SDSU Statement on Generative AI (GenAI) Privacy

Neither San Diego State University (SDSU) nor California State University (CSU) will monitor, access, or track individual user interactions with enterprise GenAI tools such as ChatGPT Edu, Google Gemini, or Microsoft Copilot. Although Information Technology Division (ITD) system administrators who manage accounts and settings can access basic account information and non-individual data, they do not monitor or track individual user interactions. 

SDSU and CSU take user privacy extremely seriously, and such monitoring would be contrary to the enhanced privacy architecture fundamental to the enterprise GenAI tools. University access to data is limited to non-identifiable, aggregated measures such as the total number of users and prompts or queries performed on the platform. 

Some critical exceptions to this, which also apply to all university-provided technology tools:

A court or law-enforcement agency could compel SDSU to provide access to targeted, specific data related to a legal investigation or proceeding. In rare cases, similar access may also be required to address any critical cybersecurity threats that may impact the confidentiality, integrity, and availability of SDSU systems and data.  In both cases, whether a legal order or a cybersecurity threat, the access request would be verified as legally valid by SDSU and/or CSU legal counsel.  If validated, only specific designees from SDSU’s Information Technology Security Office will have access to conduct a narrowly tailored search. The results of any such search are the property of the requesting court or agency or are used to protect SDSU’s data and system assets.