AI and models · 21 Oct 2026

AI Chatbots and Data Privacy: What US Users Should Know

Training opt-outs, temporary chats and deletion controls answer different questions. A practical US guide to personal and workplace accounts, connected apps, sensitive information and the limits of provider privacy promises.

By PrimetimeGeek AI Desk

Original ink illustration of a chatbot inside a transparent boundary, documents and a key, and a person reviewing permissions on a laptop. — Privacy depends on the information shared, permissions granted and terms of the specific service. Original conceptual artwork, not a depiction of any provider’s security.

An AI chatbot can feel like a private conversation. You type a question, receive a personalized answer and move on. But when the service runs in the cloud, the conversation is also a disclosure to a company and the systems it uses to deliver the service. A friendly interface does not make the exchange confidential in the legal or professional sense.

For American users, the useful question is not simply whether a chatbot is 'safe.' It is which information goes where, what the provider may do with it, how long it remains available and what control you actually have. Those answers can differ between a personal account, an employer-managed workspace and a developer's application using an API—even when the same model powers all three.

This guide synthesizes official provider documentation and US government guidance checked on October 21, 2026. It is not a technical audit, a provider ranking or legal advice. Provider statements establish their published commitments; they do not independently prove how every system implements them. Settings, account types and feature terms can change.

A prompt is more than the words you type

The information you disclose can include an uploaded document, an image, a voice recording, a screenshot or material retrieved from a connected account. A request to 'summarize this email thread' may expose other people's names, contact details, commercial negotiations and attachments—not just your question. A screenshot can contain browser tabs, notifications or account identifiers you did not intend to discuss.

Treat the chatbot as a recipient, not merely a calculator. Before sending something, ask whether you would be authorized to share the same material with an outside service. For a public recipe or a generic programming question, the consequences may be modest. For a medical record, a customer's account history or an unpublished acquisition plan, the decision deserves a different standard.

The model's reassuring answer is not a substitute for the service's policy. Asking 'Will you keep this secret?' cannot change the account's retention settings, contract or connected-app permissions. Nor does a request in the prompt not to remember something necessarily operate the product's actual memory controls.

Four privacy questions that must stay separate

Training: Can eligible conversations or files be used to develop or improve models? A training opt-out addresses that use. It does not automatically stop processing needed to answer your request, prevent all safety review or erase information already stored.

Retention: How long does the service keep the conversation and associated information? History visible in the interface, operational storage, safety records and training pipelines may have different rules. A promise about one category should not be read as a promise about all of them.

Human review: Can employees or service providers examine some information for safety, support, evaluation or improvement? An automated response does not mean the entire data-handling process is automated. Review conditions matter even when training is disabled.

Deletion: What does deleting a conversation actually remove, on what timetable and with which exceptions? Removing a chat from your screen is not proof of immediate erasure from every system. Likewise, deleting source material is not evidence that a previously trained model has been retrained to remove its influence.

A fifth question often sits beside these: sharing. A shared conversation link, connected app or third-party action may create another recipient with separate rules. These are distinct controls, not interchangeable labels for 'privacy.'

What current provider documentation says

ChatGPT: a training choice is not a storage guarantee

OpenAI says content from its individual services may be used to train models, and that opting out prevents new conversations from being used for training. Its current data-controls instructions put the 'Improve the model for everyone' choice in Settings under Data controls. Turning it off can leave conversations in chat history. 2

OpenAI also says Temporary Chat conversations do not appear in history, use or create memories, or train its models. That describes specific uses; it should not be expanded into a promise that information never reaches the provider or is never retained for another purpose. Its model-use explainer separately says business products and the API do not use inputs and outputs for training by default. 1

The practical distinction is account type, not whether you pay a subscription. A paid personal account should not automatically be treated as a workplace service with an employer's contract. Check which workspace is active before pasting work material, and read the terms for any separate product or feature you use.

Gemini: activity off does not mean zero retention

Google's Gemini Apps Privacy Hub says some collected data is reviewed by human reviewers, including trained reviewers from service providers, and warns against entering confidential information you would not want a reviewer to see. It describes several controls rather than one universal off switch. Gemini Privacy Hub

The same notice says temporary chats and chats made with Keep Activity off are retained with the account for 72 hours to respond to users and protect Google, users and the public. It says temporary chats are not used to train Google's AI models; with Keep Activity off and no feedback submitted, the notice also excludes those future chats from improving its AI models. The retention statement is precisely why 'not used for training' should not be translated into 'not stored.'

Personal-account activity controls are not a complete description of a work or school deployment. Google's activity guidance says an administrator may control settings for an organization-managed account. Review the account notice and your administrator's rules rather than applying a personal-account tutorial to every Gemini service. Activity management

Claude: consumer and commercial terms differ

Anthropic's commercial guidance says it does not use inputs or outputs from commercial products, including Claude for Work and its API, for model training by default. It also identifies exceptions when users explicitly provide feedback or otherwise permit use. 'By default' is an important qualification, not decorative wording. Commercial model-training guidance

For consumer services, Anthropic describes model-improvement settings separately. Its retention guidance says a deleted conversation leaves chat history immediately and is removed from backend storage within 30 days. When a user allows model improvement, eligible data may be retained in de-identified form for up to five years in training pipelines; the notice also describes safety-related exceptions. These are that provider's stated terms, not an industry-wide deletion timetable. Retention guidance · Consumer settings

These examples are not a privacy scorecard. Different feature sets, agreements and exceptions make a simple ranking misleading. De-identification is also a description of a handling process, not a reason to submit information you have no authority to disclose.

Connected apps expand the boundary

A connection to email, cloud storage or a calendar can supply useful context. It also changes what the chatbot can access. Review the actual authorization screen: which account, what categories of data, and whether the permission allows reading only or also taking actions. Do not assume that a narrow question implies a narrow technical permission.

Before connecting a work drive, consider access to shared documents and information belonging to colleagues or customers. Use the smallest permission scope the service supports, connect only accounts needed for the task and revoke unused connections. Check whether the third party receives content and which policy governs its use. Google's Privacy Hub and Anthropic's policy-update notice describe connected-service handling, but neither can replace reviewing the specific integration. Anthropic policy updates

Files and retrieved pages can also contain malicious instructions aimed at the chatbot. That risk is not identical to model training: an agent that can send messages or move data has an additional disclosure path. Sensitive work may require approved tools, limited permissions and confirmation before an external action. Our AI-agent evaluation guide explains why tool access should be tested separately from the quality of answers.

What to keep out—and how to ask a useful question anyway

Do not enter passwords, one-time authentication codes, recovery keys or private API credentials. Avoid Social Security numbers, full financial-account details, identifiable health records, children's personal information and confidential workplace material unless the specific service is approved for that use and you have authority to share it. A training opt-out alone is not that approval.

Often the useful part of a question survives without the private detail. Instead of uploading an actual bank statement, describe a budgeting problem with invented amounts. Instead of pasting an employee's performance review, ask for a neutral review structure using fictional examples. For a coding problem, remove credentials and proprietary data and create a minimal example that reproduces the issue.

Replacing a name is not always enough. A distinctive job title, location, date and incident can identify a person together. Attachments may retain comments, revision history or metadata. Review the whole item, not just the first paragraph. Minimize the information you send rather than relying entirely on downstream deletion.

Local software can change this analysis, but a 'local AI' label is not proof that nothing leaves the device. Check whether inference actually stays local and whether optional cloud features, telemetry or connections transmit information. The relevant question remains the data path, not the marketing label.

US privacy rights: do not assume a nationwide rule

American privacy protections combine federal sector-specific requirements, state laws and other obligations. Rights and exceptions depend on residence, the organization, the information and the context. A deletion or access right described for one state should not be presented as an unconditional nationwide right to erase every chatbot record.

California residents can start with the California Privacy Protection Agency's official materials when assessing state-specific rights and complaint options. Other residents should consult their state's official privacy resources or attorney general. Read the service's request process, expect identity verification where appropriate and distinguish a chat-delete button from a formal privacy-rights request. California Privacy Protection Agency

Neither a claim that a product is 'enterprise-grade' nor a general compliance badge establishes that your particular medical, legal or workplace disclosure is authorized. Consult an appropriate professional or your organization when regulated or confidential material is involved. NIST's Generative AI Profile provides a voluntary risk-management framework, not a consumer privacy law or certification of a chatbot. NIST AI 600-1

Children and teenagers need a separate conversation

The FTC says COPPA imposes requirements on online services directed to children under 13 and other services with actual knowledge that they collect personal information online from a child under 13. That is a defined legal scope, not a guarantee that every chatbot is suitable for children or a complete account of teenagers' protections. 1

Parents should check age rules, privacy notices and available supervision tools before a child uses a chatbot. Discuss why school names, addresses, family difficulties, photos and private conversations should not be shared casually. Emotional engagement can encourage disclosure; a conversational style does not establish confidentiality or professional care. A school's approved arrangement is also not necessarily equivalent to a student's personal account.

If you have already shared something sensitive

Stop adding information and identify what was exposed and to which service, workspace, shared link or connector. Delete the relevant conversation where available, review memory and sharing controls separately, and use the provider's privacy process when appropriate. Revoking a connector can stop future access; it should not be assumed to retract everything previously transmitted.

If the content included a password or key, change or revoke it promptly. If it involved workplace or customer information, notify the responsible security or privacy contact rather than trying to conceal the mistake. Financial or identity exposure may require contacting the relevant institution. Deletion is a useful step, but it is not a guarantee that the original disclosure has been undone.

A before-you-chat checklist

Confirm the exact service, personal or managed account, workspace and feature you are using.
Read the current training choice separately from retention, human-review and deletion terms.
Check files, memory, shared links and connected-app permissions; remove unnecessary access.
Replace sensitive details with a minimal fictional example where possible, and consider other people's information too.
Use an approved arrangement for confidential or regulated work; a paid plan or an opt-out is not sufficient evidence on its own.
Recheck controls after changing plans, adding features or receiving a policy-update notice.

The bottom line is not that Americans should avoid every chatbot. It is that privacy is a set of decisions, not a single toggle. Use these tools for tasks whose disclosures you understand, keep high-consequence information out unless the arrangement is appropriate, and never mistake a conversation that feels personal for one that is automatically confidential.