OpenAI and ChatGPT Preservation and Emergency Requests: Template

Investigators ask how to freeze a ChatGPT or OpenAI account before a warrant is signed, and what to do when a life is at risk. OpenAI publishes a dedicated, versioned policy that has a preservation section and an emergency section. This guide reports what that policy says, flags what it leaves out, and offers two templates. It is for authorised law enforcement and government staff only, and it does not repeat the general data-request process.

What the policy covers

The document is titled the OpenAI Government User Data Request Policy (file name "OpenAI Law Enforcement Policy v.2025-12") and states an effective date of 1 January 2026. It covers requests about "users of services offered by OpenAI entities". It does not list products by name, so this guide uses "ChatGPT" in the title because that is what investigators search for, while the policy's own scope is the wording above. Most users are served by OpenAI OpCo, LLC ("OpenAI US"); users residing in the European Economic Area and Switzerland are served by OpenAI Ireland Limited ("OpenAI Ireland"). Which entity you address depends on the user.

Two portal addresses. The policy (section I) states that requests "must be submitted through the request interface" and prints app.kodex.us/openai/signin; on 24 October 2026 that address opened a Kodex sign-in page carrying the OpenAI logo. OpenAI's Trust and transparency page says "Government agencies can submit legal process via the Kodex portal" and its "Submit through Kodex" button links to app.kodexglobal.com/signin, which opened a general Kodex sign-in page without OpenAI branding. Neither OpenAI page explains how the two addresses relate, so we print both as published and make no claim about which one to use. Reach either from OpenAI's own pages rather than from a search result or an email.

Preservation requests: what OpenAI says

OpenAI US (section II.C). OpenAI US "will honor valid requests from You to preserve user data consistent with 18 U.S.C. § 2703(f)". It "will preserve user data for up to 90 days, and will extend the preservation period for an additional 90-day period upon receipt of a valid extension request". The policy adds that "in the absence of such a request, records may not be retained as part of the normal course of business of OpenAI", which is the reason to act quickly.

OpenAI Ireland (section III.C). OpenAI Ireland "will honor valid requests from You to preserve information in accordance with Irish and EU law". The policy states no period for Ireland.

The federal statute. 18 U.S.C. section 2703(f)(1) says a provider "upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process", and (f)(2) says the records "shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity". OpenAI's stated 90 plus 90 days matches that text.

Notice. Under section V, OpenAI says it notifies the user before disclosing information in response to a government demand, unless prohibited by law, and may withhold notice in exceptional circumstances (emergencies where notice could cause danger, or where notice would be counterproductive, for example where an account has been compromised). It also says it "may also provide notice when it receives a request for preservation of data when circumstances warrant". So a preservation request can lead to the user being told. If notice would harm the case, discuss a non-disclosure order with your prosecutor before you submit.

Cost. Section VII reserves OpenAI's right to seek reimbursement for the costs of responding to data requests and preservations, as permitted by law.

What the policy does not say. It does not give a separate checklist for a preservation request, name the identifiers it accepts for one, say whether a preservation is a one-time snapshot or continuing, or define which data categories are held. The requirements it does publish for production requests (section II.A) are that the request contain the authorised agent's name and contact information, state with particularity the categories of records sought, include sufficient information to unambiguously identify the account(s), and indicate the specific time period. A preservation request built to the same checklist is the safest approach, but that is our suggestion, not an OpenAI requirement. OpenAI's separate civil-process page gives an email address as an example identifier and says OpenAI may be unable to identify accounts from names, IP addresses, physical addresses or phone numbers alone; that page is for civil requests, not law enforcement, so treat it as a hint only.

Emergency disclosure requests

Section IV says that in limited circumstances OpenAI US and OpenAI Ireland may disclose user data to law enforcement or government agencies "where it believes that making such a disclosure is necessary to prevent an emergency involving danger of death or serious physical injury to a person", and will evaluate emergency requests "on a case-by-case basis in compliance with applicable law". The request "must":

1. contain the name and contact information of the individual law enforcement agent or government representative making the request;
2. describe the circumstances of the request and the nature of the emergency;
3. explain why there is insufficient time to obtain and serve a valid legal process;
4. state with particularity the categories of records or information sought;
5. explain how the user data requested is necessary to avert the emergency; and
6. indicate the specific time period for which information is requested.

The US statute behind a provider's voluntary emergency disclosure is 18 U.S.C. section 2702: subsection (b)(8) for communications and (c)(4) for records, each where the provider "in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay". The statute says the provider "may" divulge.

Expectations. The policy states no response time; it says only that emergency requests are evaluated case by case. For context, OpenAI's report for January to June 2026 lists 28 emergency requests received, with data disclosed in response to 10 of them (13 accounts). The same report lists 620 non-content and 146 content requests. Do not promise a family or a court a speed that OpenAI has not stated.

Template: preservation request

Adapt to your agency's format; not legal advice. OpenAI does not publish a preservation form, so this follows the identification checklist in its policy.

[AGENCY LETTERHEAD]
[DATE]

To: OpenAI OpCo, LLC ("OpenAI US")
    [OR: OpenAI Ireland Limited, for users in the EEA or Switzerland]
    (submitted through the OpenAI government request interface)

Re: Request to preserve user data
    18 U.S.C. § 2703(f)  [OR: applicable Irish / EU law]
Agency reference / case number: [CASE NUMBER]

I am [OFFICER NAME], [TITLE], [UNIT], [AGENCY], a governmental entity
conducting an official [CRIMINAL] investigation.
Contact: [OFFICIAL GOVERNMENT EMAIL], [DIRECT TELEPHONE].

Pursuant to 18 U.S.C. § 2703(f)(1) [OR: the applicable Irish / EU
provision], I request that OpenAI preserve all
records and other evidence in its possession for the account(s) below,
pending the issuance of a court order or other process.

  Account identifier(s):   [ACCOUNT EMAIL / USER ID, SUFFICIENT TO
                            UNAMBIGUOUSLY IDENTIFY THE ACCOUNT]
  Other identifiers:       [PHONE / PAYMENT DETAILS, IF KNOWN]
  Categories to preserve:  [e.g. account and subscriber information,
                            payment and transaction records,
                            conversation content, files, logs]
  Time period:             [START DATE] to [END DATE]

Period requested: 90 days from receipt. I will submit a renewed request
under § 2703(f)(2) before the period ends if process has not issued.

[OPTIONAL: A non-disclosure order dated [DATE], effective until
[END DATE], is attached. Please do not notify the user.]

Please confirm receipt and the preservation start date.

[OFFICER NAME]
[TITLE, AGENCY]

Template: emergency disclosure request

Adapt to your agency's format; not legal advice. The six numbered parts mirror the six items in section IV of the policy.

EMERGENCY DISCLOSURE REQUEST
To: OpenAI OpCo, LLC [OR: OpenAI Ireland Limited]
[DATE AND TIME, WITH TIME ZONE]
Agency reference / case number: [CASE NUMBER]

1. REQUESTING OFFICER
   [OFFICER NAME], [TITLE], [AGENCY]
   [24-HOUR TELEPHONE], [OFFICIAL GOVERNMENT EMAIL]

2. CIRCUMSTANCES AND NATURE OF THE EMERGENCY
   [Facts only: who is at risk, what is known, and why it amounts to
   danger of death or serious physical injury.]

3. WHY THERE IS INSUFFICIENT TIME TO OBTAIN AND SERVE LEGAL PROCESS
   [Facts on timing, e.g. harm expected within [HOURS]; status of any
   warrant application.]

4. CATEGORIES OF RECORDS OR INFORMATION SOUGHT
   Account: [ACCOUNT EMAIL / USER ID]
   [Specific categories, e.g. account registration data, IP address
   logs for the account, conversation content relating to the emergency]

5. HOW THE DATA IS NECESSARY TO AVERT THE EMERGENCY
   [Explain the link, e.g. to locate or identify the person at risk.]

6. TIME PERIOD
   [START DATE AND TIME] to [END DATE AND TIME]

I am making this request because I believe an emergency involving danger
of death or serious physical injury to a person requires disclosure
without delay. I will follow with legal process: [WARRANT / ORDER /
SUBPOENA, EXPECTED DATE].

[OFFICER NAME]

Common mistakes the policy and OpenAI's pages point to

• Using the wrong channel for civil matters. OpenAI has a separate page for civil subpoenas and requests. It says civil requests in the US are served through its registered agent, CT Corporation System, and that it does not accept civil service by email, fax, regular mail or customer support channels.
• Sending legal process by email. The policy says all government requests must be submitted through the request interface. Content removal requests are different: section VI asks for those in writing from an official government email with the legal basis explained.
• An emergency request that omits "why not process". The policy lists the explanation of insufficient time to obtain legal process as a required item.
• Vague or broad scope. The policy asks you to state the categories of records with particularity, identify the account unambiguously and give a specific time period.
• Letting the 90 days lapse. OpenAI states 90 days plus a further 90 on a valid extension request, and that without a request records may not be retained in the normal course.
• Assuming secrecy. OpenAI's policy is to notify users unless prohibited by law, and it may notify on a preservation request.

Related

• Overview of platform law enforcement request guides
• Investigator handbook: United States
• Investigator handbook

Sources

• OpenAI Government User Data Request Policy (v.2025-12, effective 1 January 2026)
• OpenAI: Trust and transparency
• OpenAI: Government Requests for User Data, January to June 2026
• OpenAI: Serving civil subpoenas or other civil requests for user data
• 18 U.S.C. section 2703, U.S. Code 2024 edition (govinfo.gov)
• 18 U.S.C. section 2702, U.S. Code 2024 edition (govinfo.gov)

This guide is information, not legal advice. On 24 October 2026, v.2025-12 was the policy version linked from OpenAI's Trust and transparency page; OpenAI publishes new versions, so check the link again before you rely on it. The statute wording quoted here was checked against the U.S. Code on uscode.house.gov, current through Public Law 119-124 (15 October 2026): sections 2702 and 2703 were last amended in 2018. For more platforms see the police data-request directory, and for victims in any country see the country-by-country cybercrime help hub.