What happens to the data you give an AI?

In May 2025, in the lawsuit brought against it by the New York Times, OpenAI was ordered to preserve ChatGPT conversations, including those their authors had deleted; according to OpenAI, the Enterprise and Edu plans were not affected. The general obligation ended on 26 September that year, but the conversations already preserved and those of the accounts designated by the newspaper remain accessible. In late 2025, Judge Ona Wang ordered 20 million conversations, de-identified by OpenAI, to be handed to the newspapers' lawyers.

The fate of a conversation thus depends on the plan as much as on the settings. This survey compares 7 assistants, based on the rules in force in November 2026.

A message sent to an assistant, with any attached document or image, goes to the provider's servers and enters a history that the user can see and delete. From there, it can be used to train later models, be read by a person, steer advertising, become public through a sharing link, or be handed to a court or the police. Some of these paths can be closed by a setting, others by a contract, and others by neither of these 2 means.

Files follow the same route: at Google, with the setting on, a sample of the files and photos sent since 2 September 2025 is used to improve the services.

At 6 of the 7 assistants surveyed, a conversation is used to train the models unless the user opts out. At Google, training follows the setting that keeps the history, "Keep Activity", which is on by default from age 18. Anthropic, the provider of Claude, has asked each user to choose since August 2025. A personal subscription does not change the rule: the Plus and Pro plans of ChatGPT and the Pro and Max plans of Claude follow the same rule as the free version, as do all individual accounts on Vibe (formerly Le Chat).

How to reach each setting is explained in our ethical ranking of assistants↗ and on a page by the CNIL, the French data protection authority. A thumbs-up or thumbs-down rating brings the conversation into the provider's data: Anthropic keeps this feedback for 5 years, Mistral AI uses feedback that carries a comment on all its plans, and ChatGPT's training setting does not cover it. Turning off training does not have the same effect everywhere: Microsoft excludes future conversations, without saying anything about earlier ones; Anthropic also stops using conversations already kept, except in models already trained.

On WhatsApp, Meta AI cannot see personal messages, which are end-to-end encrypted. Meta receives whatever is written to Meta AI; in a group, any participant can call it up, and in the EU a message shared in this way can be used to train Meta's models.

At Google, the same conversation is kept for 72 hours or 18 months depending on a single setting.

Deleting a conversation removes it from the history straight away; at both OpenAI and Anthropic, it then leaves the servers within 30 days. At Anthropic, a deleted conversation is no longer used for later training, but remains in the models already trained. This time limit does not apply to every copy: a conversation reviewed at Google is kept for up to 3 years, even if deleted.

Keeping a year of conversations on the servers emits less than 10 gCO2e, according to our calculation on the actions that reduce the impact of AI↗.

Providers have people read conversations to rate the quality of answers and to detect abuse. At Google, a sample of conversations with Gemini is reviewed, including by contractors, after being detached from the account, then kept for up to 3 years, even if the user deletes their activity. Turning off "Keep Activity" stops this review for later conversations, except for the review used for safety, and the Google Workspace contract excludes it. The Gemini privacy page asks users not to enter confidential information that they would not want a reviewer to see.

In August 2025, OpenAI explained that conversations in which a user plans to harm others are passed to a small team; if that team judges the threat to be imminent, the company may alert the police, which it said it did not do in cases of self-harm. Anthropic keeps conversations flagged by its safety tools for 2 years, and classification scores for 7 years. At OpenAI and Anthropic, the training settings do not cover these safety reviews.

Since 16 December 2025, Meta has used exchanges with Meta AI to choose the advertisements and content in its applications. Exchanges on sensitive subjects, such as health or political opinions, are not used for advertising, and the user cannot object to the rest. The European Union, the United Kingdom and South Korea were excluded at launch.

ChatGPT has shown advertisements in France since 24 August 2026, in its free and Go versions; the more expensive subscriptions are exempt. In the European Economic Area, they are not personalised for now: they are chosen from the subject of the current conversation, and OpenAI says it passes only statistics to advertisers. The new Copilot app chooses its generic advertisements from the current conversation, and can personalise them from the history as long as the setting remains on. Google writes that conversations with Gemini are not used for advertising.

In late July 2025, journalists found thousands of ChatGPT conversations in Google results, made "discoverable" by a checkbox in the sharing window. OpenAI removed the checkbox promptly. In August, Forbes counted more than 370,000 conversations with Grok indexed by Google, published through its share button without warning; some contained health questions, names and a password.

In most plans for organisations, the rule is reversed: conversations are excluded from training by default. At Mistral AI, only the Enterprise plan excludes them by default; in the Team plan, it is up to the administrator to turn off training for the whole organisation. Microsoft states that it acts as a processor within the meaning of the GDPR and uses the data only on the customer's instructions; Google and Microsoft let the organisation set the retention period.

At Microsoft, searches sent to Bing fall outside the data processing agreement; Claude models remain within it, but may be processed outside the EU. Finally, the contract covers only the organisation's accounts: the guide to using AI published by the French government in June 2026 asks its civil servants not to use personal accounts for work.

4 paths lie beyond the user's settings, and partly beyond the contract.

• The courts. In the New York Times lawsuit, ChatGPT's Enterprise and Edu plans were not covered; the others were, deleted conversations included. Sam Altman, OpenAI's chief executive, acknowledged in July 2025 that a conversation with ChatGPT does not have the legal protection of an exchange with a doctor or a lawyer.
• The authorities. The policies of Anthropic and DeepSeek provide for disclosing data to them in order to comply with the law or in response to requests from public authorities.
• Safety. A conversation flagged by Anthropic's tools is kept for up to 2 years and can be used for training even if the user has opted out; at Google, safety review remains possible with the setting off.
• Already-trained models. Anthropic says so in writing: data remain in models already trained, even when the user turns off the setting. According to the European Data Protection Board, a model is anonymous only if it is very unlikely that individuals can be identified in it or that their data can be extracted from it through queries, which is assessed case by case.

The provider's country also matters: DeepSeek stores data in China, Anthropic, for example, transfers Europeans' data to the United States, and the French government's guide points out that a service hosted in the EU can remain subject to the US Cloud Act if it is operated by a company subject to US law.

The GDPR gives everyone a right of access to their data, a right to erasure and, when the processing rests on the provider's legitimate interest, a right to object on grounds relating to their particular situation; the provider may continue if it demonstrates compelling legitimate grounds. In December 2024, the European Data Protection Board accepted that this interest can serve as the legal basis for developing a conversational assistant, if the processing is strictly necessary.

In January 2025, the Garante, Italy's data protection authority, restricted DeepSeek's processing of the data of people in Italy, citing in particular storage in China and the lack of a representative in the EU. For providers established in Ireland, such as OpenAI or Anthropic, the lead authority is the Irish one: for this reason, in March 2026, an Italian court annulled the €15 million fine that the Garante had imposed on OpenAI.

The AI Act, which states that it does not affect the GDPR, changes little for a conversation. It requires providers of general-purpose models to publish a summary of the data used to train them, from 2 August 2025 for models placed on the market since that date and by 2 August 2027 for earlier ones; its transparency rules have applied since August 2026. The retention of conversations and their use for training remain governed by the GDPR. A revision of the GDPR, the digital omnibus, is under discussion: the member states settled their position on 21 October 2026; the European Parliament has not yet done so.

For us, the most useful rule lies in the question the French government asks its civil servants before they use a free version: "Could I publish this information on a website open to everyone?" (our translation). The settings reduce what the provider keeps, without closing off the safety and legal paths. Information you would not publish belongs in a plan under contract, or outside AI altogether.

For an organisation, the question is settled before the first use: in the contract, which sets training and the retention period, and in the AI use charter, which states which accounts and which data are permitted.