Conversations with popular AI chatbots like ChatGPT, Gemini, and Microsoft Copilot may not be as private as users assume. While privacy settings offer some control, they do not always prevent human review or guarantee immediate deletion of shared information.
Human Review and Data Retention Policies
Despite user expectations, major AI providers allow selected chats to be reviewed by people. This practice serves several purposes, including ensuring safety, troubleshooting technical issues, and continuously improving the AI models. It's important to note that not every conversation is routinely scrutinized; automated systems often flag harmful requests, suspicious activity, or policy violations for human oversight.
The extent of human review and data retention varies by service and user settings, as highlighted in a report by Tom’s Guide examining these industry practices.
Disabling AI Training Doesn't Stop All Review
Many users assume that turning off AI model training ensures complete privacy, but this isn't entirely true across platforms:
- ChatGPT: Disabling “Improve the model for everyone” under Data Controls prevents chats from being used for general model training. However, “Temporary Chats” are still subject to review for abuse and are typically deleted after 30 days.
- Gemini (Google): Switching off “Keep Activity” stops future chats from training Google’s models, unless you provide specific feedback. Conversations may still be retained for up to 72 hours for essential service and safety purposes. Furthermore, chats reviewed by humans can be stored for up to three years, even if you delete your activity.
- Microsoft Copilot: Users can disable “Training on conversation activity” in Profile settings. Yet, Microsoft states that some human review may still occur, particularly for investigations into suspected Code of Conduct violations.
- Claude (Anthropic): Incognito Chats are excluded from general training but can be retained for approximately 30 days. Model improvement permissions can be managed in privacy settings.
Limitations of Deleting Chats and Paid Subscriptions
Simply deleting a chat conversation often doesn't lead to immediate or complete removal:
- Deleting a ChatGPT conversation initiates its removal within 30 days, but exceptions can apply due to legal, security, or de-identification requirements.
- Paying for a consumer subscription to an AI service does not automatically confer confidentiality. While business and enterprise-tier services might offer stronger contractual protections, these vary significantly.
Best Practices for Sensitive Information
Given these privacy nuances, users should exercise caution when sharing sensitive data with consumer chatbots. It is strongly advised to avoid inputting:
- Passwords or banking details.
- Sensitive medical records.
- Confidential work files.
Removing names and account numbers can help reduce identifiable information, but context alone might still link data to an individual. For highly sensitive tasks, exploring locally run AI tools can minimize the need to transmit information to cloud services, provided their online features are disabled.