo commits to retaining personal information only as long as necessary to provide services, with extended retention for legal, fraud-prevention, and backup purposes, and offers account deletion via a dashboard link. However, no specific retention schedule, deletion SLA, or timeline is provided, and lost-password accounts may become permanently unrecoverable.

Yahoo shares data extensively across its affiliates, with trusted partners, with third-party AI providers (including Yahoo Mail inbox contents), and enables third-party advertising companies to collect data from users' devices. While Yahoo states it does not share personally identifiable information with advertising/analytics partners and does not sell customer-identifying data without consent, the scope of sharing for advertising purposes is broad and integral to the ad-driven business model, and the AI-provider sharing of mailbox contents is significant.

The policy provides specific opt-out and control mechanisms via Privacy Controls for targeted advertising, marketing preferences, location data, and email-content analysis. However, opt-out does not stop ads entirely, and there is no described opt-out from the core data collection, affiliate sharing, or AI-provider data sharing that occurs by using the Services.

The documents reference the EU-U.S. Data Privacy Framework, UK Extension, Swiss-U.S. DPF, and Standard Contractual Clauses as data-transfer mechanisms, and describe GDPR legal bases and an EU representative. No SOC 2, ISO 27001, ISO 42001, NIST CSF, or third-party audit attestations are named, and there is no explicit CCPA/CPRA certification. Compliance is largely asserted through transfer frameworks rather than independent security certifications.

The documents provide no transparency into AI model behavior, decision-making, or enterprise auditing capabilities. Yahoo explicitly states it does not control AI-provider outputs and makes no warranties about them, offering no explainability or audit rights to users.

Yahoo states it maintains technical, administrative, and physical safeguards but provides no specifics on encryption, access controls, penetration testing, or bug bounties, and references a transparency site rather than a security trust center. The terms expressly disclaim any warranty that the Services are secure and note no data transmission can be guaranteed secure; no breach history is disclosed.

The documents describe fee-based/paid Services with billing and subscription terms but do not establish any materially different data-handling protections for paid versus free tiers. Paid Services introduce additional payment-data collection and third-party payment terms rather than enhanced privacy protections.

Yahoo reserves the right to analyze user content including email content, posts, photos, and communications, and may access and disclose information for legal and operational purposes. While it states it does not monitor or screen all content, the broad analysis rights indicate user inputs may be accessed by systems or staff.

The documents disclose that Yahoo may respond to lawful governmental requests, legal process, and law enforcement, and impose binding individual arbitration, a class-action waiver, and jury-trial waiver on U.S. users. These provisions substantially limit users' legal recourse and confirm cooperation with government data requests.

Yahoo collects an extensive range of PII (name, email, device identifiers, IP address, location, browsing/usage patterns, payment/billing information) and processes communications content including email, photos, and voice inputs. Location and communications content constitute SPI, and the breadth of collection combined with advertising-driven use and third-party sharing warrants a high-risk rating.

The Privacy Policy was last updated March 2026 and the Terms reflect a May 2025 corporate name change, both recent relative to the August 2026 analysis date. The policy demonstrably addresses AI capabilities the product surface shows are live (Yahoo Scout AI chat), explicitly covering third-party AI providers, data sharing with them, and AI accuracy limitations.

Two documents were supplied (Privacy Policy and Terms of Service) and no material contradictions were found between them. The Terms correctly cross-reference the Privacy Policy for data practices, and the IP license grant and AI-provider sharing provisions are consistent with the Privacy Policy's descriptions of data use and sharing.