The consumer AI account is now a compliance surface

Anthropic's updated consumer privacy policy took effect yesterday. Free, Pro, and Max users of Claude must now hand over a government ID and a selfie to keep using the product, and their data can be passed to law enforcement on a "good-faith belief" that it should be — no court order, no subpoena, no warrant required. Enterprise, Team, and API customers are exempt. That last sentence is the whole story.

What Anthropic actually changed. Three things at once. Identity verification: government ID plus selfie, the KYC (Know Your Customer, the identity checks banks run) stack imported into a chatbot signup. Law-enforcement disclosure: proactive sharing permitted where Anthropic forms a good-faith belief that sharing is warranted. Agentic-task data: a new provision governing what Claude generates when it acts across multiple steps on a user's behalf — the emails it drafts, the sites it browses, the actions it takes.¹²

Each provision has a defensible rationale. Age verification is under legislative pressure in Louisiana, Texas, Utah, and via the UK's Online Safety Act. Export controls oblige US AI companies to block users in sanctioned jurisdictions, and account-layer ID checks are one way to do that. Law-enforcement clauses with good-faith language are standard on Google and Meta terms of service. Governing agentic-task data at all is more than most competitors have done.³

Read the provisions individually and each looks like a company doing what regulators have asked for. Read them together and something else comes into view.

Two tiers, one asymmetry

The consumer account and the enterprise account are now materially different legal objects. Enterprise customers negotiated contractual data protections and are excluded from the new disclosure and verification regime. Consumer users got a take-it-or-leave-it policy update.

This is not a subtle distinction. The same underlying model, accessed through two different contracts, produces two different privacy realities. If you are a company with a procurement team, your Claude session is protected by a data processing agreement. If you are an individual, a journalist, a researcher, a small-business owner, a curious teenager, your Claude session is governed by a policy Anthropic can revise, and that already permits proactive disclosure of your data to police on a standard lower than "we were legally compelled to."

The bifurcation is not a technical necessity. Anthropic could extend enterprise-grade protections to consumer users. It has chosen not to, because it does not have to. The consumer side is where the volume is, where the liability worries are, and where the users cannot push back.

The clause that got the least attention

Of the three changes, the one that matters most for the fewest people, and matters most, full stop, is the law-enforcement clause.

"Good-faith belief" is a materially lower bar than a warrant, and lower than a subpoena. It puts the disclosure decision inside Anthropic's trust and safety function rather than inside a court. That is fine most of the time, because most of the time law enforcement is investigating something ordinary and Anthropic will use the discretion cautiously. It is not fine some of the time.

The users for whom it is not fine are predictable: journalists working sources, researchers documenting state violence, activists in jurisdictions where dissent is criminalised, lawyers doing sensitive work, domestic-abuse survivors, people seeking reproductive or gender-affirming care in states that have criminalised it. These are the users who had reason to believe their AI assistant was a private tool and who now have reason to believe it is a proactive disclosure channel. None of them were consulted. Most of them will not read the policy.

Anthropic is not uniquely aggressive here — Google and Meta have similar language, which is the point. This is the consumer internet's default privacy contract migrating into consumer AI, at exactly the moment when the AI account is starting to hold much more sensitive material than a search history ever did.

Who is paying for sanctions enforcement

Export controls are a state obligation. When the US restricts which countries can access frontier AI, that is a policy of the US government. The mechanism Anthropic has now built to comply with it, collecting a government ID and a biometric selfie from every consumer user, puts the compliance cost on users.

The overwhelming majority of Claude's consumer users are not the target of any export control. They are being asked to submit identity documents and face scans so that Anthropic can demonstrate to regulators that the small number of users who are the target have been excluded. The liability-reduction benefit flows to Anthropic. The data exposure risk, every ID collection is a future breach, flows to users.

This is a privatisation of a state function, and the cost accounting is upside down. The state gets its export controls enforced without building the enforcement infrastructure. The company gets protection from sanctions liability. The user gets a new attack surface for identity theft and a permanent record linking a biometric to an account.

The sleeper clause

The agentic-task provisions look procedural and are not. When Claude acts as an agent across multiple steps, booking, filing, drafting, browsing, the data it generates includes actions taken in the user's name, content of communications sent, financial transactions initiated. Governing that under the same framework as "a user typed a question and got an answer" collapses a category difference.

A chat log is a record of what you asked. An agentic session is a record of what you did. That the two are now inside the same disclosure clause, subject to the same good-faith-belief release standard, is the provision the EU's regulators will notice first under the AI Act's high-risk automated-decision provisions. It should be the provision users notice first as well.

What is actually being decided

The three changes are being framed as a routine policy update. They are not. They are the moment the consumer AI account stopped being a product and became a compliance surface — where the state's identity requirements, the state's sanctions requirements, and the state's investigative interests all meet, mediated by a private company whose consumer users have no seat at the table.

The users who could negotiate did. The users who could not, got the policy. That is the ordinary shape of these things, which is why it is worth naming it out loud rather than treating it as weather.

Footnotes