Is ChatGPT Private? A Lawyer's Guide to Securing Confidential Client Data

ChatGPT is not private by default, and no ChatGPT plan is private enough to hold facts that identify a client. Free, Plus and Pro conversations are stored, trained on unless the account holder opts out, and readable by authorized reviewers. Business, Enterprise and Edu plans are excluded from training by default, though none of them is a privileged channel.

Whether ChatGPT is private enough for a given task depends on the plan and on the work, which is the distinction that matters when a team weighs a general assistant against a review tool built for legal work. Below: what each plan does with a prompt, who can read it, how long data survives deletion, what legal process has already reached, and the settings that reduce exposure.

Key Takeaways

ChatGPT is private and confidential only to the extent a plan contracts for it, and no plan makes it privileged.

1. Consumer plans (Free, Plus and Pro) store your conversations and use them to train OpenAI models unless you turn off Improve the model for everyone in Data controls. Turning off chat history no longer does this job.
2. ChatGPT Business, Enterprise and Edu plans are excluded from training by default and let workspace administrators control how long data is retained.
3. A 2025 court order required OpenAI to preserve consumer ChatGPT and application programming interface (API) conversation logs that would otherwise have been deleted. Enterprise, Edu and API usage under a Zero Data Retention (ZDR) agreement were carved out.
4. No ChatGPT plan is a privileged channel. Entering facts that identify a client or a matter is disclosure to a third party, which can waive the attorney-client privilege.
5. Spellbook is built for commercial contract work, keeps client data out of model training, and runs inside Microsoft Word and the browser.

[cta-1]

Is ChatGPT Confidential for Law Firm Use?

ChatGPT is not confidential for law firm use, and it is not safe for confidential information on a consumer plan, because OpenAI is a third party to the lawyer-client relationship. On a consumer plan your prompts and the responses may be stored, may be reviewed by authorized OpenAI personnel or contractors, and are used to improve models unless you opt out. Entering identifiable client facts is therefore a disclosure to an outsider rather than a communication made in confidence.

Where the Privilege Analysis Goes Instead

Whether ChatGPT is confidential in the doctrinal sense, and what follows from disclosing client facts to it, sits outside this page. For the analysis itself, see what the law says about privilege and AI tools. The practical rule is narrower and does not depend on how any court eventually rules: if a prompt would identify a client or a matter to a reader who saw it, do not put it into a consumer plan.

Choosing a tool built for legal work is the other half of the answer. For whether the use is permitted at all, see the legality of lawyers using ChatGPT.

How ChatGPT Handles Your Data by Plan

ChatGPT shares your data with authorized reviewers and service providers by default, and the plan decides how far that goes. The differences are contractual rather than technical. The same plan-by-plan question applies to every general assistant a firm might reach for, including Microsoft Copilot. The sections below set out what each ChatGPT tier does with a prompt.

ChatGPT Free Plan

The ChatGPT Free plan is not private by default. OpenAI may use the content you submit to improve model performance unless you opt out in Data controls. Prompts, responses and uploaded files can be reviewed by authorized OpenAI personnel or trusted service providers under confidentiality and security obligations.

Chat history is stored until you delete it. Deleted conversations are generally removed from OpenAI systems within 30 days unless retained longer for security or legal reasons, and the full rules sit in the chat and file retention article.

ChatGPT Plus and Pro Plans

ChatGPT Plus is not safe for confidential information and is no more private and secure than the free tier. Neither is Pro. Both buy performance and access, not protection. Faster models, higher limits and earlier feature access do not change the data posture: unless you opt out, conversations are saved and may be used for model improvement, and the same internal review applies.

For a comparison of a different paid consumer assistant against ChatGPT, see Claude and ChatGPT for lawyers.

ChatGPT Business, Enterprise and Edu Plans

ChatGPT Business is safer for confidential information than the consumer tiers, and ChatGPT Enterprise goes further again. Neither makes the channel privileged. ChatGPT Business is the plan OpenAI now sells to teams, replacing the tier previously marketed as Team. Alongside it sit ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare and ChatGPT for Teachers. For all of these, OpenAI states that it does not train on business data by default, and that workspace administrators control how long data is retained, with deleted conversations removed within 30 days unless retention is legally required.

These plans add the controls a firm's evaluation will ask about: single sign-on through SAML (the standard that lets staff sign in with the firm's own identity provider), fine-grained access control, and a Data Processing Addendum (DPA) for Business, Enterprise and API use in support of General Data Protection Regulation (GDPR) compliance. OpenAI documents the commitments for each offering on the enterprise privacy page, and the naming matters when a procurement form asks which product is under review.

Excluding your data from training is not the same as making the channel privileged, and an administrator who can shorten a retention window can also lengthen it. The plan improves the contractual position; it does not change what the conversation is.

Who Can Access Your ChatGPT History?

Who has access to ChatGPT data is a short list: authorized OpenAI personnel and trusted service providers, who may read user content to operate the service, prevent abuse, provide support, maintain security, comply with legal requirements, or improve performance. That access is restricted and subject to confidentiality obligations, primarily for moderation rather than routine inspection.

What Access to ChatGPT Data Means for a Legal Team

Two things follow for a legal team:

1. There is no user-side encryption control. OpenAI manages the keys, so you cannot put your conversations beyond the reach of the people who run the service.
2. A restricted access path is still an access path. For confidentiality purposes the relevant fact is that someone outside your firm can read the prompt, not how rarely they do.

Firms working through their own governance position will find the broader framing in data privacy for law firms.

Can a Court Order Reach Your ChatGPT History?

Yes. A court order can reach your ChatGPT history, and one already has. In 2025 a United States court ordered OpenAI to preserve and segregate consumer ChatGPT and API output log data that would otherwise have been deleted, which suspended the ordinary 30-day deletion cycle for the accounts the order covered. A retention promise and a confidentiality guarantee are different things. Whether your own history could surface in a proceeding is treated separately in whether ChatGPT can be used against you.

What the Preservation Order Required

The order required OpenAI to retain conversation logs going forward rather than delete them on the published schedule. OpenAI states that the obligations under that order ended on 26 September 2025, that deleted conversations and Temporary Chats are again removed within 30 days, and that it continues to store a limited set of April to September 2025 user data under legal hold, accessible only to a small audited internal legal and security team. OpenAI set out that position, and that it continues to contest the plaintiffs' demands, in its published response to the data demands. The litigation is ongoing, so treat the current position as current rather than settled.

Which Plans Were Exempt

The carve-outs tracked the contract rather than the product:

1. Covered by the order: ChatGPT Free, Plus, Pro and Team (now ChatGPT Business), and API use without a ZDR agreement.
2. Not covered: ChatGPT Enterprise and ChatGPT Edu.
3. Not covered: API traffic under a ZDR amendment, because content sent to a ZDR endpoint is not stored at all and so there was nothing to preserve.

What the Carve-Outs Mean for a Retention Policy

1. A published deletion window is a commercial commitment, not a guarantee. Legal process can suspend it.
2. The contract a firm signs matters more than the toggle a user sets. The tiers that were carved out were carved out because of the terms attached to them.

For the privilege doctrine that sits on top of these facts, see whether ChatGPT conversations carry legal privilege.

Are Your Inputs Used to Train ChatGPT?

By default, yes. ChatGPT does not keep your data private on a consumer plan unless you change one setting, and your inputs do train the models until you do. On consumer plans OpenAI may use the content you provide, including chats and saved memories, to improve its models. Business, Enterprise, Edu and Healthcare workspaces are excluded from training by default, and organizations have to opt in rather than opt out.

How to Restrict ChatGPT Data Sharing in Settings

To stop ChatGPT from using your data for training, change one setting. Turning off chat history is not it: OpenAI states that when Improve the model for everyone is off, new conversations are not used to train models and can still appear in your chat history. The two controls are now independent, which the current data controls documentation sets out step by step. To turn training off on the web:

1. Open your account menu.
2. Select Settings.
3. Select Data controls.
4. Select Improve the model for everyone, turn it off, and select Done.

Where the Setting Behaves Differently

1. On mobile the path differs. On iOS and Android it runs through your profile icon rather than an account menu. The setting then applies across devices for a signed-in account.
2. Signed out, the choice does not travel. The same toggle is available without an account, but it is saved in that browser only, so a different browser or device starts from the default.

OpenAI also runs a separate privacy portal where a firm can exercise the same opt-out outside the product interface, which matters if it wants a record of the election.

Temporary Chat, Memory and Shared Links: What Each One Protects

These three controls are often discussed interchangeably, but each stops something different, and two of them leave exposure that matters more to a lawyer than to a consumer.

Temporary Chat

Temporary Chat makes ChatGPT more private than a saved chat, though not completely private. It is the closest thing a consumer plan has to a clean session, and it stops three things:

1. The conversation is not saved to your chat history.
2. It does not read from or write to saved memories.
3. It is not used to train models.

What it does not stop is retention. OpenAI may still hold a temporary conversation for up to 30 days for abuse monitoring before it is purged, which the Temporary Chat documentation states directly. Temporary Chat is a reasonable way to keep a one-off question out of your history and out of training. It is not a way to make a prompt disappear on sending, and it was within the class of data the preservation order reached.

Memory

Memory carries details between sessions, and turning it off narrows what a later conversation can surface:

1. Turning off saved memories stops ChatGPT carrying details from one chat into another.
2. Turning off memory does not stop model training, which the separate Improve the model for everyone setting governs.

The practical risk Memory creates is cross-matter leakage: a detail entered while thinking about one deal resurfacing in an unrelated session, possibly in front of a different audience on a shared screen.

Shared Links

Deleting a shared ChatGPT chat does not happen on its own: a shared link turns the conversation into a public web address that keeps working until you revoke it, which is a different exposure from storage or training. Shared conversations have been indexed by search engines, and the mechanics of that failure are set out in the risks of search engine indexing. To close them:

1. Go to Settings, then Data controls, then Shared Links, then Manage, and delete individual links or all of them.
2. Open the original chat menu and delete the chat, which invalidates the link it generated.
3. Request a data export or account deletion from your account settings for a wider clean-up.

Deletion is not instantaneous. Content can persist in internal systems after you remove it, so revoking a link limits future access rather than undoing past access.

Is ChatGPT Encrypted, and What Does That Protect?

ChatGPT is encrypted, and the encryption does not address the confidentiality question a lawyer is asking. OpenAI states that content is encrypted at rest and in transit, both between you and OpenAI and between OpenAI and its service providers, which you can read on the OpenAI security and privacy page. What that covers is narrow:

1. Encryption in transit protects the conversation from interception while it travels between your device and the service.
2. Encryption at rest protects stored data from someone who obtains the underlying storage.

Neither protects the prompt from OpenAI. There is no zero-access or end-to-end arrangement here: OpenAI holds the keys, so the plaintext is readable server-side by the systems and the authorized reviewers described above, and by anyone a legal obligation compels OpenAI to produce it to.

Why Encryption Is Not the Differentiator

No ChatGPT plan offers end-to-end encryption, which means the content is readable by the vendor. Encryption is therefore not the axis on which AI tools differ for legal work, since every serious vendor encrypts in transit and at rest, Google Gemini included. The differences that matter sit in the contract: whether the provider trains on your content, how long it retains it, and what it does when served with legal process.

ChatGPT Plan Comparison for Legal Work

For legal work, the ChatGPT plan comparison turns on five attributes that decide whether client work can touch a plan at all: model training, administrator retention control, whether a Data Processing Addendum is available, whether OpenAI will sign a Business Associate Agreement (BAA) supporting Health Insurance Portability and Accountability Act (HIPAA) compliance, and whether the plan fell within the 2025 preservation order. "Not stated" means OpenAI does not publish a commitment either way on that plan, which is different from a published no.

Which Plan Should a Law Firm Use

Which ChatGPT plan a law firm should use turns on whether the work touches client-identifiable facts:

1. Drafting and research with no client-identifiable content: a consumer plan is workable, provided the training opt-out is set and the firm has a written rule about what may be entered.
2. Anything touching client or matter facts: Business or Enterprise only, with a DPA in place and the retention window set deliberately. Buying the plan does not change the retention position by itself, because the window stays at the workspace default until an administrator changes it.
3. Programmatic use across a document set: the API under a ZDR agreement, the only configuration in the table where nothing is stored.

Each route presumes a tool choice, not just a plan choice. A general-purpose assistant on an enterprise contract is still a general-purpose assistant, and the comparison most firms need runs across tools rather than tiers; see the most private AI tools for legal work.

In practice none of this is the individual lawyer's call. The plan, the DPA and the retention window typically sit with procurement, legal operations and information security together with the general counsel, so the written rule about what may be entered has to name who sets it and what it covers.

What a Lawyer Should Not Put Into ChatGPT, and What Is Safe

The rule for uploading confidential information into ChatGPT is simple: never enter anything that identifies a client or a matter. Consumer-oriented advice centers on passwords, bank details and medical records. A commercial lawyer's working material is non-public by default. The line a practitioner needs is drawn around identifiability and obligation, not around sensitivity in the abstract.

What Never to Enter

On any consumer plan, these are out:

1. Client names, matter names, and any combination of facts that identifies either.
2. Counterparty drafts received under a non-disclosure agreement (NDA) or any confidentiality undertaking.
3. Deal-specific commercial terms, such as pricing, caps and dates tied to a live negotiation.
4. Privileged internal memoranda, legal advice, and material subject to a litigation hold.
5. Anything received subject to a protective order or a court-imposed confidentiality restriction.
6. Internal valuation, due diligence or board material prepared for a transaction.
7. Files whose metadata identifies a client even when the prompt does not: document properties, the filename, and tracked-change author names all travel with an upload.

Generally Safe on a Consumer Plan

The following carry materially less exposure, assuming the training opt-out is set:

1. Publicly filed documents, including material contracts already on the public record.
2. General doctrinal and drafting questions with no matter attached.
3. Model or precedent language not tied to a live deal.
4. De-identified hypotheticals, with the caveat below.

The De-identification Caveat

Removing names is not de-identification. In a commercial deal the parties are frequently reconstructable from the combination of sector, transaction size, structure and approximate date, and a hypothetical keeping all four has not been de-identified in any meaningful sense. Generalized hypotheticals work only if the identifying combination is broken rather than the proper nouns stripped. A test before pasting: if a well-informed person in your market read this prompt, could they name the deal?

Ethical Considerations for Lawyers Using AI

The ABA ethics rules for lawyers using ChatGPT turn on confidentiality: lawyers using generative AI have to safeguard confidentiality, protect client interests, and obtain informed consent where client information is involved. The American Bar Association addressed this in Formal Opinion 512, issued in July 2024, the first formal ABA ethics opinion on lawyer use of generative AI and a baseline several state bars have built on. Its central confidentiality holding is that informed client consent is required before confidential client information goes into a self-learning generative AI tool, given the risk of exposure through training.

Which Model Rules Formal Opinion 512 Applies

ABA Formal Opinion 512 on generative AI is often summarized as a confidentiality opinion. It reaches considerably further than that, and the supervisory and billing duties are the ones most often overlooked:

1. Rule 1.1, competence, including the technology-competence duty in Comment 8 to understand how a tool handles data.
2. Rule 1.6, confidentiality, which requires reasonable efforts to prevent unauthorized disclosure.
3. Rule 1.4, communication with the client.
4. Rule 1.5, fees, where AI-assisted work affects what may be billed.
5. Rules 5.1 and 5.3, supervisory responsibility over lawyers and non-lawyer assistance.
6. Rule 3.3, candor toward the tribunal, where unverified AI output becomes a filing problem.

State Bar Guidance on Top of Opinion 512

Several state bars have issued their own guidance on top of that baseline. The State Bar of California published its Practical Guidance for the Use of Generative AI in the Practice of Law, which addresses confidentiality, supervision and disclosure for California practitioners. Check the guidance in your own licensing jurisdiction rather than assuming the national position governs.

What the ChatGPT Privacy Risks Mean for Legal Teams

Pasting client facts into a consumer ChatGPT plan means disclosing confidential information to a third party. That sits in tension with ABA Model Rule 1.6, which requires reasonable efforts to prevent unauthorized disclosure, and OpenAI's default consumer settings carry no contractual obligation to protect that data.

Privilege is exposed alongside the ethical duty. Authorized personnel can access your inputs for safety review and model improvement, and a waiver can complicate discovery, prompt disciplinary complaints, and support a malpractice claim. The reasonable-efforts standard is a factor test rather than a bright line, so the question is not whether a tool is approved but whether the steps you took were reasonable for the sensitivity of the information involved; see an AI-driven waiver of privilege for how that standard gets applied.

How Spellbook's Legal Protections Compare with ChatGPT

On privacy for lawyers, Spellbook and ChatGPT differ because Spellbook is built for commercial contract work rather than adapted to it. Client data is kept out of model training, the platform runs on encrypted infrastructure with contract-level safeguards including zero-retention options, and the compliance posture is published rather than described: SOC 2 Type II, HIPAA, GDPR and EU AI Act compliance are listed on the Spellbook security page, along with the California Consumer Privacy Act (CCPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The product sits where contract work already happens. The Spellbook Review feature surfaces risks and proposes redlines as native tracked changes, the Draft feature generates clauses from your own precedent, and the Playbooks feature captures a team's review standards so positions are applied consistently rather than remembered. Teams that have not written their standards down can start with how to build a contract playbook. Spellbook is used by more than 5,000 in-house teams and law firms across more than 80 countries.

What Spellbook Does Not Replace

The boundary:

1. It is a specialist tool for commercial contracts, not a legal research platform, so case-law research is not the work it is designed for.
2. It is not a litigation tool, and it does not handle matter management or docketing.
3. It is not a contract lifecycle management (CLM) system in the legacy sense, and it integrates with document repositories rather than replacing them.

Some of what a lawyer currently takes to ChatGPT falls outside that boundary, and for that work the plan and settings questions above are the ones that apply. Inside it, the Compare to Market feature benchmarks a clause against a set of more than 20 million real contracts, which is the capability behind clause benchmarking.

Frequently Asked Questions

Is ChatGPT HIPAA, GDPR, or CCPA Compliant?

It depends on the product. No consumer plan supports HIPAA compliance. ChatGPT for Healthcare is a workspace OpenAI describes as designed to support HIPAA compliance requirements, which it introduced in the OpenAI for Healthcare announcement.

For the API Platform specifically, OpenAI will sign a BAA in support of a customer's HIPAA compliance. Requests are reviewed case by case and go to a dedicated address rather than being handled in-product, and OpenAI sets out how to make one in its BAA guidance for the API services. GDPR and CCPA rights apply to consumer accounts, but Free and Plus users have to manage privacy actively, and exercising a right such as deletion generally requires a separate request.

Can You Make ChatGPT More Private?

Yes, to a point. Turn off Improve the model for everyone, use Temporary Chat for one-off questions, avoid entering identifiable information, and move to Business or Enterprise for anything organizational. None of that makes the channel privileged, and it is not designed for legal or medical confidentiality.

Is ChatGPT Safer on Mobile Apps vs. Web?

No. Both use the same platform, the same privacy settings and the same data-sharing rules. The account-level settings you choose apply across devices when you are signed in.

Does ChatGPT Keep Conversations Confidential?

No. ChatGPT is not confidential and secure in the sense a professional obligation requires. Conversations may be stored, may be reviewed by authorized personnel, and on consumer plans are used for model improvement unless you opt out. Confidentiality here is a contractual and operational commitment that varies by plan, not a protected channel, and no plan creates one.

What Should a Lawyer Never Tell ChatGPT?

What a lawyer should never tell ChatGPT is anything that identifies a client or a matter: counterparty material under a confidentiality obligation, deal terms from a live negotiation, privileged advice, and anything under a protective order or litigation hold. The working test is identifiability: if someone in your market could name the deal from the prompt, the prompt should not be there.

Put Client Work Somewhere Built for It

The settings above reduce exposure on a tool never designed to hold privileged material. Where contract review, drafting and benchmarking are the work, a platform built for commercial legal practice removes the question rather than managing it. Book a demo to see how Spellbook handles your contracts.