Privacy policy clauses for Vercel AI SDK
Vercel AI SDK is a unified software development kit that enables websites to stream AI-generated responses from multiple providers (OpenAI, Anthropic, Google, etc.). Websites use it to integrate conversational AI features, tool integrations, and real-time response streaming into their applications.
Free scan · No signup · Results in 60 seconds
What data Vercel AI SDK collects
Your privacy policy must disclose each of the following data types when you use Vercel AI SDK.
When does Vercel AI SDK trigger privacy obligations?
Installation triggers immediate obligations
The moment you integrate Vercel AI SDK into your application, user prompts and AI-generated responses become data in transit to third-party AI providers (OpenAI, Anthropic, Google, etc.). This triggers GDPR Article 13/14 disclosure obligations in the EU and CCPA Section 1798.100 disclosure obligations in California immediately—before any user interaction occurs.
Which regulations apply and why
GDPR (EU/EEA): Applies if you have any EU users. Vercel AI SDK routes personal data (prompts may contain PII) to external processors. You must establish a Data Processing Agreement (DPA) with your chosen AI provider under GDPR Article 28. If your provider lacks an adequate DPA, you cannot legally use Vercel AI SDK without additional safeguards (e.g., Standard Contractual Clauses). This is non-optional.
