⚠ Key Privacy Concerns
Under the policy, OpenAI may use your conversations to train its models on the consumer tiers unless you opt out. The opt-out exists but requires navigating to Settings, then Data Controls, then the training toggle. OpenAI's Data Controls documentation states that conversations started with history disabled are retained for about 30 days for abuse review before deletion. As I read this, "deleted" no longer means "untrained": once text has influenced model weights, that influence generally cannot be extracted the way a database record is removed.
What Should I Do?
Pick the row that matches you. The settings paths below are current as of the January 2026 policy version; OpenAI moves menu labels around, so if a label has changed, look for the closest equivalent under Settings.
👤 Everyday user
- Turn off training: Settings › Data Controls › Improve the model for everyone › Off (older builds label this "Chat History & Training").
- Understand the tradeoff: with this off, OpenAI still retains new chats for up to 30 days for abuse review before deletion.
- Never paste full names, account numbers, medical details, or anything you would not want surfacing in a future model output.
- Export or delete on your terms: Settings › Data Controls › Export data and Delete account.
- Submit a formal privacy request (CCPA/GDPR-style access or deletion) at
privacy.openai.com.
💼 Business / professional user
- Do not run client or regulated data through free or Plus ChatGPT. Those tiers can train on inputs unless you opt out, and the opt-out is per-account, not enforceable across a team.
- Use ChatGPT Enterprise, Team, or the API, where inputs are not used for training by default and a Data Processing Addendum is available.
- Request and keep OpenAI's DPA and SOC 2 report before sending any third-party or personal data.
- Map plugin and integration exposure: every connected tool can receive conversation context. Disable connectors you do not actively need.
- If you are a lawyer, accountant, or clinician, treat consumer ChatGPT as a public channel for confidentiality purposes until a DPA is in place.
⚠ Already affected
- Document everything now: screenshots, dates, the exact data involved, and any OpenAI emails. You cannot demand what you cannot describe.
- File a deletion and access request at
privacy.openai.comand keep the confirmation. This starts the statutory clock under many privacy laws. - Know the hard limit: deletion removes your account data, but data already absorbed into trained model weights generally cannot be pulled back out.
- If you believe your data was exposed in a security incident, or that a rights request was ignored, a written demand letter is often the next lever.
- For a California resident, the CCPA/CPRA framework gives access, deletion, and limit-use rights, and a private right of action for certain breaches.
⚠ The 30-day reality
"History off" does not mean "not stored." OpenAI's own Data Controls documentation says conversations started with history disabled are retained for roughly 30 days and reviewed only for abuse monitoring before deletion. Safety and abuse-investigation data, and anything held under a litigation hold, can persist longer. Plan as if today's chat exists somewhere for at least a month.
Want the formal-demand route? See my AI training-data-use demand letter templates and CCPA/CPRA privacy-rights demand letters.
Data They Collect
Everything OpenAI gathers about you and your conversations.
What they collect: Prompts, outputs, usage patterns, device info, IP addresses, browser data, account information, and conversation metadata.
Who the policy says can get your data: the sharing section describes service providers and infrastructure providers, affiliates, other users where you choose to share, and recipients in a corporate transaction such as a merger or acquisition. Read the policy's "How We Share Your Information" section for the operative list.
How long: OpenAI's Data Controls documentation describes roughly 30-day retention for conversations started with history off, then deletion. In my view the harder problem is model-training persistence: once data has shaped a model, its influence is not cleanly reversible. Abuse-monitoring and legal-hold data can be kept longer.
Your control: Training opt-out available but buried in settings. ChatGPT history toggle exists. Account deletion available. No granular controls over specific conversation data use.
Security: the policy and security pages describe industry-standard controls, including SOC 2 reporting for business tiers. As with any large platform, my framework assumes security incidents are possible and scores on whether the design limits the blast radius, not on a perfect record.
Clarity: Vague about training data usage specifics. Limited transparency on how individual conversations influence models. Data export available but incomplete picture of data usage.
Analysis
⚖ My take
If I had to compress this to one sentence: ChatGPT is fine for low-stakes, non-confidential use the moment you flip off training, and a real problem for anyone with a duty of confidentiality who treats the consumer app like a private notebook. The 48 score is not me calling OpenAI reckless. It is me flagging that the strong protections exist but sit behind a paywall and a buried toggle, which is a design choice, not an accident.
Practically: turn off training today, assume a 30-day floor on retention, keep names and account numbers out of the box, and if you are running client or regulated data, do not use free or Plus at all. Move to a tier with a signed Data Processing Addendum. And remember the one thing deletion cannot fix: text that already trained a model stays baked in.
Sergei Tokmakov, Esq., CA Bar #279869. This is attorney-supervised, informational content, not legal advice, and it does not create an attorney-client relationship.