Poppy Terms of Use (web)

Citation

California Department of Technology (CDT). “Terms of Service for Poppy: California’s Digital Assistant.” PDF, 11 pages, publication date unknown (the upload path shows 2025/09; the PDF file was made on Sept. 17, 2026). https://www.cdt.ca.gov/services/wp-content/uploads/sites/2/2025/09/Poppy_Terms-of-Use.pdf. Copy: raw/web/2026-10-15 Poppy Terms of Use.md (original: .pdf beside it), fetched 2026-10-15 by the agent. Read 2026-10-15.

Bottom line

These are the terms between CDT and each “Ordering Entity” for Poppy, the state’s generative AI (GenAI) platform. An Ordering Entity is a state entity, local government agency, academic institution or tribal organization.
Use is for “official government business” only. The terms ban regulated data, list prohibited uses, and let CDT log, audit, suspend and terminate.

Background

Poppy gives state staff access to commercial large language models (LLMs) through a CDT platform. The Poppy service page gives the rates and the request process. The Poppy overview describes the product. These terms are the contract.

Key claims

Purpose and eligibility:

“Poppy is a GenAI based digital assistant platform that provides the Ordering Entity controlled access to approved third-party Large Language Models (LLMs) and related AI capabilities.” (section 1, “Purpose”)
“Poppy is pre-configured for government use and official government business only”. (section 1)
“Ordering Entity means an eligible State Entity, Local Government Agency, Academic Institution, or Tribal Organization.” (section 2.f)
“For the purposes of these TOS, “State Entity” also includes a public college or university.” (section 2.h)
Users are “Ordering Entity’s personnel (e.g., employees, interns, volunteers and retired annuitants)”, “contractors and consultants”, and “Other third-party users authorized by the Ordering Entity.” (section 5, “Scope”)
“The right to use and access the Services is non-transferable, non-exclusive and revocable.” (section 3.1)

Authorized use (section 6):

Poppy “may only be used for purposes that: (a) support official government business; (b) are authorized and consistent with the Ordering Entity’s acceptable use policy (AUP), information security policies, and applicable federal, state and local laws; and (c) are not otherwise prohibited under these TOS.”
“All usage of Services must align with the User’s job role and Ordering Entity’s responsibilities.”

Prohibited use (section 7):

7.1 “Unlawful or Inappropriate Conduct”, including “Developing or designing weapons or their precursors” and “Compromising children’s safety”.
7.2 “Security Violations”, including “Attempting to bypass authentication or access controls” and “Probing scanning, or testing the vulnerability of IT systems.”
7.3 “Misrepresentation”, including “Creating or spreading misinformation”.
7.4 “Using Poppy for non-governmental purposes, including non-governmental use, fraudulent activities, predatory practices, personal gain, commercial solicitation, or political activity.” Also “Attempting to reverse-engineer, duplicate, manipulate, or subvert Poppy or related systems.”

Responsibilities:

“Each Ordering Entity that deploys or enables access to Poppy shall be responsible for all of its and its Users’ activity under its account.” It must “Immediately notify CDT” of a compromised account, a violation, a breach or misuse. (section 8)
Users must not rely “exclusively on Generated Data produced by Poppy without verifying the information”. (section 9.c)

Data handling (section 11):

“The Ordering Entity and its Users shall not input, upload, transmit, analyze, disclose, store or otherwise process through Poppy any Criminal Justice Information (CJI), Payment Card Industry (PCI) data, Federal Tax Information (FTI), sensitive personal information, Protected Health Information (PHI), or other similarly regulated data.” (11.1)
Sharing with other agencies needs “the appropriate data sharing agreement(s) in place”. (11.2.b)
“CDT will retain Prompts, Generated Data, and any other data provided by the Ordering Entity related to the Services for 90 days, unless a longer period is agreed between the parties.” (11.4.a)
“data created or stored within a User’s workspace shall be retained until removed by the User.” (11.4.b)
CDT may delete all data “within fifteen (15) day of termination of the Services.” (11.6)

Provider and model rules (section 11.5):

“CDT or an LLM provider may access, use, and retain Prompts, Generated Data, and any other Ordering Entity data related to the Services for the purposes of provision, administration, technical support, maintenance, and operation of the Services.”
“CDT will not train models on Ordering Entity content from the Services. CDT will not engage in any form of content moderation.”

Monitoring and logging:

“CDT may, in its sole discretion, log and audit network traffic and analytics related to the use of the Poppy platform and the Services for the purposes of security auditing, quality assurance, and system performance.” (11.5)
“The security-related and technical logs are retained for appropriate timeframes to aid in any investigation of any security incident”. (11.4.a)

Enforcement:

“CDT reserves the right to investigate, audit, and take appropriate action in response to any violations of these TOS.” (12.1)
“Any violations of these TOS by User or the Ordering Entity may result in suspension of access to the Services or termination of Services”. (12.2)
CDT may suspend when “(a) there is a risk to or attack on any of the Services; (b) the Ordering Entity or any User is using the Services in violation of these TOS; or (c) CDT’s provision of the Services to the Ordering Entity is prohibited by applicable law or an LLM provider.” CDT “will provide prior written notice of any Service suspension”. (19.3)
“Either party may terminate the Services, with or without cause, with 30 days’ prior written notice.” (19.2)

Other terms:

The Ordering Entity “owns its Generated Data”. (section 13)
CDT may release “Prompts, Generated Data, and any other records related to the Services in response to a valid CPRA request”. CPRA is the California Public Records Act. (16.2)
Liability is “limited to the total fees paid or payable by the Ordering Entity to CDT for the Service in the twelve (12) months immediately preceding the event”. (15.1)

Evidence and method

This is a legal agreement. It states duties and rights. It has no usage data.

Limits

The terms do not name the LLM providers or their contract terms.
“Academic Institution” is in the definition of Ordering Entity, but section 2 does not define it.
The publication date is not clear. The URL path says 2025/09. The PDF metadata says Sept. 17, 2026.

⚠️ Contradiction: the Poppy service page FAQ 3 says “the API provider is contracted not to retain or use this data for model training.” These terms say “CDT or an LLM provider may access, use, and retain Prompts”. The terms limit model training only for CDT: “CDT will not train models”.

⚠️ Contradiction: the Poppy service page lists PII as prohibited data. These terms list “sensitive personal information”, which is narrower.