OpenAI and ChatGPT Law Enforcement Data Requests: LERS Portal, Process and 2026 Figures

Investigators who need ChatGPT account records from OpenAI are sent to one place: a government request interface that OpenAI operates through the Kodex platform. OpenAI publishes a Government User Data Request Policy (v.2025-12, effective 1 January 2026) and a six-monthly transparency report. This guide sets out how the request process works, which legal process OpenAI says it needs, what the January to June 2026 report shows, and where the published material stops. It is for authorised law enforcement and government staff. For freezing an account before process is ready, and for life-threatening emergencies, see our OpenAI preservation and emergency guide with templates.

The portal and what to call it

OpenAI does not use the acronym LERS. Its policy says all requests from law enforcement and government agencies, to either OpenAI US or OpenAI Ireland, "must be submitted through the request interface". We call it the OpenAI LERS portal to match the other guides in this directory. The interface sits on Kodex, which OpenAI's help centre describes as the platform OpenAI uses to receive and respond to communications from government authorities.

Two addresses. The policy prints app.kodex.us/openai/signin. OpenAI's Trust and transparency page links to app.kodexglobal.com/signin. Neither page explains how the two relate, so we print both as published. If you cannot sign in, OpenAI's help centre points to Kodex Support at [email protected]. We run no portal and cannot create or reset accounts.

How to submit a user data request

1. Get a verified government account. OpenAI's help centre says you need one and links the Kodex government signup page (app.kodexglobal.com/gov/signup), where you complete a verification step.
2. Select the OpenAI entity. OpenAI OpCo, LLC for customers outside the EEA and Switzerland; OpenAI Ireland Ltd. for customers in the EEA and Switzerland.
3. Select the service your request concerns. OpenAI's example is ChatGPT Ads for advertisement requests.
4. Choose the User Data path. The other path, Content Removal, is for takedown and restriction requests.
5. Attach your legal process and identify the account, following the checklist below.
6. Wait for the reply in Kodex. OpenAI says it responds through Kodex and that you are notified in Kodex and/or by email to the address on your Kodex account. The policy gives no response time.

For general questions about process, OpenAI's help centre offers a Quick Question option under either path; questions are submitted in English in a free-text field. The help article is titled around content removal but also covers user data requests.

What the request must contain

The policy sets the same six requirements for requests to OpenAI US (section II.A) and to OpenAI Ireland (section III.A):

1. valid and enforceable legal process that compels OpenAI to produce the information (for example a subpoena, court order or search warrant);
2. the name and contact information of the individual law enforcement agent or government representative authorised to serve it;
3. the categories of records sought, stated with particularity;
4. the date by which the data is to be produced, if that is not evident on the face of the process;
5. enough information to unambiguously identify the user account or accounts; and
6. the specific time period for which information is requested.

OpenAI provides only the data specified in the legal process. Adding your case reference and a short note linking the process to the account is our suggestion, not an OpenAI requirement.

Which legal process OpenAI says it needs

Requester	Entity	What the policy says
US agency	OpenAI US	A subpoena, court order, search warrant or equivalent before disclosing non-content user information. User content only in response to a valid warrant or equivalent.
Non-US agency	OpenAI US	In some cases, direct foreign process, if it would be valid and compulsory if issued to a company in the requester's country and disclosure is consistent with US law, human rights norms and OpenAI's policies. Otherwise an MLAT, an executive agreement under 18 U.S.C. § 2523, letters rogatory or another government-to-government route to US process.
Irish agency	OpenAI Ireland	A judicially authorised order under Irish law.
Non-Irish agency	OpenAI Ireland	Diplomatic or other government-to-government routes, such as mutual legal assistance, to obtain Irish process. In some cases OpenAI Ireland may respond to foreign process that would be valid and compulsory in the requester's jurisdiction and is consistent with Irish and EU law.

The policy does not define what counts as an "equivalent" to a subpoena, order or warrant. Confirm with your prosecutor or central authority before you rely on it.

What data the report describes

OpenAI's transparency report describes two kinds of production. Non-content data covers "name, email address, payment information, and transaction history" and is sought by legal process such as subpoenas. Content data covers "text or files input or output in connection with the use of OpenAI services" and is sought by process such as search warrants. A third category, emergency requests, covers disclosures OpenAI makes where it believes disclosure is needed to prevent death or serious physical injury.

Neither the policy nor the report lists IP addresses, login history, device identifiers, session logs, deleted conversations or API usage logs as separate categories. Do not assume they are or are not held. Ask through Quick Question, and use preservation early where the policy allows.

User notice, secrecy and cost

Under section V, OpenAI notifies the user before disclosing information in response to a government demand, unless prohibited by law. It may withhold notice in exceptional circumstances, such as emergencies where notice could cause danger, or where notice would be counterproductive (its example is a compromised account). It gives delayed notice after disclosure once a legal bar, such as a non-disclosure order, has expired. It may also notify a user when it receives a preservation request. If notice would harm your case, discuss a non-disclosure order with your prosecutor before you submit. Section VII reserves OpenAI's right to seek reimbursement of its costs for responding to requests and preservations, as permitted by law.

What OpenAI reported for January to June 2026

Request type	Received	Data disclosed	Share disclosed*	Accounts with data disclosed
Non-content	620	441	71%	679
Content	146	88	60%	130
Emergency	28	10	36%	13
Total*	794	539	68%	822

*Our calculation from OpenAI's figures; OpenAI's report lists the three rows only. By OpenAI's own share of requests, non-content made up 78.1%, content 18.4% and emergency 3.5%. The report does not say why requests did not result in disclosure.

US national security requests (FISA and National Security Letters) are excluded from the table. OpenAI reports them in ranges only: 250–499 requests affecting 250–499 accounts in this period.

Requests to OpenAI rose from 71 to 794 in 18 months

Period	Non-content	Content	Emergency	Total received	Data disclosed
Jul–Dec 2024	57	13	1	71	54
Jan–Jun 2025	119	26	1	146	105
Jul–Dec 2025	224	75	10	309	209
Jan–Jun 2026	620	146	28	794	539

Requests grew more than elevenfold across these four reports and more than doubled in the latest six months (309 to 794, up 157%). The share of requests where data was disclosed stayed between 68% and 76%. Totals and disclosure counts are sums of OpenAI's three rows for each period, and exclude US national security requests.

Preservation and emergencies

For OpenAI US, the policy says OpenAI will honour valid preservation requests consistent with 18 U.S.C. § 2703(f), preserving for up to 90 days and extending for a further 90 days on a valid extension request. OpenAI Ireland will honour valid preservation requests in accordance with Irish and EU law. For emergencies, the request must contain six listed items, including why there is insufficient time to obtain legal process. Our preservation and emergency guide sets out both in full, with two adaptable templates.

FAQ

Where do I submit a ChatGPT user data request?

Through the Kodex request interface, from OpenAI's own pages. Choose the correct OpenAI entity, then the User Data path.

Do I need a warrant for ChatGPT conversations?

For OpenAI US, the policy says user content is disclosed only in response to a valid warrant or equivalent. Non-content information needs a subpoena, court order, search warrant or equivalent.

Can a non-US agency ask OpenAI US directly?

Sometimes. The policy allows it where your process would be valid and compulsory in your own country and disclosure fits US law and OpenAI's policies. Otherwise use an MLAT, a § 2523 executive agreement, letters rogatory or another government-to-government route.

Will OpenAI tell the user about my request?

Its policy is to notify the user before disclosure unless prohibited by law, with limited exceptions and delayed notice after a non-disclosure order expires.

How long does OpenAI take to respond?

The policy states no response time. OpenAI says it will respond through Kodex.

Related

• OpenAI and ChatGPT preservation and emergency requests, with templates
• Law enforcement data requests, platform by platform
• Investigator handbook: United States
• LERS directory: data-request guides by platform

Sources

• OpenAI Government User Data Request Policy (v.2025-12, effective 1 January 2026)
• OpenAI: Government Requests for User Data, January to June 2026
• OpenAI: Government Requests for User Data, July to December 2025
• OpenAI: Government Requests for User Data, January to June 2025
• OpenAI: Government Requests for User Data, July to December 2024
• OpenAI: Trust and transparency
• OpenAI Help Center: Submitting government content removal requests with Kodex

This guide is information, not legal advice. We checked the policy, report and help article against OpenAI's published versions on 9 November 2026; v.2025-12 was the policy version linked from OpenAI's Trust and transparency page. OpenAI publishes new versions, so check the link again before you rely on it. Ministry of Cyber Affairs is not OpenAI and does not run any law-enforcement portal. For more platforms see the police data-request directory, and for victims in any country see the country-by-country cybercrime help hub.