Does ChatGPT Have Legal Privilege? What Lawyers Must Understand

No. ChatGPT does not have legal privilege, and a prompt typed into ChatGPT fails three separate elements of the attorney-client privilege at once: ChatGPT is not an attorney, OpenAI’s retention and training terms defeat any reasonable expectation of confidentiality, and the service disclaims giving legal advice. Two federal courts ruled on AI materials in February 2026 and reached opposite results, because the variable was never which chatbot was used but whether counsel directed the work. Enterprise plans and zero data retention agreements narrow the exposure without creating privilege, and the only route a court has gestured at, in dictum no court has yet applied, is counsel-directed use on a platform whose terms keep the exchange confidential.

The practical consequence for a legal team is that privilege has to be protected before a prompt is typed rather than argued about afterward. That is why the control that matters for law firms adopting AI is classifying matters first and routing privileged work to platforms whose terms carry confidentiality, rather than relying on a plan upgrade to repair the problem later or pasting material that was already privileged into a window that waives it.

[cta-1]

Key Takeaways

1. A ChatGPT conversation is not protected by the attorney-client privilege, and no consumer or enterprise plan changes that answer.
2. A prompt fails three elements at once: the recipient is not an attorney, the terms defeat confidentiality, and the purpose is not obtaining legal advice from a lawyer.
3. Two federal district courts ruled on AI materials in February 2026 and split, and what separated them was counsel direction and procedural posture rather than the chatbot.
4. An enterprise plan repairs the confidentiality facts only. Contractual data protection binds the vendor; privilege binds the court.
5. Counsel-directed use is the one route a court has left open, in dictum, and no court has yet applied it.
6. A litigation hold reaches privileged AI accounts the same way it reaches privileged email, firm-issued or personal, and the hold does not restore any privilege the account already lacks.

Which Elements of Attorney-Client Privilege a ChatGPT Prompt Fails

The first three elements are the ones a ChatGPT prompt fails on its own, and each is below. The fourth, waiver, is a different question, because it asks what happens to material that was already privileged before it entered the platform. The broader doctrinal question of how privilege applies to AI tools generally sits one level up from ChatGPT specifically.

Why a Chatbot Is Not an Attorney or an Agent of One

The privilege protects communications with a lawyer, or with someone acting as the lawyer’s agent, and a consumer chatbot is neither. The Heppner court treated the absence of a lawyer on the other side of the exchange as dispositive on its own, before it reached the data terms. The agency half of the element is the one worth holding on to, because it is the only part of the test with a route through it.

The Agency Test

An agent relationship requires a lawyer to direct the work, and a lawyer who never touched the exchange has no agent in it. Baker Hostetler reads the decision the same way, as a ruling that AI-generated documents are not privileged when no lawyer stands behind them.

Why the Terms of Service Decide the Confidentiality Element

Confidentiality is measured by what the sender could reasonably expect, which makes the platform’s published terms a legal fact rather than a procurement detail.

The Hamilton Analogy

Courts reached the same result long before generative AI: in United States v. Hamilton, 701 F.3d 404 (4th Cir. 2012), emails sent through an employer’s monitored system were not privileged because the sender knew the system permitted inspection. A platform that reserves the right to retain inputs, train on them and disclose them under legal compulsion is a platform where the expectation was never reasonable.

Why “Purpose of Legal Advice” Is the Element Lawyers Miss

The purpose element asks what the user was trying to get from the recipient, not what later happened to the output, and the attorney-client privilege is a conjunctive test, so a failure here ends the analysis. A defendant who asks a chatbot to analyze an indictment is not seeking legal advice from a lawyer, and the chatbot disclaims giving any. This element is also what defeats the common assumption that forwarding the AI output to counsel cures the problem. It does not, and the Heppner court said so directly.

Why ChatGPT’s Data Retention Terms Defeat Confidentiality

ChatGPT’s data retention terms are what defeat the confidentiality element of attorney-client privilege. OpenAI’s privacy policy permits the collection of inputs and outputs, their use in model training, and their disclosure to vendors and government authorities where required by law. Data retention is therefore the first term to read in any attorney-client privilege analysis of ChatGPT, because attorney-client privilege depends on a reasonable expectation of confidentiality and ChatGPT’s data retention terms are the published answer to whether that expectation was reasonable.

What OpenAI’s Terms Currently Permit

OpenAI’s privacy policy currently permits five things that matter to a privilege analysis, and each of them is a published term rather than an inference about how the product works.

1. Collection of prompts, uploaded files and model outputs, held as account content.
2. Use of consumer-plan content to train and improve the models, unless the user turns it off.
3. Disclosure to vendors, service providers and government authorities where law or legal process requires it.
4. Retention after deletion: a deleted chat is scheduled for permanent removal within 30 days unless OpenAI is required to retain it for legal or security reasons.
5. Content is tied to the account that created it, so a personal account used for firm work holds firm material outside firm control.

Turning off chat history narrows the window without closing it. A temporary chat “may be retained for up to 30 days for safety purposes” under OpenAI’s own help documentation, which is a shorter exposure than a saved conversation and still an exposure, and the account that created the chat remains the one OpenAI can be compelled to search regardless of which retention window applied when the chat was created. OpenAI’s chief executive, Sam Altman, put the doctrinal position more plainly than any vendor page does, telling the podcast This Past Weekend with Theo Von that “right now, if you talk to a therapist or a lawyer or a doctor about those problems, there’s legal privilege for it... And we haven’t figured that out yet for when you talk to ChatGPT.”

Why Another Party’s Litigation Can Reach Your Chat Logs

Retention is not only a policy question, because a retained log is evidence another party can reach.

The OpenAI Copyright Litigation Order

On January 5, 2026, U.S. District Judge Sidney Stein affirmed orders compelling OpenAI to produce a sample of 20 million de-identified ChatGPT conversation logs to the news plaintiffs in the consolidated copyright litigation. That order concerned one company’s logs in one case, and the general point survives the specifics: a retained conversation is reachable by a party who never typed into the account, because the provider holds it. The mechanics of how a specific account’s logs become discoverable in a matter, including subpoenas, authentication and litigation holds, run deeper than privilege doctrine does. For the privilege question, the doctrinal point is narrower and harder: a platform that reserves the right to retain and disclose is a platform where the confidentiality element was never satisfied in the first place.

What Two Federal Courts Ruled on AI and Privilege in February 2026

Two federal courts ruled on AI and privilege within a week of each other in February 2026 and reached opposite results. In United States v. Heppner the Southern District of New York denied attorney-client privilege and work-product protection over documents a defendant generated with a consumer AI platform on his own initiative. In Warner v. Gilbarco the Eastern District of Michigan upheld work-product protection over material a self-represented plaintiff prepared with ChatGPT. The difference was counsel direction and procedural posture, not the chatbot.

United States v. Heppner: No Privilege and No Work Product

United States v. Heppner, No. 25-cr-00503-JSR, 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026), is a securities and wire fraud prosecution before Judge Jed S. Rakoff. The charges were filed on October 28, 2025, devices were seized from the defendant’s home on November 4, 2025, and 31 AI-generated documents were at issue. The court ruled orally on February 10, 2026 and issued its written opinion on February 17. The platform was Anthropic’s consumer Claude rather than ChatGPT, so the holding reaches consumer chatbots as a class rather than one vendor.

The Three Privilege Deficiencies the Court Found

1. The platform is not a lawyer and lacks the trusting human relationship the recognized privileges assume.
2. The provider’s privacy policy defeated confidentiality, because it collects inputs and outputs, trains on them and reserves disclosure rights.
3. The defendant’s purpose was not to obtain legal advice from the platform, which disclaims providing it.

On the instinct to forward the output afterward, the Heppner opinion is direct: a non-privileged communication does not become privileged merely because it was later shared with counsel.

Why Work Product Failed Separately

1. The documents were not prepared by counsel or at counsel’s behest, and they did not reflect defense counsel’s strategy.
2. Beyond the court’s reasoning, the practical position was worse than the holding required: the defendant used a consumer account rather than one a firm administered, so no administrator was in a position to apply a litigation hold before the account’s own retention settings ran.
3. Counsel conceded the defendant acted on his own volition, which meant he was not acting as counsel’s agent when he created them.
4. Work-product protection can cover material a party prepared, but only where counsel’s direction or mental impressions are in it, which the court found absent here.

Warner v. Gilbarco: ChatGPT Work Product Upheld

Warner v. Gilbarco, Inc., No. 2:24-cv-12333, 2026 WL 373043 (E.D. Mich. Feb. 10, 2026), is an employment discrimination case brought by a self-represented plaintiff, and the tool was ChatGPT. The defendants moved to compel all documents and information concerning the plaintiff’s use of third-party AI tools in connection with the lawsuit. The Warner docket shows the motion resolved in the plaintiff’s favor on two independent grounds.

What the Court Held in Warner

1. Protected work product: the materials reflected the non-attorney plaintiff’s own mental impressions, prepared in anticipation of litigation, with the plaintiff effectively serving as their own counsel.
2. Independently undiscoverable: the court found the request neither relevant nor proportional under Rule 26(b)(1).
3. On waiver, the opinion held that work-product waiver has to be a waiver to an adversary, or made in a way likely to get the material into an adversary’s hands.

Disclosure to a public AI platform did not meet that standard, and the protection claimed was work product under Rule 26(b)(3) rather than attorney-client privilege, which the plaintiff never asserted and the court never reached.

Why the Two Decisions Do Not Conflict

1. Different doctrine. Heppner decided attorney-client privilege and work product. Warner decided work product only. No court has held a chatbot exchange attorney-client privileged.
2. Different waiver test. Work-product protection varies by jurisdiction. Some courts ask whether the material was prepared at counsel’s direction and reflects attorney mental impressions; others ask whether disclosure materially increased the likelihood the material reaches an adversary. Heppner applied the first, Warner the second.
3. Different role. A represented defendant acting without counsel is not his counsel’s agent. A self-represented litigant is their own counsel, so their mental impressions are the attorney’s mental impressions.
4. Different posture. The Heppner material was already in the government’s hands through a device seizure. The Warner plaintiff was resisting a written discovery request. Who already holds the document changes the question the court is being asked.

Neither decision changed privilege doctrine. Both applied settled principles to a new fact pattern, which is what courts usually do first, and the Warner court got there by treating generative AI programs as tools, not persons for waiver purposes.

What the Record Does Not Yet Settle

Two district-court decisions are a thin record. There is no appellate treatment and other courts have not weighed in, so neither opinion binds outside its own district and neither forecloses a different result elsewhere. Work-product questions about presuit AI use were reaching courts before either opinion, as the 2024 ruling in Tremblay v. OpenAI shows, which suggests this doctrine will be built case by case rather than announced.

[cta-2]

Does ChatGPT Enterprise Have Attorney-Client Privilege?

ChatGPT Enterprise does not have attorney-client privilege, and neither does a zero data retention agreement. An enterprise plan repairs the confidentiality element and leaves the rest of the privilege test where it was: the exchange is still not a communication with an attorney, and ChatGPT still disclaims giving legal advice. The Heppner court left one route open, and it runs through counsel rather than through a plan upgrade.

What an Enterprise Plan Changes

An enterprise plan changes the retention facts, and every change it makes is contractual rather than doctrinal.

1. Business data is not used to train the models by default, and retention is administrator-controlled.
2. Enterprise, education and zero data retention API customers were carved out of the preservation order in the OpenAI copyright litigation.
3. A workspace administrator rather than the individual user sets the retention and sharing configuration.
4. The protection comes from a contract, which binds the vendor and can be enforced in damages, rather than from a privilege, which binds a court and keeps the material out of evidence.

That distinction is what to ask a vendor about: whether the protection it offers is contractual or evidentiary, and the answer determines whether a breach produces a lawsuit against the vendor or simply exposes material a court can order produced regardless of the contract. How each ChatGPT tier handles data differs on retention, training and administrator control, and no tier produces privilege, because a plan upgrade changes what the vendor promises rather than what a court will recognize.

The One Route Heppner Left Open: Counsel-Directed Use

Judge Rakoff added one sentence that leaves a route open, which Sidley reads as the only opening either decision offers: had counsel directed the defendant to use the platform, the court suggested, it might have functioned “in a manner akin to a highly trained professional” acting as an agent of the lawyer, within the protection of the attorney-client privilege. Read as conditions rather than as a promise, the route has four.

1. Counsel directs and supervises the specific use, and can show it.
2. The platform’s terms keep the exchange confidential, with no training on the content and no retention beyond what counsel accepts.
3. The purpose of the exchange is obtaining or giving legal advice on the matter.
4. The direction is documented at the time, so it can be shown to a court later rather than asserted.

This is dictum in one district-court opinion, not a holding, and no court has yet applied it.

Does Pasting Privileged Material Into ChatGPT Waive Privilege?

Pasting privileged material into ChatGPT can waive attorney-client privilege, because the paste is a disclosure to a third party that breaks the confidentiality the privilege depends on. Whether a particular paste waives attorney-client privilege depends on what went into ChatGPT and under whose direction, and on a consumer plan the default answer is unfavorable, because the platform is a third party and the terms permit retention and training on what it receives.

What the Paste Exposes

Four points bear on how much exposure the paste creates.

1. The exposure runs to the underlying privileged material, not only to the prompt. A memo from counsel that goes into a consumer chat window is a memo that was disclosed.
2. There is no retroactive cure. Heppner is explicit that sharing the material with counsel afterward does not change its status, so the time to protect the information is before it enters the platform.
3. The waiver analysis turns on the plan and the terms in force when the paste happened, which is why a later upgrade does not repair an earlier disclosure.
4. A paste by a non-lawyer on the team creates the same disclosure, which is why the control belongs at matter intake rather than with counsel.

Why Work Product and Privilege Waive on Different Tests

Work product and attorney-client privilege waive on different tests, and that difference is why Warner protected material that had passed through a consumer platform while Heppner did not.

1. Privilege asks whether the material was disclosed to any third party outside the privileged relationship.
2. Work product asks whether the disclosure went to an adversary, or made it materially more likely the material reaches one.
3. Both tests ask what happened after the privileged material was created, not which platform it passed through, which is why the chatbot used is not the variable that decides the outcome.

Waiver of privilege through AI use turns on inadvertent disclosure, the reasonable-steps test, and whether a vendor contract functions as a shield, and each of those runs on its own test rather than on the two above.

How to Use AI on Client Matters Without Losing Privilege

To use AI on a client matter without waiving privilege, keep the privileged facts out of any platform whose terms permit retention or disclosure, and have counsel direct the AI work that touches legal strategy. Four controls do that work, and each one names a trigger a practitioner can apply.

1. Classify before anyone prompts. The operational test: if a prompt would identify the client or the matter to a reader who saw it, it does not go into a consumer plan. Name the person who classifies, and classify at matter intake rather than at the moment of use.
2. Route privileged work to tools whose terms carry it. Read the retention, training and disclosure clauses, not the marketing page. Contractual confidentiality is necessary and not sufficient, so the review happens before procurement signs.
3. Have counsel direct and supervise the AI work on legal strategy. This is the only control aimed at the privilege elements rather than at the confidentiality facts. Prohibit unsupervised use for legal analysis, including by non-legal staff.
4. Put AI accounts inside the litigation hold. Prompts, outputs and the accounts holding them, personal accounts included, go into the hold before routine deletion runs on them.

The Professional Duty Behind the Controls

The controls above are operational, and the duty underneath them is ethical. ABA Model Rule 1.6 requires reasonable efforts to prevent the unauthorized disclosure of information relating to a representation, and that duty attaches to the choice of platform as squarely as it attaches to the choice of recipient. The standard is reasonable efforts rather than perfection, which is why the retention and training terms of a tool belong in the ethical analysis and not only in a procurement review. ABA Formal Opinion 512, issued July 29, 2024, applies the duty to generative AI specifically, reasoning that competent and diligent representation requires understanding the benefits and risks of the technology before a lawyer or the lawyer’s staff relies on it for client work. The bar rules and the court standing orders that govern whether lawyers may use ChatGPT at all reach further than Rule 1.6 does, because several of them require disclosure to the client or to the court rather than reasonable efforts alone.

Competence on the Output Side

Competence is the other half of the duty, and it fails on output as readily as on inputs. The sanctions in Mata v. Avianca, 1:22-cv-01461 (S.D.N.Y. 2023), came from filing fabricated citations that counsel never checked against a real reporter before the brief went to the court, not from any privilege problem, and the same discipline applies to AI work on a privileged matter: the output still has to be verified before it moves. AI hallucinations in legal filings are caught only by reading every authority a model cites before it goes in a brief.

Where Spellbook Fits on Privileged Work

No legal AI tool grants attorney-client privilege, so the question for a legal AI platform is narrower: do its terms protect the confidentiality the privilege depends on, and is the work it does the work a lawyer is doing on a privileged matter. A legal AI tool that protects attorney-client privilege does so by keeping privileged material inside terms that permit no retention, no training and no disclosure, and by doing work a lawyer directs on a matter the lawyer owns. Spellbook is the AI suite for transactional legal work, built into Microsoft Word and Google Docs, which is where the privileged drafting and negotiation work already happens.

The Confidentiality Facts That Matter

On the confidentiality element, three facts bear on the analysis above.

1. Zero data retention means the model providers do not learn from, train on, or store the data, which is the term a court would read when it asked whether the expectation of confidentiality was reasonable.
2. SOC 2 Type II, HIPAA compliant, GDPR and the EU AI Act are the attestations a procurement review asks for, and they evidence the controls behind the retention term rather than substituting for it.
3. SSO, MFA and encryption keep the account itself inside firm control, which is the gap a personal consumer account leaves open.

On the work itself, the Review feature helps legal teams identify risks and proposes redlines as native Word tracked changes, the Draft feature produces first-pass language, Playbooks hold the team’s own standards so that review applies them consistently, and Compare to Market benchmarks a clause against 20M+ real contracts.

What Spellbook Does Not Change

1. It does not create privilege. No vendor can, and no contract term substitutes for the elements a court applies.
2. It does not turn an unsupervised prompt into counsel-directed work. That control is a human one.
3. It does not remove the lawyer from the review step, which is where the judgment calls stay.
4. It is a commercial-contract specialist rather than a litigation or legal-research platform, so the privileged work it reaches is drafting, review and negotiation.
5. It does not exempt a matter in dispute from the litigation hold obligations described above, so the hold still has to reach the account once litigation is reasonably anticipated.

Classify the Matter Before the Next Prompt

Classify the matter before the next prompt, and route it according to what the platform’s terms allow, because that classification is what the four controls above turn on. Try Spellbook free to see what contract review looks like when the drafting work stays inside Word and the data stays out of a training set.

[cta-3]

Frequently Asked Questions

Can ChatGPT Ever Be Considered Part of a Privileged Communication?

No. ChatGPT is not a licensed attorney and no recognized doctrine makes a conversation with it privileged. The exchange can sit beside privileged material without becoming privileged itself, and sharing client facts with it forfeits the confidentiality the privilege depends on.

Has a Court Ruled on ChatGPT and Legal Privilege?

Yes. Warner v. Gilbarco addressed ChatGPT material directly in February 2026 and protected it as work product, and Heppner addressed a consumer AI platform the same month and denied both privilege and work-product protection. No court has yet held a chatbot exchange attorney-client privileged.

Does Using AI Waive Attorney-Client Privilege?

Not automatically. It depends on what was disclosed, which platform received it, and on whose direction the work was done. Pasting privileged material into a consumer plan is a disclosure to a third party; material prepared under counsel’s direction on a platform whose terms keep it confidential presents a different question.

How Is ChatGPT Enterprise Different From the Public Version for Privilege Purposes?

The retention facts differ and the privilege answer does not. An enterprise plan gives administrator-controlled retention and no training on business data by default, which repairs the confidentiality element. The exchange is still not a communication with an attorney.

Are ChatGPT Conversations Discoverable in Court?

Often, yes. Chat logs are account records that a party can be ordered to produce, and OpenAI has itself been compelled to produce conversation logs in litigation. Whether a specific log is discoverable turns on relevance and proportionality, not on privilege.

If I Turn Off Chat History, Is ChatGPT Safe for Client Work?

No. Turning off history narrows retention to roughly 30 days for safety purposes rather than eliminating it, and it does not change the privilege analysis at all. The tasks that remain appropriate when using ChatGPT for legal work are the ones that carry no client-identifying facts, such as general research on public law or formatting work on a document with the parties stripped out.