The main AI privacy concerns are that your prompts are data: they may be stored, read by reviewers, used to train models, or exposed by a mistake. Regulators in the US, UK and EU say existing privacy rules apply to AI, though some details are still being worked out. You can lower the risk by sharing less, using each service's privacy settings, and knowing how to ask for deletion.
01What are the main privacy concerns with AI chatbots?
Five concerns come up in company policies and regulator papers. Each is a question you can put to any chatbot. This is general information, not legal advice.
- Training: is what you type used to improve the model? OpenAI says it may do so for individual accounts unless you opt out, and Google says saved Gemini activity may be used for training.
- Human review: can a person read your chat? Google's Gemini notice says a sample of chats is reviewed by trained reviewers, including outside service providers.
- Retention: how long does data stay after you press delete? OpenAI's policy says up to 30 days in normal cases; Google says reviewed chats can be kept for up to three years, separated from your account.
- Exposure: can data leak? Italy's regulator said OpenAI did not report a data breach it suffered in March 2023.
- Memorisation: can a model repeat personal data it saw in training? The UK ICO notes that models can memorise and reproduce training data.
02What do privacy regulators say about training on personal data?
In December 2024 the European Data Protection Board, which brings together EU privacy regulators, adopted an opinion on AI models at the request of Ireland's regulator. It says whether a model is anonymous must be judged case by case, and that a model trained on personal data is not automatically anonymous. It also says companies relying on 'legitimate interest' must pass a three-step test: a real interest, necessity, and a balance against people's rights.
The UK ICO's call for evidence on generative AI says rights to be informed, to access, to erasure and to object apply to personal data in training sets, fine-tuning data, outputs and prompts. The ICO calls this emerging thinking, and says it does not mean any particular processing is lawful.
France's CNIL said on 7 February 2025 that the GDPR still applies to AI, that people must be informed if a model may memorise their data, and that rights to access, correct, object and delete remain, with some flexibility where they are technically hard to honour.
In the US, an FTC staff post from 9 January 2024 says AI companies must keep their privacy promises, and that quietly changing terms to use customer data for training can be unfair or deceptive. It adds that "there is no AI exemption" from existing laws.
03What do the big chat services say about your data today?
Here is a short comparison from each company's own pages, as of 24 October 2026. Pages change, so check the originals.
- ChatGPT: individual accounts may be used for training unless you opt out; Temporary Chats are not used for training; deleted chats are removed within 30 days.
- Gemini: chats saved with Keep Activity on may be used for training; the default auto-delete period is 18 months.
- Perplexity: its help page describes an 'AI data retention' switch in Preferences that controls whether search data helps improve its Sonar models. See its account settings page.
These are company statements, not audits. Nobody outside a company can confirm from these pages how a setting works inside its systems.
04What can you do to protect your privacy?
Small habits matter more than any single setting.
- Decide before you type. If a leak would hurt, leave it out, or swap real names and numbers for made-up ones.
- Find the training switch. In ChatGPT it is under Settings and Data Controls; in Gemini it is Keep Activity inside Gemini Apps Activity; in Perplexity it is AI data retention under Preferences.
- Use the private modes for sensitive questions: ChatGPT Temporary Chat, Gemini temporary chats or Perplexity Incognito.
- Delete what you no longer need and choose an auto-delete period where one is offered.
- Use your rights. OpenAI and Perplexity both point to request forms, and what you can ask for depends on where you live.
- Keep work and school data out of personal accounts unless your employer or school allows it.
If a company does not answer a deletion or access request, OpenAI's policy and Perplexity's notice both mention a right to complain to a data protection authority where you live. For a legal dispute, ask a lawyer.
?What is not known
- Regulators have not settled when a trained model counts as holding personal data; the EDPB says each case must be judged on its facts.
- The ICO's generative AI work is a consultation and its older AI guidance is under review, so UK expectations may change.
- These pages cannot show how well deletion or opt-out works inside a trained model.
- Company settings change often: OpenAI updated its policy on 10 September 2026, and Google and Perplexity updated theirs in October 2026.
QQuestions people ask
Is it safe to put work documents into a chatbot?
Only if your employer has approved that tool and account type. OpenAI says business products are not trained on by default, while personal accounts follow different settings. Ask your IT or privacy team first.
Do I have the same privacy rights everywhere?
No. Rights such as access and deletion depend on local law, and the regulators above mostly speak for the EU, the UK and the US. Company policies describe rights by region.
Last checked October 24, 2026. Rules and settings change, so open the source to see the current version.
- EDPB Opinion 28/2024 on AI models European Data Protection Board The full opinion, adopted 17 December 2024; we used its summary on anonymity and legitimate interest.
- ICO fourth call for evidence on generative AI UK Information Commissioner's Office A consultation page on how information rights apply to generative AI, used for the rights and memorisation points.
- CNIL recommendations on AI and the GDPR CNIL (France) The French regulator's February 2025 recommendations on informing people and honouring rights.
- AI companies: uphold your privacy and confidentiality commitments US Federal Trade Commission FTC staff post from January 2024 on keeping privacy promises when training on customer data.
- How your data is used to improve model performance OpenAI OpenAI's description of training and the opt-out for individual accounts.
- OpenAI US privacy policy OpenAI Used for the 30-day deletion window and the right to complain to a regulator.
- Gemini Apps Privacy Hub Google Google's page on Gemini chats, human review, training and retention, updated 23 October 2026.
- Garante press release on ChatGPT Garante per la protezione dei dati personali (Italy) Used for the finding about an unreported 2023 breach.
- Perplexity account and settings help Perplexity Help page describing the AI data retention switch in Preferences.
General information, not legal, medical, financial or investment advice. We are not affiliated with any company, agency or standards body named here. See our editorial policy and corrections, or tell us about a mistake at [email protected].