Do we need to disclose Stability AI in our privacy policy?

Yes. Because Stability AI processes user data (text prompts, input images, and usage metadata) as a third-party service provider, you must disclose this in your privacy policy under any section describing AI tools or image generation features. This disclosure is required under GDPR (Articles 13–14) and CCPA, which mandate transparency about all data recipients.

What specific data does Stability AI collect from users?

Stability AI collects text prompts users submit for image generation, any input images provided for img2img processing, the generated image outputs, and API usage metadata (timestamps, request frequency, user identifiers). If input images contain faces or identifying information, personal data may be transmitted to Stability AI's servers.

Does Stability AI require a cookie consent banner?

Stability AI itself does not set cookies. However, if your website uses Stability AI's web interface or SDKs that embed analytics or tracking, you should review those components. The absence of documented cookies does not eliminate the need for clear consent disclosures about data transmission to Stability AI's platform.

Who is the data processor and where is data stored?

Stability AI Ltd., a United Kingdom-based company, acts as the data processor. User data is transferred to Stability AI's infrastructure; their privacy policy (https://stability.ai/privacy-policy) governs further processing. Under GDPR, you must ensure a Data Processing Agreement is in place before transferring personal data.

AI & Machine Learning

Privacy policy clauses for Stability AI

Stability AI provides Stable Diffusion, an AI image generation service that converts text prompts and input images into generated outputs. Websites integrate this technology to enable users to create, edit, or manipulate images through artificial intelligence without maintaining proprietary infrastructure.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Stability AI collects

Your privacy policy must disclose each of the following data types when you use Stability AI.

Text prompts for image generation

Input images for img2img processing

Generated image outputs

API usage metadata

When does Stability AI trigger privacy obligations?

Immediate Obligations

The moment you integrate Stability AI's API into your product, you begin transmitting text prompts, input images, and generated outputs to Stability AI Ltd. (UK-based processor). This triggers:

GDPR (EU/EEA users): If any user is in scope, you must execute a Data Processing Agreement (DPA) with Stability AI *before* processing begins (GDPR Article 28). Stability AI's standard DPA is available on request. You also become a data controller responsible for lawful basis determination—typically consent (Article 6(1)(a)) or legitimate interest (Article 6(1)(f))—and must provide transparent disclosures under Article 13/14.

CCPA (California users):

Privacy policy clauses for Stability AI

What data Stability AI collects

When does Stability AI trigger privacy obligations?

Immediate Obligations

Where data goes

Common compliance pitfalls

Pitfall 1: Assuming text prompts are "not personal data"

Pitfall 2: Forgetting to disclose input images in your privacy policy

Pitfall 3: Misconstruing "generated images" as avoiding copyright/consent issues

Legal note

Sample privacy policy clause

What regulators look for

Primary Audit Triggers

Frequently asked questions

Do we need to disclose Stability AI in our privacy policy?

What specific data does Stability AI collect from users?

Does Stability AI require a cookie consent banner?

Who is the data processor and where is data stored?

Don't ship without Bandit.