Atlassian's New AI Training Policy Creates a Two-Tier Privacy System, Critics Say

Starting August 17, Atlassian began collecting customer metadata and in-app content from Jira, Confluence, and other cloud products by default, to train its Rovo and Rovo Dev AI products — a change affecting roughly 300,000 organizations. The policy is enabled by default for all cloud customers, but opt-out access is tiered: Free, Standard, and Premium customers cannot turn metadata collection off at all, while only Enterprise-tier customers have both metadata and in-app data collection disabled by default.

Why Critics Are Calling This "Privacy-by-Paywall"

The core criticism isn't that Atlassian is training AI on customer data — most major SaaS vendors are doing some version of this now. It's the tiering: an organization's ability to control what happens to its own Jira tickets and Confluence pages is gated behind which pricing tier it can afford, rather than being a universal setting every customer controls regardless of spend. That structure reframes a privacy control as a premium feature, which is the specific part drawing pushback from the developer and IT admin community.

The Details That Matter for Any Affected Organization

• Data retention runs up to seven years for collected training data
• In-app data is removed within 30 days of deletion or opt-out — but that's 30 days of continued exposure after a decision to stop, not immediate
• AI models retrained on the data are updated within 90 days — meaning even after opting out, previously-trained model behavior may persist for up to that window
• The Data Processing Addendum reportedly does not explicitly address AI training data usage — a real gap for any organization that relies on its DPA for compliance documentation, not just Atlassian's product settings pages

What This Means If You're on a Non-Enterprise Atlassian Tier

If your organization runs Jira or Confluence on the Free, Standard, or Premium tier and handles any sensitive or regulated data in tickets or pages, this is worth an immediate compliance review — not because the collection itself is necessarily improper, but because "we can't opt out at our tier" is a materially different answer than "we chose not to opt out" when a customer, auditor, or regulator asks how your organization's data governance actually works. Confirm which tier you're on, and whether that tier's default settings align with your own data-handling commitments to your customers, not just Atlassian's terms.