Every prompt you send to ChatGPT, Claude, Gemini, or any other chatbot is a disclosure of three things: the work you are trying to do, the proprietary material that work involves, and often the people affected if it succeeds. The good news is that the major AI labs now publish precise defaults for what they do with that disclosure. The bad news is that those defaults are not what most users assume they are.<\/p>\n\n\n\n
This guide is a practitioner’s map of AI privacy in 2026. It separates the five things people conflate when they say “privacy” (training use, conversation retention, human review, telemetry, and integration-side leakage), audits the actual defaults at OpenAI, Anthropic, Google, Microsoft, Apple, and Meta with citations to the labs’ own documents, and ends with a six-step defensive playbook you can deploy this week. If you write prompts for a living \u2014 copy, code, research, customer data, legal drafts, anything you would not want on a billboard \u2014 this is the article to read before you send another one.<\/p>\n\n\n\n
When a user says “I don’t want my data used by AI,” they usually mean one of five different things. Most AI privacy failures come from conflating them.<\/p>\n\n\n\n
When a vendor tells you “we don’t use your data,” the next question is always which<\/em> of the five they mean. The lab’s defaults differ in each category, and most policy pages collapse all five into a single “privacy” claim. The rest of this article works through each category against the major providers, then gives you a defensive playbook.<\/p>\n\n\n\n The numbers below are the public defaults as of August 2026, taken from each provider’s own documentation. Where defaults differ by tier (free consumer vs. paid API vs. enterprise), I note the tier in the row. If you have not seen your provider’s policy updated since 2024, treat this section as the canonical map.<\/p>\n\n\n\n For the OpenAI API, the default is clean: OpenAI’s data controls documentation<\/a> states that “data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).” The same page documents a 30-day retention window for abuse-monitoring logs<\/em>, with explicit exemption language for legal-hold extensions. Zero-data-retention endpoints are available for eligible customers via the data-residency and zero-retention programs.<\/p>\n\n\n\n For ChatGPT (the consumer product), the situation is layered. Free and Plus users have “Improve model for everyone” enabled by default, which routes a subset of conversations into the training pipeline. The opt-out lives in Settings \u2192 Data Controls \u2192 “Improve model for everyone,” and once disabled, your chats are excluded. ChatGPT Team, Enterprise, and Edu tiers have training disabled by default, regardless of settings. Memory in ChatGPT<\/a> is a separate channel: when enabled, the assistant retains facts across sessions and stores them indefinitely until you delete them. Memory is opt-in but easy to forget is on.<\/p>\n\n\n\n For Claude API customers, the rule is unambiguous. The Anthropic Commercial Terms<\/a> state in Section C: “Anthropic may not train models on Customer Content from Services.” Customer Content is defined as Inputs and Outputs together, and the section assigns all rights in Outputs back to the customer. This is the cleanest default in the industry.<\/p>\n\n\n\n For Claude.ai (the free consumer product), the Anthropic Privacy Policy<\/a> (effective July 8, 2026) confirms that consumer conversation history is “automatically deleted from our back-end within 30 days,” with training opt-in controlled via the consumer settings. Free-tier Claude.ai does allow a 30-day window of stored chat history for the user-facing chat experience; deletion happens on the back end but the surface history may persist in backups for longer, as is standard for cloud infrastructure. Enterprise customers on Claude for Work have the same no-training guarantee as API customers and operate under Anthropic’s published trust and compliance commitments<\/a> (SOC 2 Type II, ISO 27001, HIPAA-eligible configurations).<\/p>\n\n\n\n Google’s Gemini Apps Privacy Hub<\/a> (last updated August 10, 2026) covers the consumer product: Gemini app, gemini.google.com, and Gemini in Google Messages. The hub documents what is collected (conversations, location with permission, feedback) and what is not (Gemini does not use consumer chat history to train foundation models outside the opt-in experimental channels).<\/p>\n\n\n\n For Google Workspace customers, the Gemini data governance documentation<\/a> is more specific: Workspace Gemini does not use customer data (emails, documents, chats) to train foundation models outside the tenant boundary. Human review is opt-in for Workspace. Data residency and EU Data Boundary options apply. This is the right tier for any business that has not negotiated a separate data-protection addendum.<\/p>\n\n\n\n Microsoft Copilot’s privacy documentation<\/a> makes a sharp distinction between the consumer Copilot (formerly Bing Chat) and the paid Microsoft 365 Copilot tier. For Microsoft 365 Copilot, prompts and responses are processed within the Microsoft 365 service boundary; content is not used to train foundation models for paid enterprise tiers. The free Copilot tier has more permissive defaults and may use conversations for model improvement; this is the right tier to avoid for sensitive work.<\/p>\n\n\n\n Apple’s approach is architecturally different from the rest of the field, and worth understanding on its own terms. The Private Cloud Compute white paper<\/a> describes a system where Apple Intelligence runs on-device by default; when a request exceeds on-device capacity, it is routed to PCC servers that are stateless, cryptographically attestable, and built on custom Apple Silicon with non-volatile disks cryptographically erased on shutdown. Apple publishes the PCC software images so independent researchers can verify the runtime matches the documentation. This is not a “we promise we won’t use your data” claim \u2014 it is a “we architected the system so the data cannot persist” claim.<\/p>\n\n\n\n For practical purposes: if you are already in the Apple ecosystem and your workload fits on-device (summarization, drafting, Shortcuts automation, image generation in supported formats), Apple Intelligence is the lowest-friction privacy posture in the industry. If you need a frontier model on Apple silicon, you are routing through PCC and inheriting Apple’s audit posture. See our on-device AI 2026: Apple, Gemini Nano, and Qualcomm<\/a> breakdown for the full Apple vs Android on-device comparison.<\/p>\n\n\n\n Meta AI (the assistant in WhatsApp, Instagram, Facebook, and at meta.ai) defaults to training-data use for consumer prompts. Opt-out exists in the AI settings but is opt-out, not opt-in, which is a meaningful difference in a regulated context. For any work you would not want on Meta’s servers, route through a non-Meta provider’s API with explicit zero-retention configuration.<\/p>\n\n\n\n The long tail of AI products \u2014 Grok, Mistral Le Chat, Perplexity, You.com \u2014 varies widely. Perplexity retains search queries and AI responses; Grok retains conversations and trains on them by default; Mistral has separate consumer (Le Chat) and API tiers with different defaults. The rule is the same for each: read the policy page, identify which of the five categories the product touches, and confirm the default matches your threat model.<\/p>\n\n\n\n Most AI privacy pages are written for compliance teams, not practitioners. The fastest way to extract what you need is to ask five questions in order:<\/p>\n\n\n\n If the page does not answer one of these five questions in plain language, treat that gap as a default that works against you. The provider’s silence is not your protection \u2014 it is the absence of one.<\/p>\n\n\n\n The list below is ordered from cheapest to most expensive. Each pattern is independently useful; you can deploy any one of them in under an hour.<\/p>\n\n\n\n For OpenAI, Anthropic, Google, and Mistral, the API tier has stricter training and retention defaults than the consumer product. Routing your work through the API means you inherit those defaults rather than the consumer defaults. The cost is integration work (you need a key, a script, or a UI like Typing Mind or Open WebUI); the benefit is a documented no-training posture and the ability to negotiate enterprise terms.<\/p>\n\n\n\n OpenAI offers Temporary Chat (no retention, no training, no Memory use); Anthropic offers ephemeral session settings; Google’s Gemini has incognito-style modes. These modes cost nothing and remove the conversation from any retention surface. Use them for one-off sensitive queries.<\/p>\n\n\n\n The cheapest pattern: replace identifying details with placeholders before you paste. Use If you work on a team that handles regulated data \u2014 financial, health, legal, customer PII \u2014 the consumer product is not the right tool. Enterprise tiers (ChatGPT Enterprise, Claude for Work, Workspace Gemini, Microsoft 365 Copilot) all have stricter defaults and contractual protections. The cost is procurement friction and a per-seat license fee. The benefit is a signed DPA, contractual breach commitments, and an audit trail.<\/p>\n\n\n\n OpenAI offers zero-data-retention for eligible customers; Anthropic’s commercial terms make Customer Content opt-out of training by default; Google provides customer-managed encryption keys for Workspace. These are the right tier for processing customer data under a BAA or DPA. If your usage does not justify a custom negotiation, the next pattern is the right fallback.<\/p>\n\n\n\n If your workload fits a model you can run on your own hardware \u2014 and in 2026 that is a much wider range than it was two years ago \u2014 you can guarantee zero data leaves your machine. The next section covers the trade-offs honestly.<\/p>\n\n\n\n Three open-source projects define the local-LLM stack. Ollama<\/a> is the easiest install \u2014 one binary, a model pull command, and a local API at The trade-offs are real. Model quality on local hardware lags the frontier by 6 to 18 months: an M-series Mac or a workstation with 24 GB of VRAM will run a 30-billion-parameter model that performs roughly at GPT-4-mini level. For many tasks \u2014 drafting, summarizing, transforming structured data, code review \u2014 that is enough. For tasks that need the current frontier \u2014 long-context reasoning, agentic tool use, complex instruction following \u2014 it is not. The honest answer is to mix: local LLMs for the most sensitive work, API endpoints for the rest. See our 2026 local LLM setup guide<\/a> for a working Ollama + LM Studio comparison, and the 2026 frontier model benchmark<\/a> for where local models still lag the API.<\/p>\n\n\n\n The other trade-off is memorization<\/em>. A model that has been trained on a corpus containing your company’s data, your competitor’s leaked documents, or your customer’s support tickets will memorize some of it. If you ingest a model that was pretrained on data you would not want it to know, you inherit that knowledge. The mitigation is to use models with documented training corpora and published “unlearning” policies \u2014 and to run them on hardware you control rather than uploading sensitive prompts to a hosted playground. For a working setup that keeps every prompt on your laptop, see our sister-publication guide to running a private ChatGPT clone on your laptop in 10 minutes with Ollama + Open WebUI<\/a>. A model that has been trained on a corpus containing your company’s data, your competitor’s leaked documents, or your customer’s support tickets will memorize some of it. If you ingest a model that was pretrained on data you would not want it to know, you inherit that knowledge. The mitigation is to use models with documented training corpora and published “unlearning” policies \u2014 and to run them on hardware you control rather than uploading sensitive prompts to a hosted playground.<\/p>\n\n\n\n Even with perfect provider defaults, your AI assistant can leak data through a channel that is not in the provider’s privacy page at all: indirect prompt injection. The seminal paper is “Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection”<\/a> by Greshake et al. (arXiv 2310.12815). The mechanism is simple: when your assistant retrieves third-party content \u2014 an email, a web page, a document \u2014 that content can carry hidden instructions that hijack the assistant into exfiltrating data you have access to. The attacker does not need to touch the provider’s servers at all; they just need to be in your retrieval surface.<\/p>\n\n\n\n OWASP’s Top 10 for LLM Applications<\/a> ranks this as LLM01 \u2014 Prompt Injection \u2014 the highest-severity category. The defense is at the integration layer, not the model layer: treat all retrieved content as untrusted input, separate “data” from “instructions” in your prompt template, and run untrusted content through a permission boundary before it reaches the model. This is one reason enterprise tiers matter: they ship with these defenses integrated; consumer products generally leave the burden on the developer.<\/p>\n\n\n\n If you build anything that combines a model with retrieval \u2014 RAG over internal docs, AI agents that browse, MCP servers that fetch from external APIs \u2014 indirect prompt injection is a privacy threat you cannot ignore. It does not matter how good the provider’s defaults are if the attacker can speak to the model through your data. For a worked look at the integration-side surface, see our OpenAI Agents SDK practical guide<\/a> and the Microsoft agent governance toolkit review<\/a>.<\/p>\n\n\n\n Two pieces of EU regulation define the floor for AI privacy in 2026. The General Data Protection Regulation<\/a> (Regulation 2016\/679) defines personal data broadly enough to cover prompts containing identifying details; Article 6 (lawful basis), Article 17 (right to erasure), Article 22 (automated decision-making), and Article 30 (records of processing) all apply when an AI system processes personal data. The right to erasure (Article 17) is the most actionable: you can require any provider to delete your data, subject to legal-hold exemptions, and most major labs publish a workflow for it.<\/p>\n\n\n\n The EU AI Act<\/a> (Regulation 2024\/1689) is the risk-tiered horizontal regulation that took effect on a phased timeline starting in 2024. Article 5 lists prohibited practices; Article 10 requires high-quality training datasets with appropriate governance; Article 13 mandates transparency when an AI system interacts with people. The AI Act is enforced by national authorities in each member state; the European AI Office coordinates cross-border cases.<\/p>\n\n\n\n The honest framing for practitioners: GDPR gives you the right to demand deletion and to require a lawful basis for processing. The AI Act adds transparency obligations for providers, which improves the documentation surface but does not directly reduce your exposure. If you process EU personal data through an AI system, both apply to you, and your provider’s terms-of-service need to be compatible with both.<\/p>\n\n\n\n If you read this far, you have one hour of work to deploy the highest-leverage patterns. Spend five minutes on the audit; spend fifty-five on the hardening.<\/p>\n\n\n\n AI privacy in 2026 is not a single setting \u2014 it is five overlapping mechanisms, each with its own default, each with its own defensive pattern. The major labs publish precise defaults; your job is to know which ones apply to your usage and to harden the surfaces you actually expose. The cheapest first move is to turn off training and Memory in every consumer account you use, route sensitive work through the API, and run the most sensitive work locally. The hardest move is to treat retrieval content as untrusted input \u2014 but that is the only mitigation that survives a sophisticated attacker.<\/p>\n\n\n\n The frontier is moving fast. Provider policies change; new products land with weaker defaults; new regulations tighten the floor. Bookmark this article; come back in three months; re-run the audit. The providers are doing their part. Your part is to verify, not to trust. For the broader context, see AI safety research from Anthropic<\/a>, the Anthropic frontier safety roadmap<\/a>, and the 2026 frontier model benchmark<\/a> \u2014 three pieces that shape what “privacy” actually means in the API tier.<\/p>\n\n\n\n\n The five questions practitioners ask most often when they hit this topic for the first time, with the short answers and the longer reasoning behind each.<\/p>\n\n\n\n By default, free and Plus ChatGPT users have “Improve model for everyone” enabled, which routes a subset of conversations into the training pipeline. Open the Settings → Data Controls panel and disable “Improve model for everyone” to opt out. ChatGPT Team, Enterprise, and Edu tiers have training disabled by default regardless of the setting. The OpenAI API is also no-train by default; you would have to explicitly opt in to share data.<\/p>\n\n\n\n For Claude API customers: no. The Anthropic Commercial Terms explicitly state that “Anthropic may not train models on Customer Content from Services.” For Claude.ai free-tier consumers, consumer conversation history is auto-deleted from Anthropic’s back-end within 30 days, and training opt-in is controlled in user settings. Enterprise customers on Claude for Work inherit the API no-training guarantee with the additional SOC 2, ISO 27001, and HIPAA-eligible configurations published in the Anthropic Trust Center.<\/p>\n\n\n\n Yes, with the right configuration. Workspace Gemini does not use customer data — emails, documents, chats — to train foundation models outside the tenant boundary. Human review is opt-in for Workspace. Data residency and EU Data Boundary options apply for European customers. This is materially different from the consumer Gemini app, which has different defaults. If you handle regulated data on Workspace, the right move is the paid Workspace tier with the data governance settings verified by your security team.<\/p>\n\n\n\n For drafting, summarizing, transforming structured data, and code review: yes, with a 7B-30B parameter model on a recent M-series Mac or a workstation with 24 GB of VRAM, you can match GPT-4-mini quality and route zero data off your machine. For long-context reasoning, agentic tool use, and complex instruction following: the quality gap is 6-18 months behind the frontier. The honest answer is to mix: local LLMs for the most sensitive work, API endpoints for the rest, and never route regulated data through a consumer chat product.<\/p>\n\n\n\n Indirect prompt injection is when third-party content your assistant retrieves — an email, a web page, a document — carries hidden instructions that hijack the assistant into exfiltrating data you have access to. OWASP ranks it as LLM01, the highest-severity category in its Top 10 for LLM Applications. If you build any system that combines a model with retrieval, RAG, or tool use, this is a first-class threat you cannot mitigate at the provider level — the defense has to live at the integration layer. Treat all retrieved content as untrusted input; separate “data” from “instructions” in your prompt template; audit the retrieval surface for adversarial content.<\/p>\n\n\n\n\nThe Provider-by-Provider Audit: What Each Lab Logs by Default in 2026<\/h2>\n\n\n\n
OpenAI: API vs. ChatGPT \u2014 Two Different Defaults<\/h3>\n\n\n\n
Anthropic: The Most Stringent API Default<\/h3>\n\n\n\n
Google Gemini: Consumer vs. Workspace Tiers<\/h3>\n\n\n\n
Microsoft Copilot: Enterprise Service Boundary by Default<\/h3>\n\n\n\n
Apple Intelligence and Private Cloud Compute: The Architectural Argument<\/h3>\n\n\n\n
Meta AI and the Long Tail<\/h3>\n\n\n\n
How to Read Any AI Provider’s Privacy Page in Five Minutes<\/h2>\n\n\n\n
\n
The Defensive Playbook: Six Patterns That Actually Reduce Exposure<\/h2>\n\n\n\n
1. Use the API, not the consumer chat<\/h3>\n\n\n\n
2. Use ephemeral or temporary chat modes<\/h3>\n\n\n\n
3. Redact before you paste<\/h3>\n\n\n\n
[CLIENT_NAME]<\/code>, [REVENUE_2025]<\/code>, [EMPLOYEE_ID]<\/code>, and a back-substitution step after the model returns. This costs nothing and survives any provider default. For repeated work, write the substitution table in a local file the model never sees.<\/p>\n\n\n\n4. Choose enterprise tiers for team work<\/h3>\n\n\n\n
5. Negotiate zero-retention endpoints for the highest-stakes work<\/h3>\n\n\n\n
6. Run local LLMs for the most sensitive work<\/h3>\n\n\n\n
Local LLMs in 2026: When On-Device Inference Is Worth the Trade-off<\/h2>\n\n\n\n
localhost:11434<\/code>. LM Studio<\/a> is the friendliest desktop UI \u2014 model search, parameter sliders, an OpenAI-compatible local server. llama.cpp<\/a> is the underlying C\/C++ inference engine that powers both. Inference runs entirely on-device; no prompt leaves the machine unless you explicitly point the tool at a remote endpoint.<\/p>\n\n\n\nPrompt Injection: The Privacy Threat Your Provider Cannot Stop<\/h2>\n\n\n\n
What GDPR and the EU AI Act Actually Require (And Don’t)<\/h2>\n\n\n\n
What to Do This Week: A Concrete Checklist<\/h2>\n\n\n\n
\n
Frequently Asked Questions<\/h2>\n\n\n\n
Does ChatGPT train on my conversations?<\/h3>\n\n\n\n
Does Claude train on what I send?<\/h3>\n\n\n\n
Is Gemini in Google Workspace safe for business data?<\/h3>\n\n\n\n
Are local LLMs good enough for real work?<\/h3>\n\n\n\n
What is indirect prompt injection and should I worry about it?<\/h3>\n\n\n\n