OpenAI's Sora App: Facial Data Security and Account Deletion Concerns

How Safe Is Your Facial Data With OpenAI's Sora App?

When he's not battling bugs and robots in Helldivers 2, Michael is reporting on AI, satellites, cybersecurity, PCs, and tech policy. Don't miss out on our latest stories. Add PCMag as a preferred source on Google. OpenAI's Sora app has gone viral for letting users create AI-generated videos of themselves. But what does it do with your facial data? Can you delete your account if you change your mind? OpenAI confirms that it does need to store your facial and audio data for Sora's Cameo feature, which can create disturbingly real "deepfakes" of your likeness, including your voice. However, the company has committed to deleting users' facial and audio data for Cameo if they cancel their account. "Uploaded cameos are kept by OpenAI to use for new Sora videos, and are encrypted at rest and in transit," OpenAI tells PCMag. "Uploads are automatically deleted within 30 days after users delete them. You can see our retention policies here." Still, that policy doesn't specifically address the Sora app. Rather, it somewhat vaguely says: "We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations." However, OpenAI has indicated that it plans to tightly control the Cameo feature. "Only you decide who can use your cameo, and you can revoke access at any time," the company wrote in a separate blog post. Many users have already found that the Cameo feature can be used for amusing effects, especially to lampoon OpenAI CEO Sam Altman. But the company concedes there's a small chance Sora can create rule-breaking videos, including sexual deepfakes featuring a user's likeness, despite the safeguards in place. It also turns out that trying to shut down your Sora account comes with a cost. One user posted a screenshot showing that OpenAI will also delete your ChatGPT account if you try and shut down your Sora presence. This seems to be because Sora requires you to register with an OpenAI account. (Similar to how Threads is linked to Instagram.) OpenAI's message about the Sora account deletion adds: "You cannot reuse the same email or phone number for a new account. If you've been using ChatGPT with the API, this access will also be deleted." We've reached out to OpenAI for comment about the account deletion policy for Sora, and we'll update the story if we hear back. However, it appears to align with the company's existing policy, which revokes access to all OpenAI services if the user chooses to delete their account. "For security reasons, once you delete your account, you may not re-sign up for an account with the same email address," the policy adds. UPDATE: OpenAI says: "We're committed to giving people clear ways to manage their OpenAI accounts, and you can delete yours today. We're also working on a way to delete your Sora account separately, and we'll let people know as soon as that's available." Disclosure: Ziff Davis, PCMag's parent company, filed a lawsuit against OpenAI in April 2025, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.

OpenAI's New Sora App Makes Account Deletion Permanent, Including for ChatGPT - Decrypt

Deleting an account on OpenAI's new Sora 2 app isn't just a button tap -- it's a point of no return. OpenAI warns in its terms of service that once a user deletes their Sora profile, all linked data, including conversation history and API usage across ChatGPT and Sora, is permanently erased. That level of finality matters as Sora 2 has mushroomed online alongside OpenAI's push into new products like an AI agent shopping feature with Shopify. According to the TOS, once a user's email or phone number is removed, the account can never be reused. The company hasn't publicly explained why Sora's deletion rules extend to ChatGPT accounts, but it said it's working on separating the two systems. "We're committed to giving people clear ways to manage their OpenAI accounts, and you can delete yours today," OpenAI said in a statement. "We're also working on a way to delete your Sora account separately, and we'll let people know as soon as that's available." The current terms of service for Sora 2, however, call deleting an account permanent and cannot be undone. "All your data, including profile, conversations, and API usage across ChatGPT and Sora, will be removed," Sora 2's terms explained. "You cannot reuse the same email or phone number for a new account. If you've been using ChatGPT with the API, this access will also be deleted." OpenAI first introduced Sora in February 2024 as a browser-based feature inside ChatGPT. With the release of the standalone Sora 2 app on Tuesday, access shifted from web to mobile. The app still requires an invite code because it hasn't been rolled out to the general public. Unlike the first Sora model, the invite-only Sora 2 on iOS introduced "cameos" that let users insert themselves into AI-generated scenes after a quick video to verify likeness and voice. On its first day, users produced NSFW sex-toy ads, anime romance parodies, and deepfakes of OpenAI CEO Sam Altman. While OpenAI works to decouple Sora 2 from ChatGPT, deletion remains irreversible -- meaning users who delete by mistake could lose not only their AI-generated videos but also access to OpenAI's flagship chatbot. Tying Sora 2 to ChatGPT raises the stakes for anyone testing Sora's new features, as critics argue OpenAI is drifting from its mission of creating safe, broadly beneficial AI, toward memes and viral entertainment.