How to add a Privacy Policy URL to a custom GPT with Actions

By Paul Cranmer, Founder · Last verified October 2026 · ChatGPT GPT editor · Configure → Actions

Instructions and knowledge files do not need a policy. The moment you add an Action, your GPT calls an API you run, and ChatGPT may send parts of a user's conversation to that endpoint. That is why the Action editor has a privacy policy field and why OpenAI blocks public sharing of a GPT with Actions until the field is filled. This page gives the path through the editor and the points the policy has to make.

Who this is for

Builders publishing a GPT with Actions to everyone or to the GPT Store
Teams whose GPT is stuck on the publish step because of the missing policy
Developers wiring an existing API to a GPT who have no legal page yet

Not for

GPTs with no Actions (instructions and files only), which can publish without a policy
A tutorial on writing the OpenAPI schema for the Action

What the platform requires

Each Action in the GPT editor has a privacy policy URL field; OpenAI requires it before a GPT with Actions can be shared with everyone or submitted to the GPT Store.
The URL must open publicly over HTTPS without a login. A homepage or a PDF is not a policy page.
OpenAI states that when a user interacts with a GPT's custom action, ChatGPT may send parts of their conversation to the action's endpoint, so the policy must describe what your endpoint receives, stores, shares and for how long.
GPT Store listings also need a verified Builder Profile (your name or a verified website domain).

Get a live URL first

An Action is an API, which is on our free path. Choose API/SDK in the wizard, name the GPT or the API it calls, and you get a live HTTPS policy URL to paste into the Action. If you later add a website or a paid product around it, the same URL keeps working.

Get the GPT Action policy URL (free)

Step-by-step: paste your privacy policy URL

Create the hosted privacy policy URL. Run the wizard as API/SDK with the GPT's name and the data your endpoint receives from conversations. Copy the live URL.
Open the GPT in the editor and go to Configure. In ChatGPT, open My GPTs, choose the GPT, then the Configure tab. Scroll to the Actions section at the bottom.
Open the Action and paste the policy URL. Click the Action (or Create new action), confirm the schema and authentication, then paste the hosted URL into the Privacy policy field under the schema. Save.
Publish to everyone or submit to the GPT Store. Use the Share or Publish control and choose Everyone or GPT Store. The publish step no longer blocks on the missing policy; a verified Builder Profile is still required for a Store listing.
Re-check the policy when you add Actions. Each new Action can send different data to a different endpoint. Update the policy text behind the same URL; the link in every Action stays valid.

Field labels to look for

Configure → Actions: Bottom of the Configure tab. Each Action is edited separately and carries its own Privacy policy field.
Share / Publish: Everyone and GPT Store require the Action policy URL; Only me and Anyone with the link do not.
Builder Profile: Settings → Builder profile. Verify your name or a website domain before a Store listing goes public.

Common reasons the form fails

Pasting the company homepage instead of a policy page
A policy that never mentions conversation data being sent to the endpoint
Publishing with a Builder Profile that is not verified
Changing the policy URL per Action and breaking older links

Create it from an agent

Our MCP server can create this URL for you from inside an agent: call create_privacy_policy_url with resourceType API/SDK. The REST endpoint returns the same result for a CI step.

Get the GPT Action policy URL (free)Learn more

FAQ

Does a GPT without Actions need a privacy policy?

No. The requirement is tied to Actions, because that is when ChatGPT sends conversation content to your server.

Can one policy URL cover several GPTs?

Yes, if the policy names the GPTs or the API they share and describes the data each one sends. Keep one URL and update the text.

Is the API/SDK path really free?

Yes. Mobile apps, browser extensions and APIs are hosted free. Websites, stores and ad landers are on the paid plan.