Is Perplexity Private for Lawyers?

Is Perplexity private? Not by default. Whether Perplexity is private depends entirely on the plan you are on: the Free, Pro and Max consumer tiers use your prompts and uploaded files for model training until you switch AI data retention off, while Enterprise Pro excludes customer data from model training and the Chat Completions API retains nothing. For a legal team, that means the confidentiality answer changes tier by tier, and Perplexity's consumer privacy notice does not govern an Enterprise or API deployment at all.

So whether Perplexity is private is settled by the tier, which is why law firms that live in third-party paper decide it before the first prompt. What follows answers whether Perplexity is private plan by plan, setting by setting and surface by surface, then for privilege and HIPAA.

Key Takeaways

1. Perplexity is not private by default on any consumer tier: the Free, Pro and Max plans use your prompts, responses and uploaded files to train Perplexity's models until you turn AI data retention off.
2. Perplexity is private by contract on Enterprise Pro and Enterprise Max, which exclude customer data from model training, and on the Chat Completions API, which retains nothing.
3. Whether Perplexity is private is a tier question, not a settings question: Perplexity's consumer privacy notice does not apply to the Enterprise and API offerings at all.

[cta-1]

Is Perplexity Private on Each Plan?

Perplexity Pro privacy is not materially different from Free tier privacy. Both consumer plans train on your inputs by default, and the only tiers that exclude your data from training by contract are Enterprise Pro, Enterprise Max and the Chat Completions API.

What Changes Between Free, Pro and Max

Less changes than the price difference suggests. Paying for Pro or Max buys model access, usage limits and feature breadth, and all three consumer tiers share one privacy posture:

1. Prompts, responses and uploaded files are used for model training by default.
2. The control is a single account preference, identical across the three tiers.
3. Retention of uploaded files runs to roughly 30 days on all three.
4. The governing terms are the consumer terms, which no tier upgrade changes.

What Changes on Enterprise Pro and Enterprise Max

The commitment moves from a preference to an agreement. Perplexity's Enterprise page states that it never trains its models on enterprise customer data, enterprise file retention defaults to 7 days, and an administrator can configure automatic file deletion after one day. Perplexity publishes an Enterprise FAQ that distinguishes Enterprise Pro from Enterprise Max, so a team evaluating the two should confirm which tier the quoted terms attach to.

What the Chat Completions API Commits To

Perplexity documents the posture of its application programming interface (API) more precisely than any other part of its stack. Its developer documentation states that Perplexity maintains a strict zero data retention policy for the Chat Completions API, does not retain data sent through that endpoint, and collects only billable token counts, which carry no prompt or response content.

Note the scope of that commitment. It is written for the Chat Completions API specifically rather than for the API platform as a whole, so a team building against a different endpoint should ask where the policy stops rather than assuming it travels.

What Perplexity Does Not Publish

Pricing follows the same split, and it limits what you can verify before you commit. Perplexity publishes rates for its consumer plans and does not publish standard Enterprise pricing, and estimates vary by firm size and deployment scope, which means the contractual terms that decide the confidentiality question only become visible inside a sales conversation.

What the Perplexity Privacy Policy Says About Data Collection

The Perplexity privacy policy, now published as a privacy notice and last updated July 8, 2026, sets out Perplexity data collection in three groups: what you provide, what Perplexity records as you use it, and what Perplexity does with the result.

What You Provide

Account details such as your name, email address and payment information, plus the substance of what you do with the product:

1. Prompts and typed inputs.
2. Uploaded files and images.
3. The responses generated from them.

For a lawyer, the second group is where the confidentiality risk sits. A prompt that names a counterparty, quotes a clause under negotiation or describes a live dispute is client information the moment it is typed.

What Perplexity Records as You Use It

Usage and device data, including device information, approximate location and interaction patterns. Where the Comet browser is synced to a Perplexity account, the notice describes browsing history being recorded and engagement being tracked, which is a considerably wider collection surface than a search box.

What Perplexity Does With It

The notice's own "How We Use Data" section expressly includes improving or creating services and products, including Perplexity's AI models. That is the sentence that matters for a confidentiality review, because it is the documented basis for the consumer default.

The load-bearing qualification sits further down the same notice: it states that it does not apply to data collected through Perplexity's Enterprise and API offerings, where Perplexity acts as a service provider or processor. A reviewer who reads the consumer notice to assess an Enterprise rollout is reading a document that disclaims the deployment they are assessing, which is the same trap that catches teams comparing consumer and enterprise postures on ChatGPT.

Does Perplexity Train on Your Inputs?

Perplexity does train on your data on the consumer tiers. Prompts, responses and uploaded files from Free, Pro and Max accounts are used to improve Perplexity's models by default, and the control is the AI data retention setting in account preferences rather than a plan upgrade. Enterprise Pro and Enterprise Max accounts are excluded from training, and data sent through the Chat Completions API is not used for training at all. So whether Perplexity trains on your data is a tier question and a settings question at once, rather than a product-wide yes or no.

Two limits on the opt-out are worth stating plainly:

1. It operates forward only. Switching the setting off governs what happens from that point on, so inputs already used for training are not retrieved by changing a toggle.
2. It is a preference, not a promise. On a consumer plan the setting is a product control governed by the consumer terms, so it can be switched back on by accident or by a colleague sharing the account.

That second limit is the main reason privacy posture varies so widely across the major assistants a legal team is likely to compare, because the comparison that matters is contractual rather than technical.

How to Make Perplexity Private: The Settings That Matter

How to make Perplexity private involves four controls, plus one limit that none of them reaches. There is no single switch: the work to make Perplexity private is spread across account preferences, chat mode, file retention and the account itself. The controls are real and they reduce exposure. None of them creates a confidentiality obligation on a consumer plan.

The Four Controls

1. AI data retention: turn it off in account preferences. This is the setting that stops prompts, responses and uploaded files from being used to train Perplexity's models on Free, Pro and Max.
2. Temporary or incognito chats: these do not save to your primary history and expire after roughly 24 hours. They reduce persistence, not transmission.
3. File retention: the deletion window is fixed on a consumer plan and cannot be shortened from the account. Only an enterprise administrator can configure it, down to automatic deletion after one day, which is the practical reason a file-heavy review does not belong on a consumer tier.
4. Account deletion: deleting the account removes personal information within 30 days.

What the Settings Do Not Reach

The limit is contractual rather than technical. Everything above is a product setting, which means it is governed by the consumer terms and can be reconfigured, defaulted differently after an update, or simply switched on by a colleague sharing the account. A firm that wants the commitment in writing moves to Enterprise Pro or to the API, where the posture sits in the agreement instead of the preferences pane. That line separates a configured consumer account from a governed deployment, and it applies in the same shape to Google's assistant stack.

The Decisions That Belong in a Firm Policy

These choices do more for exposure than the account settings above, and they are firm-level rather than individual:

1. Which tier is approved for which category of work.
2. Which categories of client material may not reach a prompt on any tier, such as material under a protective order or a sealed filing.
3. Who is permitted to create accounts, and under whose billing.
4. What happens to an account and its history when someone leaves.

Those belong in the same document as the rest of a firm's AI data handling policy, reviewed on the same cycle, rather than in an email thread.

Who Can Access Your Perplexity Chat History?

Perplexity AI chat history privacy depends on the plan and on who counts as an authorized party. On consumer plans, Perplexity employees, support personnel and automated systems may access chat content for troubleshooting and service improvement, and history is retained unless you delete it or use temporary chats. On enterprise accounts, access is administered and files follow the 7-day default retention.

The Three Categories of Access

1. Perplexity's own personnel, for support and service improvement.
2. Subprocessors, meaning the third parties Perplexity engages to deliver the service.
3. Other people in your account, where a team or enterprise workspace shares threads or connectors.

Perplexity publishes its subprocessor list on its Trust Center, which is the document a reviewer should read alongside the data processing agreement rather than instead of it. The list tells you who else touches the data; the agreement tells you on what terms.

What the Agreement Has to Cover

A data processing agreement that is fit for client work addresses four things the subprocessor list cannot:

1. The subject matter, duration, nature and purpose of the processing.
2. Whether and how further subprocessors may be engaged.
3. What happens to data on termination, including deletion timelines.
4. Which security measures the vendor commits to maintain.

Under Article 28 of the General Data Protection Regulation (GDPR), a processor may not engage another processor without the controller's authorization, and the processing has to be governed by a contract setting out those elements. A firm acting as controller over client personal data therefore needs the agreement in place before the work starts, rather than after a question is raised.

The same framework applies whichever assistant a team settles on, which is why the Perplexity and ChatGPT posture comparison is worth running side by side rather than tool by tool in isolation. For a law firm, the practical conclusion is narrow: chat history should not be treated as private unless a contract says so, and on a consumer plan no contract does.

Does Perplexity Share Your Conversations with Advertisers?

Perplexity does not share your conversations with advertisers, according to its own privacy notice. The notice, updated July 8, 2026, states expressly that Perplexity does not sell your personal data and does not send your queries, prompts or conversation content to advertisers. That is the current documented answer, and it is the one a confidentiality review should record.

The Documented Sequence

The sequence behind that wording is documented:

1. March 31, 2026: a proposed class action, Noel v. Perplexity AI, Inc., No. 3:26-cv-02803 (N.D. Cal.), was filed naming Perplexity, Google LLC and Meta Platforms Inc. as defendants. The allegations concerned advertising trackers transmitting conversation content and identifiers, and the complaint asserted that because the transmission was server-side, incognito mode did not prevent it.
2. May 6, 2026: the docket was terminated, roughly five weeks after filing, so the allegations were never tested on the merits.
3. July 8, 2026: Perplexity's privacy notice was updated, carrying the advertiser language quoted above.

What a Confidentiality Review Should Take From It

The takeaway is structural rather than adversarial. A vendor's advertising and analytics stack is a separate disclosure pathway from its model training, it is governed by different language in the privacy notice, and a review that only asks whether the vendor trains on your data will not reach it. Ask about both pathways, and ask which deployment each answer covers, because the consumer notice and the enterprise agreement answer differently.

[cta-2]

Comet and Perplexity Computer: The Surfaces That Change the Risk

The Perplexity Comet browser and Perplexity Computer change the confidentiality question more than the privacy notice updates covered above, because they move the product from a box you type into to a surface that holds your credentials.

What Comet Collects

Perplexity's own privacy notice is specific about the browser:

1. Saved settings, passwords, payment data and account information are processed.
2. Browsing history is recorded and engagement is tracked when Comet is synced to a Perplexity account.
3. Browsing data, site permissions and download records are stored locally on the device.
4. Incognito mode does not prevent Perplexity or the sites you visit from tracking you.

A lawyer who treats a private window as a confidentiality control is relying on something the vendor does not claim.

Computer for Counsel

Perplexity Computer widens the exposure further for legal work, because Perplexity now markets it to lawyers directly. Its legal use-case page publishes "Computer for Counsel," described as connecting research databases, document repositories, contract tools and matter-management systems, running cross-jurisdictional research, regulatory monitoring and document review in the background, and assembling output into a brief, a memo or a deal summary.

What to Review Before Connecting an Agentic Surface

Read as a confidentiality matter, every connector is a new pathway between a document management system and a vendor, and the approval that covers a search box does not cover a credentialed agent working inside a matter file. Questions a search-product review never had to ask:

1. Which systems is the agent authorized to read, and which can it write to?
2. Where does output land, and who else in the workspace can see it?
3. What happens to a connector's access when a matter closes or a lawyer leaves?
4. What record is kept of which documents the agent opened and what it did with them, and can the firm produce that record if a client asks?

That is a different review with a different scope, and it is the one to run before anyone connects an agentic surface to Perplexity's broader legal workflow claims.

Reporting in September also described Perplexity moving some processing to a hybrid local and cloud model, with a related on-device engine open-sourced. No Perplexity-owned page was reached to confirm the scope of either, so treat that detail as reported rather than documented until the vendor publishes it.

Does Using Perplexity Waive Attorney-Client Privilege?

Entering client information into Perplexity does not automatically waive attorney-client privilege, but it can, and the mechanism is disclosure to a third party rather than anything specific to AI.

How a Waiver Arises

The attorney-client privilege protects confidential communications between a lawyer and a client made for the purpose of seeking or providing legal advice, and the confidentiality element is the one a cloud tool puts under pressure. Voluntary disclosure of a privileged communication to someone outside the privileged relationship can waive the protection as to that communication. On a consumer plan, where inputs may be used for training and no confidentiality obligation runs to the firm, the prudent treatment is to assume anything entered may be retained and reviewed.

What the Model Rules Require

Two Model Rules carry most of the weight here:

1. ABA Model Rule 1.6 requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of information relating to the representation.
2. ABA Model Rule 1.4 requires a lawyer to keep the client reasonably informed about the means by which the representation is carried out.

Taken together, they make the tier decision an ethical question and not only a procurement one. A consumer account with training enabled is a weaker set of reasonable efforts than an Enterprise deployment with the posture written into the contract, and that gap is the practical core of how privilege analysis applies to AI tools.

Anonymizing Is Not a Complete Answer

Stripping names from a prompt reduces identifiability, and it does not eliminate it. A clause quoted verbatim from a distinctive agreement, a deal structure with few comparables, or a fact pattern a competitor could place can still identify the matter. The working test is whether someone in your market could name the deal from the prompt. If they could, the prompt should not be in a consumer tool, and the broader mechanics of how a waiver arises from AI use are worth understanding before the question is live rather than after.

Is Perplexity HIPAA Compliant?

Perplexity's compliance with the Health Insurance Portability and Accountability Act (HIPAA) is not something any single Perplexity document establishes. Three Perplexity properties describe the HIPAA posture three different ways, so the honest answer is that it depends on which document your contract reflects.

Why Those Are Three Different Claims

They are three different statements, not three phrasings of one:

1. A gap assessment is an evaluation of where a program stands against a standard.
2. Aligned safeguards describe controls modeled on a standard.
3. Compliant is a statement that the standard is met.

None of the three mentions a business associate agreement, which is the instrument that allocates HIPAA obligations between a covered entity and a vendor handling protected health information on its behalf.

What to Ask Before a Covered-Entity Deployment

For a lawyer advising a covered-entity client, this is a verification instruction rather than a criticism:

1. Which of the three statements does the proposed contract actually reflect?
2. Will Perplexity execute a business associate agreement for this deployment?
3. Which tier and which endpoints does that agreement cover?

Get the answers in the agreement rather than from a marketing page. The same exercise is worth running on any vendor whose compliance language varies across its own properties.

Two practical points tend to decide the question before the contract does. The first is scope: a covered-entity client's protected health information usually reaches a lawyer inside the documents rather than inside the prompt, so the exposure runs through uploaded files and connected repositories rather than through what gets typed, and the retention windows that apply to uploads are the ones to check. The second is who signs. A business associate agreement is executed between the covered entity and the vendor, so a firm handling protected health information on the client's behalf is usually a business associate itself and may need its own subcontractor arrangement rather than relying on the client's. Both points are worth settling before a deployment rather than after a question is raised, because the answer can rule out a tier that the marketing page appears to permit.

Legal Best Practices When Using Perplexity

To use Perplexity safely with client data, decide the tier before the work starts, put a data processing agreement in place, and keep privileged client data out of any prompt the tier does not cover. Using Perplexity safely with client data is a governance exercise before it is a settings exercise, and it starts upstream of the tool, with whether lawyers may use Perplexity on the matter at all. The steps below run in the order a matter actually runs.

1. Pick the tier before the work starts. Decide which category of work is permitted on which plan, and route anything touching client confidences to Enterprise Pro or the Chat Completions API rather than to a configured consumer account.
2. Review the data processing agreement and the subprocessor list together. The agreement sets the terms; the list tells you who else is in scope. Check both at renewal, because subprocessor lists change.
3. Limit privileged content. Enter privileged material only where the tier, the agreement and the retention settings all support it.
4. Minimize the data scope. Input only what the question requires, remove identifiers, and apply the identifiability test to clause text as well as to names.
5. Update engagement letters. Disclose the use of AI tools, address the confidentiality implications with the client, and record the client's position.
6. Retain human oversight. Verify outputs and sources before they reach a client or a filing, and keep the lawyer accountable for the work product.
7. Review the decision regularly and when the product changes. A new surface such as an agentic browser is a new review, not an extension of the old one.

The ethics guidance is more specific than it is often given credit for. Florida Bar Ethics Opinion 24-1 addresses lawyers' use of generative AI, covering confidentiality, oversight of the work product, and what has to be disclosed to a client before the tool is used on their matter.

At the national level, ABA Formal Opinion 512 addresses generative AI under the Model Rules. The Model Rules are a template that each jurisdiction adopts and amends, so a state opinion construes its own version of the rule rather than displacing Opinion 512. A lawyer practicing in several states is therefore reconciling several opinions, not applying one, and the differences between them tend to sit in the disclosure and consent requirements rather than in the confidentiality analysis.

The District of Columbia addresses the same ground for lawyers practicing there in D.C. Bar Ethics Opinion 388, which reaches confidentiality, competence and supervision.

Because these are jurisdiction-specific documents rather than a single bright-line rule, the governing opinion for a given matter is the one from the relevant jurisdiction, and a firm with multi-state practice may be reconciling several at once. That makes it worth tracking the bar guidance that applies to your own jurisdictions rather than relying on a general summary of where the profession has landed.

Where Spellbook Fits

Is Perplexity safe for lawyers? For open-web research with no client content in the prompt, on a tier where training is switched off, it can be. For privileged contract work, a consumer Perplexity account is not, and no setting changes that, because the commitment is a preference rather than a contract. Perplexity is a research and answer product that happens to accept uploaded files, so the confidentiality posture it offers a lawyer is the one you configure. Spellbook is built for commercial legal work, which changes what the privacy posture has to do: the material is the contract itself, so the confidentiality commitment has to hold by default rather than by configuration. Spellbook prices per seat by team size and offers a free seven-day trial.

What Spellbook Commits To for Client Data

1. Zero data retention.
2. SOC 2 Type II, HIPAA compliant, and support for GDPR and EU AI Act obligations.
3. Single sign-on (SSO) and multi-factor authentication (MFA).
4. Encryption in transit and at rest.

Where It Works

The product sits in Microsoft Word and Google Docs rather than in a separate tab:

1. The Review feature surfaces risks and proposes redlines as native Word Track Changes.
2. The Draft feature generates language grounded in a team's own playbooks and precedents alongside more than 20 million real contracts.
3. The Playbooks feature holds the firm's positions so they are applied the same way across reviewers.

The Limitation

Spellbook is a commercial contract specialist rather than a legal research platform, so a team that needs cross-jurisdictional case law research or open-web answers still reaches for a research tool. Keep privileged contract work inside a platform whose confidentiality posture is contractual, and keep general research where no client content needs to go.

Frequently Asked Questions

Does Perplexity Store Your Data?

Yes. Perplexity does store your data, and how long Perplexity stores your data depends on the plan. Perplexity stores your account information, prompts, responses and uploaded files on every consumer tier, and closing a thread does not delete them. Uploaded files auto-delete after about 30 days on consumer plans and after 7 days on enterprise accounts, account deletion removes personal information within 30 days, and temporary chats expire after roughly 24 hours. Data sent through the Chat Completions API is not retained beyond billable token counts.

Can You Delete Your Perplexity History?

Yes. Threads can be deleted manually on every plan, and enterprise accounts can apply automatic file deletion. Deletion is not recoverable. Deleting history and switching off AI data retention both operate forward: neither removes inputs already used for model training.

Does Perplexity AI Track You?

Perplexity records usage and device data on all plans, and where the Comet browser is synced to an account it records browsing history and tracks engagement. Perplexity's privacy notice states that incognito mode does not prevent Perplexity or the sites you visit from tracking you, so a private window is not a confidentiality control.

What Is the Perplexity Privacy Controversy?

The dispute concerned advertising trackers. A proposed class action filed in March 2026 named Perplexity alongside Google and Meta and alleged that conversation content and identifiers were transmitted to advertising infrastructure server-side. The docket was terminated about five weeks later, so the allegations were never tested, and Perplexity's privacy notice was updated in July 2026 to state that it does not send queries, prompts or conversation content to advertisers.

Can Perplexity Access Your Legal Queries?

On consumer plans, yes. Perplexity personnel, support staff and automated systems may access chat content for troubleshooting and service improvement. On enterprise accounts, access is administered and the posture is set by contract. Without a contract, a legal query entered into a consumer account should not be treated as confidential.

[cta-3]

Put Privileged Contract Work Somewhere Built for It

The settings in this guide reduce exposure on a product that was not designed to hold privileged material, and on a consumer plan they remain preferences rather than commitments. Where the work is contract review, drafting and negotiation, the tier question does not have to be managed at all. Book a demo to see the Review feature working on your own contracts.