When a cloud storage provider gets attention for something questionable — changing what they can do with your files, scanning content, or modifying deletion policies — the initial reaction from privacy-conscious users is usually the same: check the privacy policy.
This is the wrong document to read.
The privacy policy tells you how a company handles your personal data in the narrow legal sense: what they collect about you as a user (name, email, payment information, usage metrics), who they share it with, and how you can request deletion. It’s primarily a compliance document, designed to satisfy data protection regulations like GDPR and CCPA.
The document that controls what the provider can actually do with your files — your photos, your documents, your personal content — is the Terms of Service.
Why the Distinction Matters
The privacy policy answers: “What information about me does the provider collect?”
The Terms of Service answers: “What rights does the provider have over the content I store with them?”
These are fundamentally different questions. A company can have an excellent privacy policy — one that commits to not selling your data, not sharing your email with advertisers, and honoring deletion requests — while its Terms of Service grants broad rights to access, process, display, and use your stored files in ways you’d find objectionable.
The legal mechanism that makes this possible is the intellectual property license. When you store files with a cloud provider, you typically grant them a license to host, display, transmit, and process those files as necessary to operate the service. The scope of “as necessary” is where the crucial decisions are made.
The License Clause: What You’re Actually Agreeing To
Most cloud storage Terms of Service include a section that grants the provider a license to your uploaded content. The specific language varies enormously between providers. Understanding what you’re reading requires knowing what to look for.
Scope of rights. The license will typically enumerate the specific things the provider can do with your content. “Reproduce, distribute, transmit, display, and perform” is common. Some licenses include “create derivative works” — which covers generating AI outputs, summaries, or other content derived from your files. A license that includes derivative works rights is materially broader than one that doesn’t.
Purpose limitations. Some licenses are limited to operating and improving the specific service you’re using. Others extend to “any purpose,” which can include using your content to train AI systems, improve other products, or contribute to the provider’s research efforts. The phrase “to provide and improve our services” sounds reasonable but can cover a lot.
Sublicensing. Many cloud providers work with subprocessors: companies that handle storage infrastructure, content delivery, or AI processing. A license that includes the right to sublicense means the provider can extend the rights you granted them to these third parties.
Global, royalty-free, irrevocable. These modifiers appear frequently and have specific meanings. Global means the license applies regardless of jurisdiction. Royalty-free means you’ve given up any claim to compensation for the rights granted. Irrevocable is the most concerning: it means that even if you delete your content or close your account, the license you granted persists. Some providers limit irrevocability to content that’s been shared publicly; others don’t.
Comparing Real Examples
Reading the actual Terms of Service of several major cloud storage providers reveals significant variation in what they claim.
Google Drive grants Google “a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.” The license is described as “royalty-free” and continues until the content is deleted. Google has noted in documentation that personal content in Drive is not used for targeted advertising, but the license itself is expansive.
Dropbox grants “a worldwide, non-exclusive, royalty-free, sublicensable license to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute your stuff in any and all media or distribution methods (now known or later developed).” The phrase “now known or later developed” is particularly broad, encompassing processing methods that don’t exist yet.
Microsoft OneDrive grants Microsoft “a worldwide and royalty-free intellectual property license to use your content.” The license is scoped to providing and improving services. Microsoft’s supplementary documentation describes Copilot’s access to OneDrive content for users who have it enabled — which is separate from the base license but relevant to understanding what features touch your files.
iCloud (without Advanced Data Protection) doesn’t grant Apple a content license in the same framing, but Apple holds the encryption keys to iCloud data, which means they have technical access to your content regardless of how the license clause is written.
Proton Drive is explicit that they cannot access the content of files stored in Proton Drive due to end-to-end encryption, and this is reflected in the terms — the license scope is limited to what’s necessary to provide the service, and they don’t claim derivative works rights.
What Content Moderation Means for Your Files
Most cloud storage services include content moderation provisions in their Terms of Service. These clauses typically prohibit:
- Illegal content (a reasonable and expected provision)
- Content that violates intellectual property rights
- Content that violates the provider’s community standards or acceptable use policy
The content moderation clause matters for privacy because it establishes that the provider has the technical capability and stated right to access and review stored content, at least for moderation purposes. A provider that enforces content policies against private files must, by definition, be able to read those files.
This isn’t necessarily objectionable — no one wants a storage provider that knowingly hosts illegal content. But understanding that content moderation requires content access is important for accurately assessing your privacy posture. Files you believe are private are accessible to the provider for purposes that include but may not be limited to moderation.
AI Features and the Permissions They Actually Require
The most significant recent evolution in cloud storage terms has been around AI features. As providers have integrated AI tools — file summarization, content search, “ask questions about your documents,” intelligent organization — the terms governing how AI can access stored content have expanded accordingly.
When you enable an AI feature that can answer questions about your files, that AI must be able to read your files. The Terms of Service governs whether that AI access extends beyond immediate query processing to include:
- Storing the queries and your files’ content for model improvement
- Using your files as training data for future AI development
- Sharing content with third-party AI providers
- Retaining derived data (summaries, embeddings, semantic indexes) after you delete the original file
The default assumption for most major providers is that AI features involve some combination of the above. The Terms of Service and AI-specific policies are the documents where the specific commitments (or lack of them) are articulated.
If you don’t use AI features — or use a service that doesn’t offer them — this consideration is less urgent. But the trend toward AI integration in cloud storage means that checking for AI-specific provisions in the Terms of Service is increasingly important even for users who don’t think of themselves as AI users.
Deletion: What the Terms Actually Promise
The Terms of Service also governs what happens when you delete files or close your account. The relevant questions:
When does deletion complete? Most providers commit to purging deleted content within a defined window — often 30 to 90 days from the time of deletion. Some are less specific. Some note that content may persist in backups for an additional period beyond the primary deletion.
What happens to derived data? If the provider has generated embeddings, summaries, or AI-derived representations of your content, those are separate from the files themselves. The deletion guarantee may cover the original files but not the derived data. Some Terms of Service address this explicitly; many don’t.
Does deletion terminate the license? This is where “irrevocable” license language becomes consequential. If the license to your content is irrevocable, deleting the content may not actually revoke the rights you granted. Practically, the provider can’t use content that doesn’t exist, but in theory an irrevocable license persists after deletion.
What happens on account closure? Different from individual file deletion. Check whether the Terms address account closure separately and whether the deletion commitments apply in full under account closure scenarios.
How to Read a Terms of Service Without Getting Lost
The Terms of Service for major cloud providers can run to 10,000+ words. Reading the full document is possible but time-consuming. If you want to understand the key provisions without a line-by-line review, focus on these sections:
License grant / intellectual property: search for “license,” “grant,” “rights,” “content.” This section describes what you’re giving the provider permission to do.
Acceptable use / prohibited content: describes what content can be stored and what grounds give the provider authority to access or remove content.
Data deletion / account termination: describes what happens to your content when you delete it or close your account.
AI / machine learning provisions: newer Terms of Service often have a dedicated section on AI features and data use. If you can’t find it, search for “artificial intelligence,” “machine learning,” or “train.”
Changes to the terms: how the provider can modify the Terms of Service and what notice they’re required to give you. Providers with broad unilateral modification rights can change what they’re permitted to do with your content at any time.
What Good Terms Look Like
For comparison, consider what terms that actually prioritize users’ content rights would say:
The license grant would be limited to what’s technically necessary to deliver the service — hosting, transmission, display within your account — without derivative works rights or AI training use.
Deletion would be permanent, with a specific timeframe, explicitly covering derived data and backups.
The license would terminate upon content deletion, with no irrevocable provisions.
AI features, if offered, would be opt-in rather than default, with explicit documentation of what data is used and how.
Third-party processing would be limited to service delivery, with subprocessors prohibited from using your content for their own purposes.
Not all providers meet these standards. The ones that do typically operate on subscription revenue models rather than advertising or data monetization, because the business model shapes what the terms need to permit.
Before You Choose a Provider
Most people pick a cloud storage provider based on price, interface, and storage capacity. The Terms of Service is the document that should also factor in, because it’s the legally binding description of what you’re agreeing to — not the marketing copy, not the privacy feature announcements, not the corporate blog posts about how much the company values your trust.
Spending fifteen minutes with the license grant, deletion provisions, and AI policy of a storage service before uploading years of personal files is a small investment relative to the decision’s significance. The alternative is learning about the terms when they matter — which typically means after something has already gone wrong.