Home / Young Lawyers Section / AI Committee / AI Privacy Tracker / ChatGPT

AI Privacy Tracker · Version 110426

ChatGPT

Plain-English resources for lawyers, judges, and government attorneys who use AI, or want to.

ChatGPT · OpenAI

ChatGPT at a glance

Rated Green

Fit for client confidences after your usual vendor checks.

Rated Yellow

Usable for client confidences only after you deal with the gap named in the entry.

Rated Red

Keep client confidences and secrets out. Settings lower the risk but do not change the color.

When you delete a chat

A deleted chat leaves your account at once. OpenAI says it erases its copy within 30 days.

PlanRatingTrains on your data?How long keptCan the provider read it?
ChatGPT FreeFreeRedYes, by defaultUntil you delete; then up to 30 daysYes
ChatGPT Go$8/mo (US)RedYes, by defaultSame as FreeYes
ChatGPT Plus and ProPlus $20/mo; Pro comes in three tiers: Pro 100, Pro 200, and Pro 500 ($100, $200, or $500/mo)RedYes, by defaultSame as FreeYes
ChatGPT BusinessStandard seat $25/user/mo monthly or $20/user/mo annually; Premium seat $125 or $100; at least 2 seatsGreenNo (contract)Until deleted; admin retention control unclearLimited (incl. abuse-review contractors)
ChatGPT EnterpriseCustom (contact OpenAI sales); not publishedGreenNo (contract)Admin-controlledOnly for incidents or as law requires
ChatGPT EduCustom (contact OpenAI sales); not publishedYellowNo (contract); de-identified use allowedAdmin-controlled; de-identified data keptOnly for incidents or as law requires

Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. Select a plan for its full entry.

Official pages

Deleting a chat

What deleting does on ChatGPT

Personal plans (Free, Go, Plus, Pro): what happens after a chat is deleted
The chat disappears from your account at once. OpenAI then schedules it for permanent deletion from its systems within 30 days. A deleted chat cannot be restored by you or by OpenAI Support. Provider page
Copies kept anyway
  • Chats OpenAI had already de-identified and separated from your account are not deleted.
  • OpenAI keeps chats longer when it must for security or legal reasons.
  • Files saved to the Library stay there until they are deleted separately.
  • Deleting a chat does not delete saved memories, which are deleted separately. OpenAI may keep logs of deleted memories up to 30 days.
  • Feedback you already sent (thumbs up or down) may already have been used to train.
  • New York Times lawsuit: a court order of May 13, 2025 made OpenAI keep all chat records it would otherwise delete, including chats that users deleted. That duty ended on September 26, 2025 (order of October 9, 2025). But data already kept stays on legal hold (OpenAI describes it as limited April to September 2025 data, open only to a small legal and security team), except data from users in the EEA, Switzerland, or the UK. OpenAI must also keep going-forward data for accounts tied to 89 domains, mostly news sites, listed in the October 9, 2025 order. A separate order of November 7, 2025 made OpenAI produce a de-identified sample of 20 million consumer chats. The district judge affirmed it on January 5, 2026. OpenAI says the sample covers December 2022 to November 2024. As of October 24, 2026 we found no newer preservation order, but we could not check the full court docket.

In short: deleting removes a chat from view, but it does not undo what has already happened to it. On business plans, the organization's retention settings decide how long chats are kept; each plan below explains how.

Plan by plan

Every ChatGPT plan in detail

Open a plan for its rating, the settings that lower the risk, and short quotations from OpenAI's own policy with links.

ChatGPT FreeRedRated Red. OpenAI uses these chats to train its models. Its staff and contractors can read them. Ads can be chosen from what you write. The plan runs on consumer terms, with no promise of confidentiality. Turning training off lowers the risk but does not change the color, because only consumer terms apply and they make no enforceable promise to keep your content confidential. Chats are then no longer used for training or ads. Staff review, retention, and the consumer terms stay the same.

ChatGPT Free. Anyone using ChatGPT (chatgpt.com or the app) with a personal login and no paid subscription. Price: Free.

Default settings Red

OpenAI uses your chats to train its models. Authorized staff and contractors may read them. ChatGPT shows ads, and it can choose them from your chats and memory. Only consumer terms apply.

With the settings below Red

With "Improve the model for everyone" off, new chats are not used for training. The Ads-Free version has lower usage limits. With it on, no ads are chosen from your chats. Free is then in the same position as Plus with training off.

What the settings do not change: The consumer terms still make no promise of confidentiality. Staff and contractors can still read chats for abuse, security, support, and legal reasons. Thumbs up or down still sends the whole chat for training. Deleted chats stay up to 30 days, and longer under a legal hold. Chats used for training before you turned it off are not pulled back. On the ad-supported version, ads are still picked from at least the current chat.

Settings that lower the risk

  1. Improve the model for everyoneWhat it does: Stops your new chats being used to train OpenAI's models.
  2. Ads-Free experienceWhat it does: Stops ads in your chats, at the cost of lower usage limits and losing image generation and deep research.
  3. "Personalize ads" and "Past chats and memory"What it does: Stops ChatGPT using past chats and memory to pick ads (the current chat is still used if ads stay on).
  4. Marketing privacy control (exact label not confirmed)What it does: Stops OpenAI sharing limited information with marketing partners for ads on other websites.
  5. MemoryWhat it does: Stops ChatGPT storing facts about you across chats and using them for answers and ads.

Worth knowing

  • Pressing thumbs up or down sends the whole conversation to OpenAI, and OpenAI may use it for training even when training is turned off.
  • Documents you paste or upload are handled the same way as the chat itself.
  • A shared chat link lets anyone who has the link read the chat.
  • If you sign up with a firm email address, OpenAI's terms let the organization that owns that domain add the account to its business workspace and control it.

What the policy says

On default training on
“On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default.”

Data controls in ChatGPT, Default data sharing. Read the source

On feedback exception survives opt-out
“the entire conversation associated with that feedback may be used to train OpenAI models.”

Data controls in ChatGPT, Feedback. Read the source

On ads chosen from chats and memory
“ChatGPT may save and use memories and reference recent chats when selecting an ad”

Ads in ChatGPT, Ad personalization. Read the source

Your data, in plain English

How long it is kept
Saved chats are kept until you delete them. There is no automatic deletion and no admin setting.
What happens after you delete
The chat disappears from your account at once. OpenAI then schedules it for permanent deletion from its systems within 30 days. A deleted chat cannot be restored by you or by OpenAI Support.
Copies kept anyway
  • Chats OpenAI had already de-identified and separated from your account are not deleted.
  • OpenAI keeps chats longer when it must for security or legal reasons.
  • Files saved to the Library stay there until they are deleted separately.
  • Deleting a chat does not delete saved memories, which are deleted separately. OpenAI may keep logs of deleted memories up to 30 days.
  • Feedback you already sent (thumbs up or down) may already have been used to train.
  • New York Times lawsuit: a court order of May 13, 2025 made OpenAI keep all chat records it would otherwise delete, including chats that users deleted. That duty ended on September 26, 2025 (order of October 9, 2025). But data already kept stays on legal hold (OpenAI describes it as limited April to September 2025 data, open only to a small legal and security team), except data from users in the EEA, Switzerland, or the UK. OpenAI must also keep going-forward data for accounts tied to 89 domains, mostly news sites, listed in the October 9, 2025 order. A separate order of November 7, 2025 made OpenAI produce a de-identified sample of 20 million consumer chats. The district judge affirmed it on January 5, 2026. OpenAI says the sample covers December 2022 to November 2024. As of October 24, 2026 we found no newer preservation order, but we could not check the full court docket.
Temporary chat
  • OpenAI offers a "Temporary Chat." It does not appear in your history, is not used for training, and does not create new memories.
  • You can choose whether it uses your existing memories and custom instructions.
  • OpenAI may still keep a copy for up to 30 days for safety.
  • A temporary chat that you save becomes a normal chat, kept until you delete it.
  • During the 2025 New York Times order, data that would otherwise have been deleted had to be kept.
  • Temporary Chats show no ads.
Memory
  • Yes. ChatGPT can remember facts about you ("Reference saved memories") and draw on past chats ("Reference chat history").
  • OpenAI's help page does not say whether memory is on by default.
  • Since June 4, 2026, memories "are now updated automatically." Turning memory off does not delete past chats or saved memories; those are deleted separately.
  • While training is on, OpenAI may also use remembered information for training.
  • On Free and Go, memory can be used to pick ads.
Who at the provider can read it
Yes. A limited number of authorized OpenAI staff and outside service providers bound by confidentiality may read content to investigate abuse or security incidents, give support, handle legal matters, and (unless you turned training off) improve the models. Some content may go to outside providers for data labeling and safety work.
Who else receives it
  • Affiliates and vendors (hosting and other services) receive data.
  • OpenAI says it does not sell personal data and does not share your conversations with advertisers.
  • Since spring 2026 the Privacy Policy allows sharing "limited information" (not chats) with marketing partners for ads on other websites; you can opt out in account settings or with Global Privacy Control.
  • OpenAI shares with government authorities when legally required.
  • Apps you connect get data under their own terms.
  • Data is stored in the US and elsewhere.
  • Ads: ads are shown in chats.
  • With ad personalization on, ChatGPT may use your current chat, past chats, and memory to pick ads; with it off, only the current chat.
  • Advertisers get only aggregated, non-identifying information, but since October 5, 2026 advertisers can send their own conversion data to OpenAI through partners such as LiveRamp.
Contract
Consumer Terms of Use plus the Privacy Policy: no confidentiality promise, no data processing agreement, no BAA, binding arbitration, and liability capped at the greater of 12 months' fees or $100.
All sources for this plan (18)

Last checked against OpenAI's pages on October 25, 2026.

Not yet confirmed
  • Default state of ad personalization, Memory, and the voice toggles "Include your audio recordings" / "Include your video recordings": OpenAI's help pages do not state them.
ChatGPT GoRedRated Red. Go works like the Free plan with higher limits. OpenAI trains on these chats by default. Its staff can read them. Go shows ads, and Go has no way to switch them off. The plan runs on consumer terms, with no promise of confidentiality. Turning training off does not change the rating, because the ads remain.

ChatGPT Go. You pay $8 a month for ChatGPT on a personal account and your plan is called "Go." Price: $8/mo (US).

Default settings Red

OpenAI may use your chats to train its models. Authorized staff and contractors may read them. ChatGPT shows ads, and it can choose them from your chats and memory. Only consumer terms apply.

With the settings below Red

With "Improve the model for everyone" off, new chats are not used for training. With ad personalization off, ads are picked only from the current chat. The plan stays Red, because ads are still chosen from what you write and Go has no ad-free option.

What the settings do not change: Ads are still chosen from the current chat. The consumer terms make no promise of confidentiality. Staff and contractors can still read chats for abuse, security, support, and legal reasons. Thumbs up or down still sends the whole chat for training. Deleted chats stay up to 30 days, and longer under a legal hold.

Settings that lower the risk

  1. Improve the model for everyoneWhat it does: Stops your new chats being used to train OpenAI's models.
  2. "Personalize ads" and "Past chats and memory"What it does: Stops ChatGPT using past chats and memory to pick ads.
  3. Marketing privacy control (exact label not confirmed)What it does: Stops OpenAI sharing limited information with marketing partners for ads on other websites.
  4. MemoryWhat it does: Stops ChatGPT storing facts about you across chats and using them for answers and ads.

Worth knowing

  • Pressing thumbs up or down sends the whole conversation to OpenAI, and OpenAI may use it for training even when training is turned off.
  • Paying for Go does not remove ads. Only Free with the Ads-Free version, or Plus and above, are free of ads.
  • Documents you paste or upload are handled the same way as the chat itself.
  • If you sign up with a firm email address, OpenAI's terms let the organization that owns that domain add the account to its business workspace and control it.

What the policy says

On ads on Go
“This plan may include ads”

Plans and Pricing, Go plan. Read the source

On training opt-out on Go
“You can opt out of having your data used for training at any time”

What is ChatGPT Go?, Data use. Read the source

On feedback exception survives opt-out
“the entire conversation associated with that feedback may be used to train OpenAI models.”

Data controls in ChatGPT, Feedback. Read the source

Your data, in plain English

How long it is kept
Saved chats are kept until you delete them. There is no automatic deletion and no admin setting.
What happens after you delete
The chat disappears from your account at once. OpenAI then schedules it for permanent deletion from its systems within 30 days. A deleted chat cannot be restored by you or by OpenAI Support.
Copies kept anyway
  • Chats OpenAI had already de-identified and separated from your account are not deleted.
  • OpenAI keeps chats longer when it must for security or legal reasons.
  • Files saved to the Library stay there until they are deleted separately.
  • Deleting a chat does not delete saved memories, which are deleted separately. OpenAI may keep logs of deleted memories up to 30 days.
  • Feedback you already sent (thumbs up or down) may already have been used to train.
  • New York Times lawsuit: a court order of May 13, 2025 made OpenAI keep all chat records it would otherwise delete, including chats that users deleted. That duty ended on September 26, 2025 (order of October 9, 2025). But data already kept stays on legal hold (OpenAI describes it as limited April to September 2025 data, open only to a small legal and security team), except data from users in the EEA, Switzerland, or the UK. OpenAI must also keep going-forward data for accounts tied to 89 domains, mostly news sites, listed in the October 9, 2025 order. A separate order of November 7, 2025 made OpenAI produce a de-identified sample of 20 million consumer chats. The district judge affirmed it on January 5, 2026. OpenAI says the sample covers December 2022 to November 2024. As of October 24, 2026 we found no newer preservation order, but we could not check the full court docket. Go reached the US on January 16, 2026, after that preservation duty ended, so US Go chats were not caught by it. Go chats from India between August 19 and September 26, 2025 may have been.
Temporary chat
  • OpenAI offers a "Temporary Chat." It does not appear in your history, is not used for training, and does not create new memories.
  • You can choose whether it uses your existing memories and custom instructions.
  • OpenAI may still keep a copy for up to 30 days for safety.
  • A temporary chat that you save becomes a normal chat, kept until you delete it.
  • During the 2025 New York Times order, data that would otherwise have been deleted had to be kept.
  • Temporary Chats show no ads.
Memory
  • Yes. ChatGPT can remember facts about you ("Reference saved memories") and draw on past chats ("Reference chat history").
  • OpenAI's help page does not say whether memory is on by default.
  • Since June 4, 2026, memories "are now updated automatically." Turning memory off does not delete past chats or saved memories; those are deleted separately.
  • While training is on, OpenAI may also use remembered information for training.
  • On Free and Go, memory can be used to pick ads.
Who at the provider can read it
Yes. A limited number of authorized OpenAI staff and outside service providers bound by confidentiality may read content to investigate abuse or security incidents, give support, handle legal matters, and (unless you turned training off) improve the models. Some content may go to outside providers for data labeling and safety work.
Who else receives it
  • Affiliates and vendors (hosting and other services) receive data.
  • OpenAI says it does not sell personal data and does not share your conversations with advertisers.
  • Since spring 2026 the Privacy Policy allows sharing "limited information" (not chats) with marketing partners for ads on other websites; you can opt out in account settings or with Global Privacy Control.
  • OpenAI shares with government authorities when legally required.
  • Apps you connect get data under their own terms.
  • Data is stored in the US and elsewhere.
  • Ads: ads are shown in chats.
  • With ad personalization on, ChatGPT may use your current chat, past chats, and memory to pick ads; with it off, only the current chat.
  • Advertisers get only aggregated, non-identifying information, but since October 5, 2026 advertisers can send their own conversion data to OpenAI through partners such as LiveRamp.
Contract
Consumer Terms of Use plus the Privacy Policy: no confidentiality promise, no data processing agreement, no BAA, binding arbitration, and liability capped at the greater of 12 months' fees or $100.
All sources for this plan (14)

Last checked against OpenAI's pages on October 25, 2026.

Not yet confirmed
  • Go is not named in OpenAI's sentence that training is on by default for Free, Plus, and Pro; the Go page says OpenAI "may use conversations" and offers an opt-out, so we treat the default as on.
  • Default state of ad personalization and Memory.
ChatGPT Plus and ProRedRated Red. OpenAI uses these chats to train its models. Its staff can read them. The plan runs on consumer terms, with no promise of confidentiality. Turning training off lowers the risk but does not change the color, because only consumer terms apply and they make no enforceable promise to keep your content confidential. New chats are then no longer used for training. Staff review, retention, and the consumer terms stay the same. A higher price does not change the terms.

ChatGPT Plus and Pro. You pay for ChatGPT yourself on a personal account (Plus, or a Pro 100/200/500 plan). Even at $500 a month this is a consumer plan. Price: Plus $20/mo; Pro comes in three tiers: Pro 100, Pro 200, and Pro 500 ($100, $200, or $500/mo).

Default settings Red

OpenAI uses your chats to train its models. Authorized staff and contractors may read them. There are no ads. Only consumer terms apply.

With the settings below Red

With "Improve the model for everyone" off, your new chats are not used for training. Temporary Chats also stay out of your history and memory.

What the settings do not change: The consumer terms still make no promise of confidentiality, and there is no data processing agreement. Staff and contractors can still read chats for abuse, security, support, and legal reasons. Thumbs up or down still sends the whole chat for training. Deleted and temporary chats are kept up to 30 days. A legal hold can keep them longer, as the 2025 New York Times order did. Chats used for training before you turned it off are not pulled back.

Settings that lower the risk

  1. Improve the model for everyoneWhat it does: Stops your new chats being used to train OpenAI's models. Alternative: "Do not train on my content" at privacy.openai.com.
  2. MemoryWhat it does: Stops ChatGPT storing facts about you across chats.
  3. Marketing privacy control (exact label not confirmed)What it does: Stops OpenAI sharing limited information with marketing partners for ads on other websites (applies to paid plans too).

Worth knowing

  • Pressing thumbs up or down sends the whole conversation to OpenAI, and OpenAI may use it for training even when training is turned off.
  • Pro runs under the same consumer Terms of Use as Free.
  • Files saved to the Library stay there after you delete the chat they came from.
  • If you sign up with a firm email address, OpenAI's terms let the organization that owns that domain add the account to its business workspace and control it. Moving a personal Pro workspace into a Business workspace copies the data and leaves the personal copy in place.

What the policy says

On Pro is a consumer plan
“Pro use is subject to our Terms of Use.”

About ChatGPT Pro tiers, Terms. Read the source

On default training on
“On personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default.”

Data controls in ChatGPT, Default data sharing. Read the source

On what the opt-out does
“When Improve the model for everyone is off, your new conversations won't be used...”

Data controls in ChatGPT, When the setting is off. Read the source

Your data, in plain English

How long it is kept
Saved chats are kept until you delete them. There is no automatic deletion and no admin setting.
What happens after you delete
The chat disappears from your account at once. OpenAI then schedules it for permanent deletion from its systems within 30 days. A deleted chat cannot be restored by you or by OpenAI Support.
Copies kept anyway
  • Chats OpenAI had already de-identified and separated from your account are not deleted.
  • OpenAI keeps chats longer when it must for security or legal reasons.
  • Files saved to the Library stay there until they are deleted separately.
  • Deleting a chat does not delete saved memories, which are deleted separately. OpenAI may keep logs of deleted memories up to 30 days.
  • Feedback you already sent (thumbs up or down) may already have been used to train.
  • New York Times lawsuit: a court order of May 13, 2025 made OpenAI keep all chat records it would otherwise delete, including chats that users deleted. That duty ended on September 26, 2025 (order of October 9, 2025). But data already kept stays on legal hold (OpenAI describes it as limited April to September 2025 data, open only to a small legal and security team), except data from users in the EEA, Switzerland, or the UK. OpenAI must also keep going-forward data for accounts tied to 89 domains, mostly news sites, listed in the October 9, 2025 order. A separate order of November 7, 2025 made OpenAI produce a de-identified sample of 20 million consumer chats. The district judge affirmed it on January 5, 2026. OpenAI says the sample covers December 2022 to November 2024. As of October 24, 2026 we found no newer preservation order, but we could not check the full court docket.
Temporary chat
  • OpenAI offers a "Temporary Chat." It does not appear in your history, is not used for training, and does not create new memories.
  • You can choose whether it uses your existing memories and custom instructions.
  • OpenAI may still keep a copy for up to 30 days for safety.
  • A temporary chat that you save becomes a normal chat, kept until you delete it.
  • During the 2025 New York Times order, data that would otherwise have been deleted had to be kept.
Memory
  • Yes. ChatGPT can remember facts about you ("Reference saved memories") and draw on past chats ("Reference chat history").
  • OpenAI's help page does not say whether memory is on by default.
  • Since June 4, 2026, memories "are now updated automatically." Turning memory off does not delete past chats or saved memories; those are deleted separately.
  • While training is on, OpenAI may also use remembered information for training.
  • Plus and Pro show no ads.
Who at the provider can read it
Yes. A limited number of authorized OpenAI staff and outside service providers bound by confidentiality may read content to investigate abuse or security incidents, give support, handle legal matters, and (unless you turned training off) improve the models. Some content may go to outside providers for data labeling and safety work.
Who else receives it
  • Affiliates and vendors (hosting and other services) receive data.
  • OpenAI says it does not sell personal data and does not share your conversations with advertisers.
  • Since spring 2026 the Privacy Policy allows sharing "limited information" (not chats) with marketing partners for ads on other websites; you can opt out in account settings or with Global Privacy Control.
  • OpenAI shares with government authorities when legally required.
  • Apps you connect get data under their own terms.
  • Data is stored in the US and elsewhere.
  • No ads appear on Plus or Pro.
Contract
Consumer Terms of Use plus the Privacy Policy: no confidentiality promise, no data processing agreement, no BAA, binding arbitration, and liability capped at the greater of 12 months' fees or $100.
All sources for this plan (18)

Last checked against OpenAI's pages on October 25, 2026.

Not yet confirmed
  • Default state of Memory and of the voice audio/video recording toggles.
  • NYT docket after January 5, 2026.
ChatGPT BusinessGreenRated Green. OpenAI's business terms forbid it to train on the workspace's data. A data processing agreement makes OpenAI the organization's processor. The business terms also include a confidentiality promise. One caveat concerns retention. OpenAI's own pages disagree on whether Business admins can set an automatic retention period. If they cannot, chats stay until someone deletes them.

ChatGPT Business (formerly ChatGPT Team). Your firm bought a ChatGPT workspace for 2 to 200 users and you log in through the firm's workspace (it used to be called Team). Price: Standard seat $25/user/mo monthly or $20/user/mo annually; Premium seat $125 or $100; at least 2 seats.

Default settings Green

The contract forbids OpenAI to train on your firm's chats. OpenAI acts as the firm's processor under a data processing agreement. OpenAI treats your content as confidential. There are caveats. Outside contractors may review content for abuse. The plan also lacks Enterprise audit tools, data residency, and a business associate agreement (BAA).

Settings that lower the risk

  1. Workspace data retentionWhat it does: OpenAI's privacy page says Business admins control retention, but its pricing page and admin training material list custom retention as Enterprise-only. OpenAI has not resolved the conflict publicly.
  2. Memory settings and role permissionsWhat it does: Admins can manage supported memory settings for members.
  3. Any opt-in to share data with OpenAIWhat it does: OpenAI trains on business data only if the customer explicitly opts in.
  4. Allow response feedbackWhat it does: Controls whether members can send thumbs up or down feedback to OpenAI.

Worth knowing

  • Thumbs up or down feedback still sends the conversation to OpenAI, although OpenAI says it does not use business feedback for training. Admins can switch feedback off.
  • The business protections attach to a workspace bought by the organization, not to a personal account that has been upgraded.
  • Workspace admins can view, export, and delete members' chats.

What the policy says

On no training by contract
“OpenAI will not use Customer Content to develop or improve the Services...”

OpenAI Services Agreement, Section 4.2, Effective January 1, 2026. Read the source

On processor role
“OpenAI acts as a Data Processor on the Customer's behalf”

OpenAI Data Processing Addendum, Section 1.1, Effective January 1, 2026. Read the source

On contractor abuse review
“specialized third-party contractors who are bound by confidentiality and security obligations”

Enterprise privacy at OpenAI, Who can view conversations and chat history in ChatGPT Business?, Updated January 8, 2026. Read the source

Your data, in plain English

How long it is kept
Chats stay until a member or admin deletes them. Whether Business admins can set an automatic retention period is unclear: OpenAI's privacy page says admins control retention, but its pricing page lists custom retention as an Enterprise feature.
What happens after you delete
OpenAI says deleted or unsaved conversations are removed from its systems within 30 days. When the firm ends its contract, OpenAI must delete all customer content within 30 days.
Copies kept anyway
OpenAI may keep data longer when the law requires it or to protect its services or others. The 2025 New York Times preservation order covered Team (now Business) chats from mid-May to September 26, 2025; some of that data remains on legal hold. Business was not part of the 20-million-chat sample.
Temporary chat
Not stated for Business. OpenAI's Temporary Chat help page does not separate plans; where Temporary Chat is available, OpenAI says it may keep a copy for up to 30 days for safety.
Memory
Available. Admins can manage supported memory settings and role permissions. The default for Business is not stated by the provider.
Who at the provider can read it
Workspace admins can view, export, and delete members' chats. Authorized OpenAI staff may access chats for engineering support, abuse investigations, and legal compliance. Outside contractors bound by confidentiality may review content for abuse. This is broader access than Enterprise.
Who else receives it
No ads. OpenAI uses sub-processors under the data processing agreement and must notify the firm of changes (the firm can object). OpenAI will tell the firm about a law-enforcement demand for its data where legally allowed. Apps members connect follow members' own permissions. Data is stored in the US; data residency is not offered on Business.
Contract
OpenAI Services Agreement ("Business Terms") plus the Data Processing Addendum (OpenAI as processor) and OpenAI's Enterprise Privacy commitments; no BAA.
All sources for this plan (15)

Last checked against OpenAI's pages on October 25, 2026.

Not yet confirmed
  • Whether Temporary Chat and "Delete all chats" are available in Business, and the Business memory default.
ChatGPT EnterpriseGreenRated Green. OpenAI's enterprise terms forbid it to train on the organization's data. A data processing agreement makes OpenAI the organization's processor. Admins can set a custom retention period. Admins also control who has access. This is the most protective ChatGPT plan.

Is this your plan? Your firm signed a contract with OpenAI's sales team and you log in through the firm's workspace, usually with single sign-on. Price: Custom (contact OpenAI sales); not published.

Default settings Green

The contract forbids OpenAI to train on your organization's chats. OpenAI acts as the organization's processor under a data processing agreement. Admins control retention. OpenAI staff may read chats only to resolve incidents, to recover chats with your permission, or where the law requires.

Settings that lower the risk

  1. Custom data retentionWhat it does: Decides how long chats are kept; otherwise they stay until deleted.
  2. Compliance Platform / Compliance API exportWhat it does: Feeds chat logs to eDiscovery tools; the compliance logs themselves are kept only 30 days, so export continuously.
  3. Share chats and scheduled tasks in the workspaceWhat it does: Stops members creating shareable chat links.
  4. Use shared memory / Use improved memoryWhat it does: Controls whether ChatGPT remembers information across chats.
  5. Allow response feedbackWhat it does: Controls whether members can send thumbs up or down feedback to OpenAI.

Worth knowing

  • A business associate agreement for health information is offered only for "ChatGPT for Healthcare" or Enterprise with a "Regulated Workspace," and some features fall outside it.
  • Thumbs up or down feedback still sends the conversation to OpenAI, although OpenAI says it does not use business feedback for training. Admins can switch feedback off.

What the policy says

On staff access limited
“Authorized OpenAI employees will only ever access your conversations for the purposes of resolving incidents”

Enterprise privacy at OpenAI, Who can view conversations (Enterprise), Updated January 8, 2026. Read the source

On admins control retention
“Your workspace admins control how long your data is retained.”

Enterprise privacy at OpenAI, What is OpenAI's policy on data retention for ChatGPT Enterprise, ChatGPT Edu, and ChatGPT for Healthcare?, Updated January 8, 2026. Read the source

On excluded from NYT order
“This does not impact ChatGPT Enterprise or ChatGPT Edu customers.”

How we're responding to The New York Times' data demands, FAQ, June 5, 2025; updated October 22, 2025. Read the source

Your data, in plain English

How long it is kept
Chats stay until deleted, or until the admin's custom retention period (minimum 90 days, per OpenAI's admin training material) removes them. Some temporary files in Enterprise can expire after 48 hours.
What happens after you delete
OpenAI says deleted conversations are removed from its systems within 30 days. On termination, OpenAI must delete all customer content within 30 days.
Copies kept anyway
OpenAI keeps data longer only when legally required. Enterprise and Edu were excluded from the 2025 New York Times preservation order and from the 20-million-chat sample.
Temporary chat
Not stated by the provider for Enterprise. Where Temporary Chat is available, OpenAI says it may keep a copy for up to 30 days for safety.
Memory
Admin-controlled ("Use shared memory," "Use improved memory"). Improved memory is off by default in Healthcare and Regulated Workspace; the default in standard Enterprise is not stated.
Who at the provider can read it
Authorized OpenAI staff may access chats only to resolve incidents, recover chats with your permission, or where the law requires. Admins see audit logs through the Compliance API.
Who else receives it
No ads. Sub-processors under the data processing agreement. OpenAI will tell the customer about a law-enforcement demand where legally allowed. Data stored in the US by default; data residency is offered in ten regions (storage at rest). Customer-managed encryption keys are available.
Contract
OpenAI Services Agreement plus the Data Processing Addendum (OpenAI as processor); Edu uses a Student Data Privacy Agreement; a BAA only for ChatGPT for Healthcare or Regulated Workspace.
All sources for this plan (15)

Last checked against OpenAI's pages on October 25, 2026.

Not yet confirmed
  • Default for improved memory in standard Enterprise; Temporary Chat availability and retention in Enterprise.
ChatGPT EduYellowRated Yellow. ChatGPT Edu runs on the same Services Agreement as Enterprise, which forbids OpenAI to use your content to develop or improve its services. Edu adds a Student Data Privacy Agreement. It defines Student Data to include anything a user types into the service. It lets OpenAI use de-identified Student Data for purposes privacy law allows (§4.4), and it exempts that data from deletion (§4.5). In a law school clinic, client facts that students type fall within that definition.

Is this your plan? Your university or law school bought ChatGPT Edu and you log in through its workspace. Law school clinics often use it. Price: Custom (contact OpenAI sales); not published.

Default settings Yellow

The Services Agreement forbids OpenAI to use your content to develop or improve the service, and OpenAI acts as the school's processor. The Student Data Privacy Agreement lets OpenAI use de-identified Student Data for purposes privacy law allows and keep it after the contract ends. Admins control retention.

Everything else about Edu, including settings, retention, and access, follows the ChatGPT Enterprise entry above.

In OpenAI's words

On de-identified use (binding)
“De-Identified Data may be used by OpenAI for those purposes allowed under Privacy Laws.”

OpenAI Student Data Privacy Agreement, §4.4, undated (PDF created Nov. 19, 2025). Read the source

On what counts as Student Data (binding)
“any other information provided by a user through the Services’ open input fields”

OpenAI Student Data Privacy Agreement, Definitions, “Student Data.” Read the source

On de-identified data kept (binding)
“The duty to dispose of Student Data shall not extend to Student Data that had been De-Identified Data”

OpenAI Student Data Privacy Agreement, §4.5. Read the source

Our criteria

How we rate

Each color answers one question: may a D.C. lawyer put client confidences and secrets into this plan? Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. The full method, with the ethics rules behind each test, is on the tracker page.

Green

Fit for client confidences and secrets, after your usual vendor checks. All five are true:

  1. (1)A contract forbids the provider to train AI models on your content or use it for its own purposes.
  2. (2)A contract makes your content confidential and requires notice of a subpoena or government demand.
  3. (3)Staff and subcontractors see it only to run, support, or secure the service. Any outside AI model company is bound by the same terms.
  4. (4)Your organization can delete it or set how long it is kept.
  5. (5)The contract requires notice of a security breach, and an independent audit (SOC 2 Type II or ISO 27001) covers the service.
Yellow

Use for client confidences only after you deal with the gap. A business contract forbids training and limits use, but at least one Green condition is missing. Common gaps:

  1. (1)Your organization cannot delete content or set retention.
  2. (2)An outside AI model company works under its own terms.
  3. (3)The contract lets the provider use your content, even de-identified, for its own purposes.
  4. (4)The contract does not treat your content as confidential.
  5. (5)The contract bars personal data, which client files contain.
Red

Keep client confidences and secrets out. At least one of these is true:

  1. (1)The provider trains AI models on your content, or its terms let it.
  2. (2)Your content is used to choose ads.
  3. (3)Only consumer terms apply, so no contract keeps your content confidential.

Turning training off does not change the color. The only exception is the client's informed consent (D.C. Rule 1.6(e)(1)), and D.C. Bar Opinion 388 says clients typically should not be asked to consent to disclosures this broad.

Last checked against the provider's own pages on October 25, 2026. Quotations are kept short and link to the full page. Where the provider does not say something, we say so rather than guess. Ratings describe each provider's published standard terms; large customers often sign negotiated agreements that may differ. General information prepared by the BADC Young Lawyers Section AI Committee, not legal advice. Spotted an error or a change? Write to YLS@badc.org with the subject "Tracker correction."

Questions about the AI Committee, or want to get involved? Write to us directly.

YLS@badc.org