Perplexity vs ChatGPT: Privacy and Legal Compliance Compared

The privacy difference between Perplexity and ChatGPT is smaller than the privacy difference between either tool's consumer plan and the enterprise plan sold by the same vendor. On Perplexity Pro and ChatGPT Plus, conversations are retained by default and a lawyer has no negotiated data processing agreement governing third-party access. On Perplexity Enterprise and ChatGPT Enterprise, privacy rests instead on a data processing agreement, a commitment not to train on customer data and administrator-controlled retention. The comparison below runs plan by plan: what Perplexity and ChatGPT privacy amounts to at each tier, what each enterprise contract commits to, and where privileged material is exposed.

For law firms handling third-party paper at volume, the plan and the contract are a procurement decision, not a per-matter one. Both vendors publish enough to answer it, and both publish it in places that do not line up.

[cta-1]

Key takeaways

1. Perplexity and ChatGPT both retain conversations by default on their consumer plans, so the plan a lawyer is signed into matters more than the choice between the two tools.
2. ChatGPT separates the training control from the retention control, and switching off model training does not delete or hide saved chats.
3. Perplexity Incognito stops search activity being saved across sessions, and Perplexity states that it and third parties such as the websites visited may still be able to track the user in that mode.
4. A federal court has ordered OpenAI to produce 20 million de-identified ChatGPT conversations in copyright litigation, and no equivalent order has reached Perplexity.
5. System and Organization Controls 2 (SOC 2) Type II describes a vendor's tested controls rather than the terms of a particular plan, so it does not distinguish a consumer plan from an enterprise one.

At a glance: Perplexity and ChatGPT privacy by plan

This Perplexity and ChatGPT privacy comparison table covers the four plan groups a legal team would buy, on the four axes that decide whether client material is safe to enter.

Privacy by plan group

What Perplexity and ChatGPT retain by default

Perplexity and ChatGPT retain conversations by default on every consumer plan, and they differ in how far the user can switch that off. In ChatGPT the training control and the retention control are separate, so turning off model training does not delete or hide saved chats. Perplexity keeps search queries and threads in the account until the user deletes them, and on enterprise plans deletes files attached to threads after seven days.

The preservation order that no longer applies

The consumer retention picture was briefly larger than this. A preservation order in the copyright litigation against OpenAI required the company to retain consumer and standard application programming interface (API) output logs, including logs a user had deleted, and that obligation ended on September 26, 2025. A narrower obligation survives for accounts the news organizations have flagged, and logs already preserved remain accessible in the litigation. Any firm policy still written on the premise that all ChatGPT consumer data is preserved indefinitely is describing an order that no longer applies.

Why training and retention are separate controls

OpenAI's help center states that a deleted saved chat is scheduled for permanent deletion within 30 days, and the OpenAI data controls FAQ states that switching off "Improve the model for everyone" leaves saved chats in place. The two controls answer different questions: one governs whether the conversation is used to improve a model, the other governs whether it persists in the account. Perplexity publishes a single preference covering training use of prompts, responses and uploaded files, so on the consumer tiers there is one switch rather than two. Plan-by-plan detail on the ChatGPT side, including memory and shared links, runs in our guide to whether ChatGPT is private.

Five retention facts a legal team needs in writing before a consumer plan carries client material:

1. Whether the conversation is used to train a model, which on both tools is on by default.
2. How long a deleted conversation survives the deletion, which OpenAI states can be up to 30 days.
3. How long an uploaded file survives the thread, which Perplexity sets at seven days on the enterprise tiers.
4. Who at the vendor can read the conversation during that window, which neither vendor's consumer documentation currently answers.
5. Which model providers and subprocessors receive the conversation and what each of them retains, which is a separate question from what the vendor itself holds.

The privacy controls each tool offers

ChatGPT temporary chat and Perplexity Incognito look like the same control and protect different things. OpenAI states that a temporary chat does not appear in chat history and may be kept for up to 30 days for safety purposes. Perplexity states that Incognito stops search activity being saved across sessions, and that in incognito mode Perplexity and third parties such as the websites visited may still be able to track the user.

The four controls that change what either tool holds

1. The ChatGPT setting named "Improve the model for everyone", which governs training use and not retention.
2. ChatGPT temporary chat, which keeps the conversation out of chat history.
3. The Perplexity AI data retention preference, which governs training use of prompts, responses and uploaded files.
4. Perplexity Incognito, which stops search activity being saved across sessions and does not stop tracking by Perplexity or by the sites visited.

Agentic browsing adds a surface neither setting covers

Agentic browsing, where the AI tool navigates websites and takes actions on the user's behalf instead of only answering questions, adds a surface neither privacy setting covers. LayerX researchers disclosed an attack they named CometJacking, in which a single crafted URL carries a hidden instruction that the Comet browser executes as though the user had typed it. The risk class is indirect prompt injection, where instructions hidden in a web page or document are read by the AI as user input. It is an open research problem across agentic browsers and not a defect unique to one product, and ChatGPT Atlas sits in the same class. Zenity researchers separately described a zero-click path through calendar content that reached local files, and Perplexity implemented stricter boundaries that prevent that specific attack. Neither vendor's privacy settings govern what an agent does once it is browsing on a user's behalf, which makes the browser a separate procurement question from the chat product, and the plan-by-plan treatment of the Perplexity browser surface sits with the rest of that tool's detail.

What SOC 2 Type II does and does not settle

SOC 2 Type II does not mean an AI tool is safe for client data, because the report describes a vendor's tested controls rather than the terms of any particular plan. Perplexity states that it is SOC 2 Type II compliant, and OpenAI states that ChatGPT Enterprise, Edu and Business have each completed a SOC 2 Type II audit. Those statements cover the service organization, so neither distinguishes a consumer plan from an enterprise plan.

What each vendor's attestation covers

Perplexity publishes the compliance position in the Perplexity Trust Center, which lists SOC 2 Type II alongside General Data Protection Regulation (GDPR) compliance and holds the report itself behind a request. The attestation is organization-wide rather than plan-specific, so it does not by itself separate the Free, Pro and Max tiers from Enterprise Pro. A lawyer reading the attestation as a plan feature is reading it for something the report does not cover.

OpenAI publishes the equivalent position in the OpenAI Trust Portal, which records the completed SOC 2 Type II audits for the business tiers. What differs by tier on both platforms is contractual rather than certificatory: the data processing agreement, the commitment not to train on customer data, and the retention configuration.

What a SOC 2 Type II report does and does not settle:

1. It does settle that an independent auditor tested the vendor's controls across a period rather than at a single point in time.
2. It does not settle whether the plan in use carries a data processing agreement.
3. It does not settle whether inputs on that plan are used for model training.
4. It does not settle how long a conversation is retained, or who inside the vendor can read it during that window.

The duty behind the decision: Rule 1.6(c) and Opinion 512

The duty that governs the decision is not a certification question either. American Bar Association (ABA) Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of information relating to the representation, and ABA Formal Opinion 512 applies that duty to generative AI tools, including the diligence a lawyer owes on a vendor's terms of use and data handling practices. Most of that diligence is the same for either tool, and this guide to whether lawyers may use ChatGPT works through what Opinion 512 asks before a first prompt. A SOC 2 report is evidence a lawyer can weigh in that assessment rather than the assessment itself.

[cta-2]

Third-party access: the 20-million-conversation order

A court can order an AI vendor to hand over conversations, and one already has: a federal court has ordered OpenAI to hand over 20 million de-identified ChatGPT conversations to the news organizations and class plaintiffs suing it, and no equivalent order has reached Perplexity. On January 5, 2026, District Judge Sidney H. Stein affirmed the order in the consolidated copyright litigation in the Southern District of New York. OpenAI states that the sample excludes ChatGPT Enterprise, Edu, Business and API customers, so the exposure the order documents sits on the consumer plans.

How the production order was scoped

Bloomberg Law reported that the judge affirmed the production order over OpenAI's objection, describing the conversations as anonymized. The volume is the part that matters for a confidentiality assessment rather than the merits of the copyright claim: a third party's discovery request has already reached a pool of consumer conversations at a scale no individual account holder agreed to, and the account holders are not parties to the case.

The National Law Review's account of the ruling sets out how the production was scoped and which plaintiff groups receive the logs, which runs to both the news plaintiffs and the class plaintiffs in the consolidated proceeding. De-identification reduces the exposure without closing it, because a conversation containing a deal name, a party name or a draft clause identifies the matter regardless of whose account it came from.

What the asymmetry with Perplexity does not show

The absence of an equivalent order against Perplexity is a fact about litigation history rather than evidence that Perplexity is harder to reach. Both vendors hold consumer conversations that are discoverable in principle.

Enterprise plan controls compared

Perplexity Enterprise and ChatGPT Enterprise converge on the same four controls, and they differ in how retention is configured. Both commit to not training on customer data, sign a data processing agreement, support single sign-on with multi-factor authentication, and expose audit logs to administrators. Perplexity deletes files attached to threads after seven days by default, while OpenAI gives the workspace administrator the retention period directly.

What an administrator controls on the enterprise tiers

1. A data processing agreement, on both platforms.
2. A commitment not to train on customer data, on both platforms.
3. Single sign-on with multi-factor authentication, which Perplexity pairs with short-lived session credentials on Enterprise Pro.
4. Audit logs, which Perplexity extends to real-time upload and download alerts alongside the Security Hub for administrator permissions.
5. Retention configuration, which OpenAI hands to the workspace administrator and Perplexity sets at seven days for files attached to threads.
6. Control over which apps and connectors are enabled, which the OpenAI enterprise privacy page documents with permission inheritance and per-user authentication.

Where the enterprise controls stop

Two limits sit inside those lists. Files uploaded to Perplexity Spaces do not automatically expire, so the seven-day deletion does not cover everything an enterprise user puts into the tool. Administrator-controlled retention on the ChatGPT business tiers means the retention period is a firm configuration decision rather than a vendor commitment, which only helps a firm that has configured it. Neither list covers hosting location either, and data residency is usually what decides whether an enterprise plan works for a cross-border matter, so a firm asks for it in the agreement rather than looking for it in a setting.

Perplexity sells Enterprise Pro and Enterprise Max, with the deeper audit logging and custom retention on the higher tier, and OpenAI sells ChatGPT Business alongside Enterprise, Edu and Healthcare, which is usually the tier a smaller firm would buy. These controls also sit with different owners, because the data processing agreement is a procurement and privacy decision while single sign-on, audit logging and retention configuration are owned by information technology and security rather than by the lawyers who will use the tool. Firms already standardized on Microsoft 365 often resolve the question inside that tenancy instead, which our comparison of Copilot and ChatGPT privacy covers on these same axes.

Pros and cons for legal work

Perplexity and ChatGPT each carry a different set of pros and cons for legal work, and the cons are not symmetrical. Perplexity cites the sources behind an answer, which suits research, and the Comet browser widens the surface a firm has to govern. ChatGPT offers the more granular consumer privacy controls and carries the documented third-party production order.

Perplexity

Pros

1. Citations sit in the answer, so a lawyer can check the underlying source before relying on a research result.
2. SOC 2 Type II compliance is stated organization-wide rather than only on the enterprise tiers.
3. Enterprise Pro deletes files attached to threads after seven days by default, which limits how long an upload persists without administrator action.
4. Audit logs on the enterprise tiers carry real-time upload and download alerts, which gives a firm visibility into what left the workspace.

Cons

1. Consumer plans use prompts, responses and uploaded files for model training until the account preference is switched off.
2. Incognito is scoped to a session, and the Perplexity privacy policy states that tracking by Perplexity and by the sites visited can continue in that mode.
3. Files uploaded to Spaces do not automatically expire, so the seven-day rule does not cover every enterprise upload.
4. The agentic browser is a second product surface carrying disclosed prompt-injection research, and a firm has to govern it separately from the chat product.

ChatGPT

Pros

1. Temporary chat keeps a single conversation out of chat history, so the control is scoped to one conversation while Perplexity Incognito is scoped to a session.
2. The training control and the retention control are separate, which gives a user two decisions rather than one.
3. Enterprise, Edu and Business have each completed a SOC 2 Type II audit, with the report available through the OpenAI Trust Portal.
4. Workspace administrators set the retention period directly on the business tiers.

Cons

1. Consumer conversations are retained by default, and the training switch leaves them in the account.
2. A federal court has ordered production of 20 million de-identified consumer conversations, which makes third-party access a documented event rather than a theoretical one.
3. The consumer control names have changed more than once, so firm guidance written against an older setting name no longer matches the product.
4. Consumer plans carry no negotiated data processing agreement, so a firm's confidentiality position rests on standard terms of service.

Which to choose for privileged work

A law firm should use neither Perplexity nor ChatGPT on a consumer plan for client work that puts client material into the prompt, and can defensibly use either one on an enterprise plan once the data processing agreement is signed.

The decision resolves differently in the situations a firm faces:

1. Privileged or client-identifying material, where the answer is an enterprise plan with a data processing agreement in place, or neither tool.
2. Public legal research with no client facts in the prompt, where the cited answers Perplexity returns are the better fit and a consumer plan is defensible.
3. An existing deployment, where the live question is which plan the firm is on.
4. A client instruction or outside counsel guideline restricting third-party AI processing, where the restriction governs whichever plan the firm is on and the options narrow to written client permission or neither tool.

Why a consumer plan fails the privilege test

The reason the consumer plans fail the first situation is not that disclosure is certain. It is that the firm would struggle to show the steps the waiver analysis asks for. The analysis under Federal Rule of Evidence 502(b) treats an inadvertent disclosure as a non-waiver only where the holder took reasonable steps to prevent it and reasonable steps to rectify it, and a plan with no data processing agreement and model training on by default is difficult to characterize that way after the fact. The practical test a firm can apply is whether it could show where the material went, who at the vendor could read it, and for how long it stayed there.

Where Spellbook fits

Spellbook is built for confidential client contracts, and it differs from Perplexity and ChatGPT in where the contract goes rather than only in what the vendor promises. The Review feature, which surfaces risks and proposes redlines as native Word Track Changes, works inside the document a lawyer already has open, so a client contract is not uploaded to a separate website. Spellbook maintains SOC 2 Type II compliance and has negotiated zero data retention agreements with both OpenAI and Anthropic, which means customer data in requests and responses with those models is not persisted and exists only in memory for long enough to process the request.

1. The Review feature surfaces risks and proposes redlines as native Word Track Changes, inside the document instead of in a separate chat window.
2. The Draft feature produces first-pass language using GPT-5, grounded in the firm's own playbooks and precedents alongside a set of more than 20 million real contracts, so the drafting request does not become a prompt in a consumer chat account.
3. The Compare to Market feature benchmarks a clause against that contract set, so a lawyer does not have to paste the clause into a public chat tool to ask whether it is market.

The scope limit

Spellbook is a commercial-contract specialist rather than a legal research platform, so the case-law question Perplexity answers well is not a question Spellbook is built for, and a firm running both would route them to different work.

Frequently asked questions

Which AI has the better privacy policy, Perplexity or ChatGPT?

Neither published consumer privacy policy is materially better for legal work, because both permit retention and training by default and both can be switched off only through an account preference the user has to find. The document that settles the question is the enterprise data processing agreement, which replaces the consumer policy rather than amending it, and it is where either vendor makes a commitment a firm could enforce.

Does Perplexity keep my data private?

Perplexity does not keep data private by default on the consumer tiers. On the Free, Pro and Max plans, prompts, responses and uploaded files are used for model training until the AI data retention preference is switched off, and threads stay in the account until the user deletes them. Enterprise Pro and Enterprise Max exclude customer data from model training by contract, which is a different kind of commitment from a setting.

Is Perplexity a security risk?

Perplexity carries the same security risk class as any browser-based AI tool, and the agentic browser adds one surface on top of it. Researchers have disclosed indirect prompt-injection paths in agentic browsers generally, including in Comet, and Perplexity addressed the specific paths disclosed to it. Because the underlying injection problem is unresolved across the category, what a firm can manage is which plan holds the data and which surfaces are enabled for which users.

Can a court order an AI vendor to produce my conversations?

A court can order an AI vendor to produce conversations, and the order goes to the vendor rather than to the account holder, who is not a party to the litigation and receives no notice that the request was made. The practical consequence follows the plan: a consumer account's conversations sit in a pool a plaintiff can ask for, while OpenAI states that business and API data was carved out of the one order that has issued so far.

[cta-3]

Spellbook offers a free seven-day trial, so a firm can test the Review feature on the firm's own contracts before it changes a policy. Try Spellbook free.