Slack's privacy principles spell out consent for AI training

What the page currently states

Slack's Privacy Principles: Search, Learning and Artificial Intelligence page, as retrieved on 16 September 2026, draws a sharp line between two kinds of machine learning. For generative AI, the page states that Slack will not use customer data to train generative AI models unless the customer gives affirmative opt-in consent. For the older category of predictive, non-generative features, such as emoji and channel suggestions, the page describes an opt-out rather than an opt-in: a workspace or organisation owner can write to Slack's customer experience team to exclude that workspace's data from the shared global model, after which the workspace still benefits from models trained on other customers' data but no longer contributes its own.

Why the distinction is the whole story

The two defaults point in opposite directions, and a reader who only skims the page can come away with either impression. Opt-in for generative training is the stronger customer protection; opt-out for predictive models is the industry-standard pattern for features that existed before generative AI became a marketing category. A separate Slack help-centre guide adds that AI features in Slack only draw on content the requesting user could already see, meaning public channels plus the private channels and direct messages that user belongs to, and that administrators can restrict which AI features are available at all.

What a contract needs to pin down

Pages like this one are living documents, not permanent commitments; wording that reassures a customer today can be rewritten tomorrow, and a plain-language summary is not the same as a contractual guarantee. It is common practice, seen across this industry, for a vendor to tighten language of this kind after customers or the press read an earlier version more broadly than intended; this is an editorial observation about the pattern, not a claim about a specific past version of this page. A procurement team should not rely on the public page for a compliance record. It should get the same opt-in and opt-out commitments written into the actual data-processing agreement, with a defined meaning for training that covers fine-tuning and prompt-log retention, not just the headline model-building step.

• Does your master services agreement or data-processing addendum repeat the opt-in commitment, or only the public trust page?
• Who at your organisation has the authority, and the workspace details, to exercise the opt-out for predictive models?
• Does training in your contract cover fine-tuning and prompt retention, or only full model builds?

The safest reading of any such page is functional rather than reassuring: note exactly what is opt-in, what is opt-out, and treat the rest as subject to change.