Last updated:
21 Oct 2026 — Google’s privacy policy (effective 16 Oct) now lets Search and Gemini use Gmail, Photos and Drive data you connect, including for ads. Also added xAI’s October policy and the new Gemini hub date.
16 Oct 2026 — added an academic study of third-party trackers in nine chatbots, and a section on AI agents with Full Disk Access on the Mac (the disputed Meta Muse report and Apple’s planned change).
🤖 AI and Your Privacy: What Chatbots Actually Collect in 2026
What happens to what you type into ChatGPT and the rest — training use, human review, and the data beyond your prompts. Why pasting sensitive information is where real harm happens, how to opt out, and how AI is quietly supercharging every other kind of surveillance.
Key findings
By default, consumer ChatGPT uses your conversations to train models unless you opt out in data controls — business/enterprise tiers and the API generally don't. Chatbots collect more than your prompts: account identity, usage patterns, device metadata, IP and rough location. The place real harm happens is pasting sensitive data — contracts, code, medical details, other people's information — into a consumer tool, which transmits it to a third party that may store it, review it, and train on it; employees have leaked proprietary data this way by accident. The rule that prevents nearly all avoidable harm: if you'd need permission to share it with a stranger, keep it out of a prompt. You can often opt out of training, but there's no universal switch — the burden is on you, service by service, and defaults favor collection. AI companions are the underestimated risk: intimacy is engineered, data handling frequently isn't trustworthy. Local models are the strongest privacy option — your data never leaves your device. And the biggest shift: AI supercharges every other form of surveillance, turning piles of raw records into actionable profiles.
AI tools are genuinely useful and worth using — this isn't an argument against them. It's a clear account of what they collect, where the real risks are (mostly not where people expect), and the handful of habits that let you use them without giving away more than you meant to. The mental model in one line: a chatbot is a service run by a company, not a private notebook.
By Ned Walsch · Last updated October 2026
The mental model: it's a service, not a notebook
Almost every AI privacy mistake comes from the same misconception — treating a chatbot like a private space. It isn't. It's a service running on a company's servers, subject to the company's policies and to legal process. Once you internalize that, the right behavior follows naturally.
Does it train on your conversations?
For consumer chatbots, often yes — by default — and this is the setting most worth knowing:
| Tier | Trains on your data by default? | Human review possible? |
|---|---|---|
| ChatGPT Free / Plus | Yes, unless you opt out in data controls | Yes — conversations may be reviewed |
| ChatGPT Business / Enterprise | Generally no | Restricted |
| API | Generally no by default | Restricted |
| Other consumer chatbots | Varies — some yes, opt-out prominence differs | Often yes |
The opt-out for ChatGPT lives in your settings' data controls. The broader lesson: assume a consumer chatbot may use and review your input unless you've turned it off or you're on a business tier. Defaults favor collection; the switch is on you to find.
What they collect beyond your prompts
Where real harm happens: pasting sensitive data
This is the single biggest avoidable risk, and it almost always happens by accident rather than through any breach.
Two recent cases make this concrete. First, deletion is a promise, not a guarantee: during the New York Times’ copyright litigation against OpenAI, a court ordered the company from May 2025 to preserve output logs that would otherwise have been deleted — including chats users had deleted themselves. OpenAI objected and the order was lifted on 22 October 2025, but the point stands: once your words sit on someone else’s server, whether they’re really gone is a decision others make, and a court, subpoena, or breach can override it. Second, don’t assume these conversations are legally shielded: in United States v. Heppner (February 2026), a court held that conversations with AI assistants are not protected by attorney-client privilege and do not constitute attorney work product. Treat a chatbot like a service that logs everything, not a confidant.
The underestimated risk: AI companions
AI companion and character apps are among the most underestimated privacy risks precisely because they're designed to feel intimate — that's the product. They encourage deeply personal disclosure: emotional states, relationship details, secrets, intimate content people would never put in a normal app. All of it becomes data held by the company, subject to its policies, its security (often weaker than a major provider's), and its business model.
The strongest option: run it locally
The most private way to use AI is to run a model locally on your own hardware — open-weight models through tools built for local inference, where your prompts and data never leave your device. Nothing is transmitted, nothing is reviewed, nothing feeds a training pipeline. For genuinely sensitive work, it's the gold standard.
The tradeoffs are real: capable models need decent hardware, local models generally lag the frontier hosted ones, and setup takes more effort than opening a website. For casual use, hosted tools win on convenience. But for anyone regularly handling confidential material — or who simply wants AI that can't phone home — local models are the private alternative, and they've become far more accessible than they were a couple of years ago.
The bigger picture: AI as a surveillance amplifier
The quiet shift with the largest long-term implications is that AI doesn't just raise new questions about chatbots — it supercharges every other form of data collection. Surveillance systems and data brokers always gathered vast information; the bottleneck was making sense of it. AI removes that bottleneck. It correlates disparate sources, infers sensitive attributes you never disclosed, recognizes faces and voices at scale, and turns raw records into actionable profiles.
A concrete example: AI watching workers
The amplifier effect isn't abstract, and it isn't only about consumers. A July 2026 investigation documented how Kaiser Permanente call-center nurses — the ones who answer advice and triage calls — say AI-driven monitoring is degrading both their jobs and patient care. Nurses reported that spending more than 15 minutes on a patient call routinely drew criticism or performance-review meetings, with call time feeding monthly performance scores; software tries to predict daily whether they're being "unproductive." Kaiser even tested an AI tool to rate the empathy and tone in nurses' and patients' voices. (Kaiser says it deploys AI with patient safety in mind and does not use average handle time to assess performance.)
Using AI without giving away too much
October 2026 update: policies moved, and the first biometric suit lands
Four of the providers on this page revised their privacy policies in September. Most of the changes are small; one is worth reading closely, and one widely reported story is not what the headline suggests.
What actually changed in the policies
| Provider | Dated | What changed |
|---|---|---|
| OpenAI (US policy) | 10 Sep 2026 | The advertiser clause was broadened: “We may receive information from advertisers… to help us measure and improve the effectiveness of ads shown to Free and Go users” became “We receive information from advertisers… for purposes described in this Policy including to help us measure and improve the effectiveness of our Services, including ads shown to Free and Go users.” References to the Atlas browser and Sora were removed. Retention language (30-day deletion window, Temporary Chats deleted within 30 days) is unchanged. |
| Anthropic (consumer) | 10 Sep 2026 | The only substantive change is a rewritten South Korea PIPA addendum — new domestic representative and identity-verification processors. US retention and training defaults were not changed. The “Verification Data” category covering government ID images and facial geometry templates was already present in the July version; it is not new. The company’s public policy changelog does not list this revision at all. |
| Google (Gemini Apps hub) | 19 Oct 2026 (privacy notice section 13 Oct 2026) | Re-dated twice since 24 September; what changed is not published. Gemini Apps Privacy Hub (checked 21 Oct 2026) The retention figures below were unchanged on 21 October. Google publishes no changelog for this page and the archived copy does not render its body text. Current substance: Gemini Apps Activity auto-deletes at 18 months by default (changeable to 3 or 36 months, or off), chats kept 72 hours with activity off, human-reviewed conversations retained up to 3 years disconnected from the account, temporary chats not used for training. |
| Google (main policy) | 16 Oct 2026 | A real change this time. The policy still says Google does not show personalised ads based on content from Drive, Gmail or Google Photos. It now adds an exception: “unless you choose to make data from these services available to other Google services that support personalized ads.” You can let services such as Search or Gemini Apps read Gmail, Drive and Photos, for features such as “Personal Intelligence”. Search “may process some of the data that you allow Search to access to personalize content, including ads.” Google Privacy Policy (effective 16 Oct 2026) Google is testing ads in AI Mode for people who connect apps. It says ads “will not be based directly” on the contents of Gmail or Photos, and that connecting is optional and can be undone Search Engine Land (16 Oct 2026). Turning off personalised ads in My Ad Center may not stop connected data being used for AI personalisation. To disconnect, remove Google Workspace and Google Photos under Search personalisation in your Google Account Techlicious (19 Oct 2026). The 1 October revision only added “across devices”. |
| Microsoft | Sep 2026 (day not published) | Its own change history says the Artificial Intelligence and Copilot Capabilities section was expanded with more detail on how Copilot uses your data, and the “Personal data we collect” section was expanded on device-derived data. Microsoft dates revisions by month only. |
| Meta | No change | Still effective 23 July 2026. |
| DeepSeek | No change | Still 10 February 2026. |
| xAI (Grok) | 11 Oct 2026 (terms 12 Oct) | Both documents now name SpaceXAI LLC (“SpaceXSI”) as the company. The privacy policy lists “to train our models” as a use of personal information. Deleted conversations, and chats in Private Chat, are deleted “within 30 days” unless kept for legal or safety reasons xAI Privacy Policy (11 Oct 2026). If you sign in with X, the terms let the company bring in your X profile (including date of birth), location, preferences, post history and “your Grok on X conversation history” xAI Terms of Service (12 Oct 2026). Users can choose whether their content is used to train models. |
The OpenAI advertiser edit is the one to notice. Dropping “may” and widening the purpose from measuring ads to improving “our Services” converts a conditional, ad-scoped intake into a stated, general-purpose one. That is a meaningful change in what the document permits, delivered as a sentence rewrite.
The first biometric class action against an AI assistant
On 30 September 2026 a class action was filed against Anthropic in San Francisco County Superior Court over Claude’s identity verification, pleading two counts under the Illinois Biometric Information Privacy Act. The complaint alleges users were required to upload a government ID and a live facial image, that facial geometry was scanned and matched against the ID, and that BIPA’s written notice of retention and destruction schedules and written consent were not obtained; it seeks statutory damages of $1,000/$5,000 per class member. Courthouse News.
Two caveats. The docket number and filing details come from reporting, not from the court record, which we have not retrieved. And an Illinois BIPA claim pleaded in a California state court is an unusual posture that may not survive early motions. What makes it worth tracking regardless is the target: not training data, not chat logs, but the age and identity verification step — the one users are least able to refuse, and the one this page has flagged as collecting the most sensitive category of data.
The FTC story, accurately
Reporting on 30 September says the FTC is preparing civil investigative demands to OpenAI, Anthropic and other AI companies. Axios. It is framed as a product-safety inquiry; the reporting does not place data collection, retention or training within its scope, and the FTC has published no press release about it. Do not read it as a privacy probe.
UK regulator: ten AI developers commit to changes (added 11 October 2026)
On 8 October 2026 the UK Information Commissioner’s Office (ICO, the UK data-protection regulator) reported on its engagement with leading AI developers. Ten have made or committed to changes: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The changes “included clearer transparency information, stronger mechanisms for people to exercise their rights”, plus tougher checks on safeguards. The ICO says: “We are monitoring developers’ progress against their commitments.” It paused its work with xAI after opening a formal investigation into Grok. ICO (8 Oct 2026)
Open questions remain. The ICO acknowledges that “current foundation model training practices present technical challenges when it comes to complying with UK data protection law”. It has also opened a call for evidence on AI agents, with responses due by 20 November 2026 ICO (8 Oct 2026). We rechecked the policies on 11 October: OpenAI, Anthropic, Google and DeepSeek still carry the dates in the table above, and Microsoft’s change history has no entry after September. On 21 October OpenAI, Anthropic, Microsoft, Meta and DeepSeek were unchanged. Google’s main policy (16 October) and the Gemini hub (19 October) had new dates, and xAI’s policy had been rewritten. The table reflects this.
Third-party trackers inside the chatbots (added 16 October 2026)
A research team at IMDEA Networks in Madrid, with Universidad Carlos III and an independent co-author, measured what nine AI chat services send to outside companies. They tested ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Copilot, Mistral Le Chat and Meta AI on the web, and eight of the Android apps Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026). All the experiments ran in Spain in May 2026, so some behaviour may have changed since. The paper is laid out for a privacy journal, but the copy we read has no volume or DOI yet, so treat it as a preprint Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026).
- Every service contacted at least one advertising or tracking company Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026).
- Conversation details leaked in 6 of 9 web apps and 3 Android apps. These included conversation URLs, titles, prompts or screenshots Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026). The paper notes that a conversation URL can be opened by anyone who has it, where sharing is public.
- Rejecting cookies helps only partly. “Even when non-essential cookies are rejected, 80.8% of third-party trackers remain active” Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026).
What the researchers observed, by service (May 2026)
| Service | Observed in the study |
|---|---|
| Grok (web) | Meta Pixel received the conversation ID, chat title and full conversation URL. For shared conversations, TikTok collected screenshots. Share links were public by default (with an opt-out), and still were on 10 September 2026. |
| Claude (web) | User events were forwarded server-to-server from Anthropic’s infrastructure to eleven trackers, and identifiers went to Intercom, a customer-messaging service. Rejecting non-essential cookies stopped Meta Pixel from loading. |
| ChatGPT (web) | Datadog received the conversation ID. Only the paid tier kept cookie choices persistently on the web. OpenAI added third-party trackers to its privacy policy on 15 August 2026; the authors cannot confirm a link to their work. |
| Perplexity | Hashed email addresses and advertising IDs went to the marketing firm Singular. On 3 April 2026 Perplexity stopped sharing conversation URLs with trackers such as Meta, possibly in response to a US class action. |
| Copilot (Android) | The Android advertising ID went to Adjust, a mobile measurement company. |
| Mistral Le Chat | Identifiers went to Intercom. |
All rows: Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026). The authors say they reported their findings to EU and UK data-protection authorities in April 2026 and that “No official response has been received to date” from the companies Oliveira et al., IMDEA Networks (PDF dated 16 Sep 2026). Their advice matches the habits above: reject non-essential cookies, turn off chat sharing, check whether share links are public by default, and keep sensitive conversations out of chatbots. You can see which trackers a site loads with our cookie and tracker checker.
AI agents on your computer: the Muse dispute and Full Disk Access (added 16 October 2026)
Desktop AI agents can ask for far more access than a chat window. The claim: Inc. columnist Jason Aten reported that Meta’s Muse agent on his Mac knew the content of his private Messages while Full Disk Access was off TechCrunch (30 Sep 2026). Meta’s answer: spokesperson Andy Stone said the Messages integration “is entirely opt-in” and that “You have to enable both Full Disk Access and the Messages connector”. Meta’s David Singleton said the AI gave a confused, incorrect explanation of what happened TechCrunch (30 Sep 2026). TechCrunch did not report independent testing of either account, so the claim remains disputed TechCrunch (30 Sep 2026).
Days later Apple said “Some developers are using Full Disk Access in ways that could put users at risk”. It plans controls so that this access can be granted only with “very explicit user action”, citing risks that grow as AI agents become more capable. Apple gave no date or macOS version TechCrunch (2 Oct 2026).
What to check now: choose Apple menu > System Settings > Privacy & Security, then Full Disk Access. Apple says this lets apps “access all files on your computer, including data from other apps” Apple Mac User Guide: Privacy & Security (checked 16 Oct 2026). Remove any AI agent or app that doesn’t need it. In the same pane, Accessibility and Automation show apps allowed to control your Mac or other apps Apple Mac User Guide: Privacy & Security (checked 16 Oct 2026).
ChatGPT log preservation: where it actually stands
Because this keeps getting described as live, the current position, unchanged throughout the window: the broad going-forward preservation order was terminated on 9 October 2025, with exceptions — logs already preserved stay preserved, and data for flagged accounts must still be retained. Separately, on 5 January 2026 Judge Sidney Stein affirmed orders requiring OpenAI to produce the entire de-identified 20-million-conversation sample to the plaintiffs. No further preservation or production order issued between 1 September and 3 October 2026; September docket activity was summary-judgment briefing.
New California AI statutes — and what they do not cover
California chaptered a block of AI legislation in September: SB 1119 (Chapter 190) and SB 867 (Chapter 189) on companion chatbots on 10 September, AB 1609 (Chapter 733) on customer-service chatbot disclosure, and thirteen more AI bills signed on 30 September including workplace-surveillance and AI-transparency amendments. None of them regulates AI assistant data collection or retention directly. If you are looking for the statute that governs what a chatbot keeps about you, it still does not exist.
Frequently asked questions
Does ChatGPT use my conversations to train its models?
By default, on the consumer version, yes — and you can turn it off, which is the single most useful thing to know here. OpenAI has historically used conversations from the free and Plus tiers of ChatGPT to help train and improve its models unless you opt out. The opt-out lives in the data controls in your settings, where you can disable training use (sometimes at the cost of chat history features). The business and enterprise tiers, and the API, operate differently — data submitted through those is generally not used for training by default. The practical takeaway: assume anything you type into a consumer chatbot may be seen by humans reviewing conversations and may inform future models, unless you've explicitly opted out or you're on a business plan. Treat the input box accordingly.
What do AI chatbots actually collect about me?
More than the conversation itself. The obvious layer is the content of your prompts — which, if you paste in personal details, documents, code, or others' private information, is now data held by the provider. The less obvious layers are the ones people forget: account information tied to your identity, usage patterns and timing, device and browser metadata, IP address and rough location, and in some cases how you interact across sessions. Providers use this to operate and improve the service, and their privacy policies govern what else it may be used for. The mental model that keeps you safe is simple: a chatbot is not a private notebook. It's a service run by a company, on the company's servers, subject to the company's policies and to legal process. Anything sensitive enough that you'd hesitate to email it is sensitive enough to keep out of a prompt.
Is it safe to paste confidential or personal information into an AI tool?
As a default rule, no — and this is where real harm most often happens, usually by accident. When you paste a contract, a medical detail, source code, a customer list, or a friend's personal information into a consumer AI tool, you've transmitted that data to a third party whose systems may store it, whose staff may review it, and whose models may be trained on it depending on the tier and settings. There have been real cases of employees leaking proprietary company data this way without realizing it. The safe practice: strip or anonymize anything sensitive before it goes into a prompt, use business or enterprise tiers (which typically don't train on your data) for work involving confidential material, and never paste other people's private information into a chatbot — their privacy isn't yours to surrender. If you'd need permission to share it with a stranger, don't share it with an AI.
Can I opt out of my data being used to train AI?
Often, yes, though it varies by service and takes deliberate action. For ChatGPT's consumer tiers, the data controls in settings let you disable training use. Other providers offer their own controls with varying prominence — some make it a clear toggle, others bury it, and a few don't offer a meaningful opt-out on their free tiers at all. Business and enterprise plans generally exclude your data from training by default, which is part of what you're paying for. Beyond the AI tools themselves, there's a broader front: many companies now use customer data to train AI models, and opting out of that can mean digging through the privacy settings of every service you use. The uncomfortable reality is that the burden is on you to find and flip these switches, service by service — there's no universal opt-out, and defaults usually favor collection.
Are AI companions and character chatbots a privacy risk?
They're among the most underestimated risks in this space, precisely because they're designed to feel intimate. AI companion and character apps encourage deeply personal disclosure — that's the product — which means people share emotional states, relationship details, secrets, and intimate content they'd never put in a normal app. All of it becomes data held by the company behind the app, subject to its policies, its security (which is often weaker than a major provider's), and its business model. Some of these apps have unclear ownership, aggressive data practices, or have suffered breaches exposing exactly this deeply personal material. The intimacy is engineered; the data handling frequently isn't trustworthy. If you use these tools, assume everything you share could be exposed, and be especially wary of apps whose ownership and privacy practices you can't verify.
Does using AI locally protect my privacy?
Yes, and it's the strongest privacy option available for AI — with real tradeoffs. Running a model locally on your own hardware, using open-weight models through tools designed for local inference, means your prompts and data never leave your device. Nothing is transmitted to a company's servers, nothing can be reviewed by staff, nothing feeds a training pipeline. For genuinely sensitive work, that's the gold standard. The tradeoffs: capable models require decent hardware, local models generally lag the frontier hosted ones in raw capability, and setup takes more effort than opening a website. For most casual use the convenience of hosted tools wins, but for anyone handling confidential material regularly — or who simply wants AI that can't phone home — local models are the private alternative, and they've become far more accessible than they were a couple of years ago.
How is AI changing what surveillance and data brokers can do?
It's the quiet shift with the largest long-term implications. AI doesn't just create new privacy questions about chatbots; it supercharges the old ones. Data brokers and surveillance systems have always collected vast amounts of information, but the bottleneck was making sense of it. AI removes that bottleneck — it can correlate disparate data sources, infer sensitive attributes you never disclosed, recognize faces and voices at scale, and turn piles of raw records into actionable profiles. The same pattern-finding that makes AI useful makes mass surveillance far more powerful: a system that can read all the license-plate data, all the camera feeds, and all the purchase records together, and draw conclusions, is a different order of threat from one that just stores them. This is why AI privacy isn't a niche concern about one app — it's an amplifier on every other form of data collection this site covers.
What's the practical way to use AI without giving away too much?
A handful of habits cover most of the risk, and none of them require abandoning these tools. First, opt out of training use where the setting exists, and prefer business or enterprise tiers for anything work-related. Second, never paste sensitive data — yours or anyone else's — into a consumer chatbot; strip or anonymize first, and if you'd need permission to share it with a stranger, keep it out. Third, treat AI companions and unverified apps with real caution, since intimacy is engineered but trustworthy data handling often isn't. Fourth, for genuinely confidential work, consider a local model that never transmits your data. And fifth, remember the bigger picture: the same defensive habits that protect you elsewhere — minimizing your footprint, using aliases, reading the privacy settings — apply here too. AI is a powerful tool worth using; it just isn't a confidant, and treating the input box with that in mind prevents nearly all the avoidable harm.
Do AI chatbots share my conversations with advertising trackers?
Some details can reach them. In tests run in May 2026, researchers at IMDEA Networks found that all nine chat services they studied contacted at least one advertising or tracking company, and that six of the nine web apps leaked conversation details such as URLs, titles, prompts or screenshots to third parties. Rejecting non-essential cookies cut some of this but left most trackers active. Results differ a lot by service and may have changed since.
Should I give an AI agent Full Disk Access on my Mac?
Only if you understand what it will read. Apple says Full Disk Access lets an app access all files on your computer, including data from other apps, and in October 2026 it said it will require very explicit user action before granting it because of AI agents. Review the list under System Settings, Privacy and Security, Full Disk Access, and remove anything that does not need it.