Home / Young Lawyers Section / AI Committee / AI Privacy Tracker / CoCounsel and Westlaw AI

AI Privacy Tracker · Version 110426

CoCounsel and Westlaw AI

Plain-English resources for lawyers, judges, and government attorneys who use AI, or want to.

CoCounsel and Westlaw AI · Thomson Reuters

CoCounsel and Westlaw AI at a glance

Rated Yellow

Usable for client confidences only after you deal with the gap named in the entry.

When you delete a chat

Thomson Reuters's CoCounsel help pages say a deleted chat is permanently deleted and cannot be undone. It does not say how fast deleted data leaves its servers and backups.

PlanRatingTrains on your data?How long keptCan the provider read it?
CoCounsel and Westlaw AIWestlaw Edge with AI-Assisted Research from $155.35/mo (one circuit, 3-year term); Westlaw Advantage from $256.75/mo (one circuit); online prices for new customers at firms of up to 10 attorneys; CoCounsel by quoteYellowNo (contract)Organization sets it (Essentials); otherwise not publishedSampled for evaluation; reviewed for reported issues

Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. Select a plan for its full entry.

Official pages

Deleting a chat

What deleting does on CoCounsel and Westlaw AI

CoCounsel chats and matters: what happens after a chat is deleted
Thomson Reuters's CoCounsel help pages say a deleted chat is permanently deleted and cannot be undone. Deleting a matter deletes all its chats and files. These pages describe the classic version of CoCounsel. Thomson Reuters does not say how fast deleted data leaves its servers and backups. Its Westlaw help pages do not describe deleting AI research history. Provider page
Copies kept anyway
  • Thomson Reuters does not say how long it keeps prompts and outputs sampled for evaluation.
  • Under the DPA, Thomson Reuters may keep personal data that the law or its own retention policies require it to keep.
  • After termination, backups are deleted in the normal course of business. No period is given.

In short: deleting removes a chat from view, but it does not undo what has already happened to it. On business plans, the organization's retention settings decide how long chats are kept; each plan below explains how.

Plan by plan

Every CoCounsel and Westlaw AI plan in detail

Open a plan for its rating, the settings that lower the risk, and short quotations from Thomson Reuters's own policy with links.

CoCounsel and Westlaw AIYellowRated Yellow. Thomson Reuters's General Terms forbid it to train generative AI models on your data or on outputs. The same promise covers its model providers. A Data Processing Addendum makes Thomson Reuters your processor for personal data. Two gaps remain. First, the contract lets Thomson Reuters sample prompts and outputs for "evaluative purposes." Automated filters are meant to keep confidential material out of those samples. The contract also lets Thomson Reuters review customer data to investigate reported issues. Second, organization control of retention is published only for CoCounsel Essentials. Thomson Reuters publishes nothing on retention for Westlaw AI or the new CoCounsel Legal.

CoCounsel Legal, CoCounsel Core and Essentials, and Westlaw AI features (AI-Assisted Research, Westlaw Advantage Deep Research). Your firm, company, or government office subscribes to Westlaw or CoCounsel from Thomson Reuters. You use CoCounsel or the AI features inside Westlaw under that subscription. Price: Westlaw Edge with AI-Assisted Research from $155.35/mo (one circuit, 3-year term); Westlaw Advantage from $256.75/mo (one circuit); online prices for new customers at firms of up to 10 attorneys; CoCounsel by quote.

Default settings Yellow

The contract forbids Thomson Reuters to train generative AI models on your data or on outputs. It also forbids Thomson Reuters to let its model providers do so. Thomson Reuters may sample prompts and outputs for "evaluative purposes." Automated filters are meant to keep confidential and identifying information out of those samples. Thomson Reuters may also review customer data to investigate reported issues or defects. For CoCounsel Essentials, Thomson Reuters says the organization sets how long data is kept.

Settings that lower the risk

  1. Organization-level retention (CoCounsel Essentials)What it does: For CoCounsel Essentials, Thomson Reuters says the organization sets how long prompts and content are kept, with a Thomson Reuters client manager. This is in an FAQ, not the contract.
  2. CoCounsel for Outlook (Microsoft Graph permissions)What it does: The Outlook add-in asks for Microsoft Graph permissions. They include read and write access to the user's mail (Mail.ReadWrite).
  3. Syncly DMS serviceWhat it does: It syncs documents between CoCounsel Core and the firm's document management system. The terms let Thomson Reuters host it in a single-tenant or multi-tenant environment at its discretion.
  4. CoCounsel Legal MCP connectorWhat it does: It connects CoCounsel Legal to Claude. Thomson Reuters offers it as a pilot. Work typed in Claude passes through Claude before it reaches CoCounsel.

Worth knowing

  • Not every Thomson Reuters AI product has the same rule. For Document Intelligence, a separate product, the terms let Thomson Reuters use customer data to train and adapt its products.
  • The new CoCounsel Legal, released August 20, 2026, is built on Anthropic's Claude Agent SDK. Thomson Reuters's statements about OpenAI, Google, zero retention, and abuse monitoring appear in its CoCounsel Essentials FAQ.
  • Thomson Reuters's terms forbid uploading Westlaw or Practical Law content to other legal AI tools. Limited extracts may go into an enterprise-licensed office AI tool to prepare work product. Consumer AI tools do not qualify.
  • CoCounsel connects to Microsoft Outlook, Word, Teams, document management systems, and Claude. Thomson Reuters's terms say a third-party integration is governed by the firm's own agreement with that provider.
  • U.S. federal government customers sign separate general terms. Those terms have no clause like the General Terms promise not to train on customer data.

What the policy says

On no training, including model providers (binding)
“will not, and will not permit its third-party providers to, develop, train, or fine-tune”

Thomson Reuters General Terms and Conditions, US Version 6.0, Section 3.6 No Model Training, Last modified September 1, 2026. Read the source

On processor role (binding)
“Customer acts as the data controller and Thomson Reuters as the data processor”

Thomson Reuters General Terms and Conditions, US Version 6.0, Section 10.1, Last modified September 1, 2026. Read the source

On evaluative sampling of prompts and outputs (binding)
“Customer grants Thomson Reuters a license to use Prompts and Outputs for evaluative purposes”

Thomson Reuters General Terms and Conditions, US Version 6.0, Section 3.5, Last modified September 1, 2026. Read the source

On review of customer data to investigate issues (binding)
“Thomson Reuters may review Customer Data to investigate reported issues, Service anomalies, or potential defects”

Thomson Reuters General Terms and Conditions, US Version 6.0, Section 11.3, Last modified September 1, 2026. Read the source

On organization-level retention for CoCounsel Essentials; zero-retention model calls; abuse monitoring; model providers; hosting (FAQ)
“Retention of user content and prompts is customized to fit customer needs and set up at the organization account level”

CoCounsel Essentials, Frequently asked questions, Accessed October 25, 2026. Read the source

On no sale or sharing of personal data; no cross-context behavioral advertising (binding)
“provide cross-context behavioral advertising”

Thomson Reuters Data Processing Addendum, Version 4.1, Section 3.1, Effective October 23, 2026. Read the source

On deleted chats are permanent
“The chat will be permanently deleted. This can't be undone.”

Delete chats (CoCounsel help), Warning, No date shown. Read the source

On new CoCounsel Legal built on Anthropic's Claude Agent SDK
“Built on Anthropic's Claude Agent SDK”

Thomson Reuters Launches Next Generation of CoCounsel Legal, the AI Ecosystem Built for Legal Professionals, Press release, August 20, 2026. Read the source

Your data, in plain English

How long it is kept
  • For CoCounsel Essentials, Thomson Reuters says the organization sets how long user content and prompts are kept.
  • It says users can also delete their own content and prompts at any time.
  • This is in an FAQ, not the contract.
  • Thomson Reuters publishes no retention period for the new CoCounsel Legal or for Westlaw AI research history.
  • For CoCounsel Essentials, Thomson Reuters says calls to model providers are zero-retention.
  • After the contract ends, Thomson Reuters will delete production data within 90 days if the customer asks in writing at termination.
  • Backups are deleted in the normal course of business.
  • Under the DPA, the customer can ask Thomson Reuters to delete personal data at any time.
What happens after you delete
Thomson Reuters's CoCounsel help pages say a deleted chat is permanently deleted and cannot be undone. Deleting a matter deletes all its chats and files. These pages describe the classic version of CoCounsel. Thomson Reuters does not say how fast deleted data leaves its servers and backups. Its Westlaw help pages do not describe deleting AI research history.
Copies kept anyway
  • Thomson Reuters does not say how long it keeps prompts and outputs sampled for evaluation.
  • Under the DPA, Thomson Reuters may keep personal data that the law or its own retention policies require it to keep.
  • After termination, backups are deleted in the normal course of business. No period is given.
Temporary chat
Not stated by the provider.
Memory
Not stated by the provider.
Who at the provider can read it
  • The contract lets Thomson Reuters use prompts and outputs for "evaluative purposes." Thomson Reuters must use automated safeguards designed to keep confidential and identifying information out of those samples.
  • The contract also lets Thomson Reuters review customer data to investigate reported issues, service anomalies, or defects.
  • For CoCounsel Essentials, Thomson Reuters says that, where applicable, it has turned off its model providers' abuse monitoring.
  • It says this ensures no human access to your data at those providers.
  • This is in an FAQ, not the contract.
Who else receives it
  • For CoCounsel Essentials, Thomson Reuters names OpenAI and Google as its model providers.
  • It says requests reach them under the name Thomson Reuters, not yours.
  • The new CoCounsel Legal is built on Anthropic's Claude Agent SDK.
  • Thomson Reuters also runs some CoCounsel Legal features on its own model, called Thomson.
  • Its third-party terms list use rules for AWS, Anthropic, Google, Microsoft, and OpenAI.
  • Where Thomson Reuters acts as a service provider under U.S. privacy law, the DPA forbids it to sell your personal data.
  • The DPA also forbids it to share your personal data for targeted advertising.
  • It also forbids Thomson Reuters to provide cross-context behavioral advertising.
  • This DPA version applies to contracts signed or renewed from October 23, 2026.
  • For a subpoena or court order, Thomson Reuters must give prior notice and reasonable help to contest it, where the law allows.
  • For CoCounsel Essentials, Thomson Reuters says data is hosted in the U.S. It says regional hosting is available in the UK, Australia, and Canada.
Contract
  • Thomson Reuters General Terms and Conditions, US Version 6.0, last modified September 1, 2026.
  • The Product Specific Terms for Legal Products and Services with AI Functionality, January 23, 2026.
  • The Data Processing Addendum, which makes Thomson Reuters your processor for personal data.
  • Version 4.1 of the DPA took effect October 23, 2026.
  • Older contracts may be on Version 3.
  • The no-training promise is binding and covers model providers.
  • The retention, zero-retention, and abuse-monitoring statements are in a CoCounsel Essentials FAQ, not the contract.
  • U.S. federal government customers sign separate general terms.
All sources for this plan (26)

Last checked against Thomson Reuters's pages on October 25, 2026.

Not yet confirmed
  • Default retention periods for the new CoCounsel Legal and for Westlaw AI-Assisted Research and Deep Research history.
  • Whether users can delete Westlaw AI research history, and whether CoCounsel can delete all chats at once.
  • Whether the model providers behind the new CoCounsel Legal, including Anthropic, keep no data (zero retention).
  • Where data from the new CoCounsel Legal and Westlaw AI is hosted.
  • Which terms govern law school and other academic Westlaw accounts.

Our criteria

How we rate

Each color answers one question: may a D.C. lawyer put client confidences and secrets into this plan? Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. The full method, with the ethics rules behind each test, is on the tracker page.

Green

Fit for client confidences and secrets, after your usual vendor checks. All five are true:

  1. (1)A contract forbids the provider to train AI models on your content or use it for its own purposes.
  2. (2)A contract makes your content confidential and requires notice of a subpoena or government demand.
  3. (3)Staff and subcontractors see it only to run, support, or secure the service. Any outside AI model company is bound by the same terms.
  4. (4)Your organization can delete it or set how long it is kept.
  5. (5)The contract requires notice of a security breach, and an independent audit (SOC 2 Type II or ISO 27001) covers the service.
Yellow

Use for client confidences only after you deal with the gap. A business contract forbids training and limits use, but at least one Green condition is missing. Common gaps:

  1. (1)Your organization cannot delete content or set retention.
  2. (2)An outside AI model company works under its own terms.
  3. (3)The contract lets the provider use your content, even de-identified, for its own purposes.
  4. (4)The contract does not treat your content as confidential.
  5. (5)The contract bars personal data, which client files contain.
Red

Keep client confidences and secrets out. At least one of these is true:

  1. (1)The provider trains AI models on your content, or its terms let it.
  2. (2)Your content is used to choose ads.
  3. (3)Only consumer terms apply, so no contract keeps your content confidential.

Turning training off does not change the color. The only exception is the client's informed consent (D.C. Rule 1.6(e)(1)), and D.C. Bar Opinion 388 says clients typically should not be asked to consent to disclosures this broad.

Last checked against the provider's own pages on October 25, 2026. Quotations are kept short and link to the full page. Where the provider does not say something, we say so rather than guess. Ratings describe each provider's published standard terms; large customers often sign negotiated agreements that may differ. General information prepared by the BADC Young Lawyers Section AI Committee, not legal advice. Spotted an error or a change? Write to YLS@badc.org with the subject "Tracker correction."

Questions about the AI Committee, or want to get involved? Write to us directly.

YLS@badc.org