Adobe Firefly

The terms are explicit that users retain all rights and ownership of their content, and Adobe claims no ownership. Any license Adobe takes is limited to operating and (optionally) improving the service on the user's behalf.

The Terms define "Content" to include material "create[d] using the Services and Software" and confirm the user retains ownership of Content, which strongly implies generated outputs belong to the user. However, the supplied documents do not contain an explicit statement about ownership of AI-generated output specifically, and the AI User Guidelines note outputs may be inaccurate or duplicative, leaving some ambiguity.

Adobe makes a clear and repeated commitment not to train generative AI models on user content unless the user submits content to the Adobe Stock marketplace (governed by a separate contributor agreement). This is a strong, user-favorable position stated consistently across both documents.

The Terms provide a 30-day post-termination transition window before Adobe reserves the right to delete content, and state deleted content stops being publicly available within a reasonable time. However, there is no defined retention schedule, no deletion SLA, and backups may retain copies indefinitely, leaving deletion timing vague.

Adobe discloses that it uses trusted cloud infrastructure providers, CDNs, and vendors/contractors under confidentiality restrictions, and that Business Users' personal information may be shared with the Business. It also refers users to a separate Privacy Policy (not supplied) for the full picture. No selling of data to advertisers/brokers is indicated, but the reliance on the unsupplied Privacy Policy limits certainty.

The Terms provide an explicit opt-out from Content Analytics (product improvement) and from usage-data analysis, and point to an information-preferences management page. Because training on user content does not occur by default (except via Adobe Stock submission), users effectively control that use as well.

The supplied documents reference GDPR (via a DPA) and COPPA (in defining sensitive/child data) but name no third-party attestations such as SOC 2, ISO 27001, ISO 42001, or the EU AI Act, and do not claim CCPA/CPRA compliance. For a marketing/adtech-adjacent generative AI product, this near-total absence of named certifications with evidence is a material gap.

Adobe provides Content Credentials to disclose AI generation/modification and references a Transparency Center for content moderation practices, offering some transparency. However, the documents describe no model explainability, model documentation, or enterprise-facing audit capability into model behavior; the only audit right described runs in Adobe's favor over the customer's license usage.

The documents describe account-level security expectations (multi-factor authentication, credential responsibility) and automated scanning for illegal content, but disclose no substantive technical security controls such as encryption at rest/in transit, penetration testing, bug bounty, or incident/breach response. No breach history and no dedicated security page/trust center for controls is referenced, making the security posture largely undisclosed in these documents.

The Terms distinguish Business Users from Personal Users: businesses gain access to and control over Business Profile content, and business use is governed by the Business's separate agreement with Adobe. Free accounts face inactivity-based deletion and are provided 'as-is' with no warranties or support, while paid accounts in good standing are exempt from inactivity deletion — a meaningful tier delta.

Adobe reserves the right to review prompts, inputs, and generated results through automated and manual methods for abuse prevention and content filtering, and human review of cloud content can occur in defined circumstances (support requests, public content, flagged/illegal content, or opted-in beta programs). Local content is never reviewed and review is scoped, but generative AI inputs/outputs are explicitly subject to manual review.

The documents reference Law Enforcement Requests and a Transparency Center, and state Adobe may report material exploiting minors to NCMEC. A mandatory arbitration agreement, class-action waiver, and a one-year claim limitation constrain users' litigation options. There is no disclosure of pending litigation, but government-request handling detail is limited within the supplied text.

The Terms indicate collection of account/personal information (name, email, phone number) and font/usage data, and expressly prohibit users from submitting Sensitive Personal Information unless authorized or intended by the product. The AI Guidelines likewise warn against inputting health records, government addresses, or precise location. Full PII inventory depends on the unsupplied Privacy Policy, so the picture is partial.

The governing documents are recent relative to the 2026-09-19 analysis date (General Terms published/effective October 3, 2025; AI User Guidelines last updated May 15, 2026) and explicitly address generative AI, model training, and Firefly by name. However, no PRODUCT SURFACE was supplied, so coverage of the product's actual capabilities cannot be independently verified; per the insufficient-evidence rule the rating is capped at YELLOW.

Two governing documents were supplied (AI User Guidelines and General Terms of Use), and they are consistent on the core issues — most notably the no-training-on-user-content commitment, human-review scope, and content ownership. No contradictions were identified between them; a third Product Specific Terms PDF was listed as analyzed but its text was not provided for direct comparison.