Whether it is safe to put client information into ChatGPT depends less on your privacy setting than on what you send. The setting most people reach for, “Improve the model for everyone”, only decides whether your conversations can be used to train OpenAI’s models. It does not decide whether they are kept. For several months in 2025 a US court order required OpenAI to preserve ChatGPT conversations, including ones users had deleted, on the Free, Plus, Pro and Team plans and the standard API; the Team plan’s promise not to train on business data made no difference. For a one-person practice, the safeguard that holds up is to take names, figures and identifying detail out before anything goes in, to use a business plan rather than a personal one for anything that cannot be stripped, and to keep out anything you could not explain to the client in a sentence: where it went, who holds it and for how long.
The moment usually looks like this. It is late, a client has sent a long, tense email about a disputed invoice, and you want a calm reply drafted quickly. The fastest way is to paste the whole thread into ChatGPT: the client’s name, their company, the amount, and the paragraph where they explain why they cannot pay this month.
If you have thought about confidentiality at all, you have probably turned off the training setting and moved on. That was worth doing. It just answers a narrower question than the one your client would ask.
The setting decides training, not keeping
OpenAI’s help page on how your data is used is clear about what the switch does. On its services for individuals (Free, Plus and Pro) it may use your content to train its models unless you turn off “Improve the model for everyone” under Settings, then Data controls. On ChatGPT Business, Enterprise, Edu and its API, it does not use your inputs or outputs for training by default.
The same page contains a detail most people miss. On the individual plans, if you give a response a thumbs up or thumbs down, the entire conversation that feedback belongs to may be used to train the models, even if you have opted out. One reflexive click on a good draft of that invoice reply undoes the setting for that conversation. Temporary chats, by contrast, are not used for training while they remain temporary.
Training is the risk people picture: a client’s details turning up in someone else’s answer. But switching it off does nothing about storage. The conversation still sits in your history and on OpenAI’s systems. When you delete it, OpenAI’s stated practice is to remove it within 30 days, unless it is required to keep it for legal or security reasons. In 2025 that exception stopped being hypothetical.
In 2025, deleted did not mean deleted
The New York Times and other plaintiffs are suing OpenAI, and as part of that case they asked a court to make OpenAI keep consumer ChatGPT and API content that would normally have been deleted. The court ordered it. On 5 June 2025 OpenAI published a page explaining who was affected: anyone on ChatGPT Free, Plus, Pro or Team, and anyone using the API without a Zero Data Retention agreement. Chats users had deleted were included. ChatGPT Enterprise and Edu were not, and nor were API customers on zero-retention terms.
OpenAI fought the order, and on 22 October 2025 it updated the page: its obligations had ended on 26 September 2025, and deleted chats were going back to being removed within 30 days. It also said it would keep storing a limited set of user data from April to September 2025 under legal hold, accessible only to a small, audited legal and security team, and not handed over to the Times, the court or anyone else at that time.
This is not a story about a careless provider. It is a story about where your client’s information actually lives once it leaves your machine. The Team plan was a business product that did not train on your data, and the order caught it anyway, because not training on something and not keeping it are different promises. A conversation held by a third party is held on that third party’s legal terms, and those terms can be changed by a lawsuit you are not part of and might never hear about.
The test a professional body sets
The most detailed professional guidance on this so far is the American Bar Association’s Formal Opinion 512, issued on 29 July 2024. Its section on confidentiality says that before a lawyer puts information relating to a client into a generative AI tool, they must weigh the risk of it being disclosed to or accessed by people outside the firm. For tools that can learn from what is put into them, it concludes that the client’s informed consent is required first.
It then sets a demanding bar for what counts as informed. The client needs the lawyer’s reasons for using the tool, specific information about the risk, the kinds of client information that will go in, how others might use it against the client, and a clear explanation of the benefit. Adding a general clause to the engagement letter that authorises the use of AI is, in the opinion’s words, not sufficient. As a baseline, every lawyer should read and understand the tool’s terms of use and privacy policy, or consult someone who has.
The limits matter. The opinion is written for US lawyers under the ABA’s Model Rules, and it says itself that its conclusion reflects the risks of the tools as they stood when it was published. If you are an accountant, a coach, or practising anywhere else, your own professional body sets your rules. But the test it implies works for anyone holding a client’s confidences: could you give the client that explanation? If you could not tell them where the pasted thread went, who now holds it and for how long, you could not have obtained their consent to send it.
Send less instead of trusting more
The same opinion gives an example of use that needs no consent at all: using the tool to generate ideas without putting in any information about the client. That is the useful observation for a solo practice, because most of what you want from ChatGPT does not need to know who the client is. “Draft a firm, polite reply to a client disputing half of an invoice for a website rebuild, who says cash flow is tight this month” gets you the same draft as the pasted thread, without a name, an amount or a company attached.
- Replace names with roles before you paste: “the client”, “their finance director”, “the other side”.
- Remove or round any figure that would identify the matter. The draft rarely needs the exact amount; you can put it back in your email client.
- Paste the paragraph you need help with, not the whole thread or the whole document. Most of what goes into a chat is there because it was quicker to select all than to choose.
- Anything that cannot be stripped (a client’s bank export, a contract under negotiation, case notes) goes onto a business plan at the very least, after you have read its terms, or it stays out.
The weak point is not knowing these rules. It is the evening when stripping out the names would take longer than writing the reply yourself, so you paste the whole thread just this once. A habit that depends on care at nine at night is the one that fails first. The sturdier version is a tool that sits in your inbox and sends the model only the fields the task needs, through business terms that exclude training by default, so the client’s identity never leaves your systems in the first place.
What this concedes
This is not legal advice, and we are not your regulator. If your profession has guidance on AI and client data, it outranks anything here.
A built tool does not make the data disappear either. OpenAI’s standard API content is deleted after 30 days, not on the spot, and the 2025 order covered the standard API too. Only customers with a zero-retention agreement were outside it. Building something changes what is sent and how much of it, not the fact that something is sent to a third party, and anyone who tells you otherwise is selling you the toggle again.
And for many people working alone, the right answer costs far less than a build: a business plan instead of a personal one, the stripping habit above, and a short list of material that never goes into a model at all. If the client work you want help with can be described without the client in it, that is most of the protection you need, and nobody has to build you anything.
Common questions
- Does ChatGPT use my client information to train its models?
- On the individual Free, Plus and Pro plans it may, unless you turn off “Improve the model for everyone” under Settings and Data controls. Even after opting out, giving a response a thumbs up or down can let OpenAI use that whole conversation for training. On ChatGPT Business, Enterprise, Edu and the API, OpenAI says it does not train on your inputs or outputs by default.
- If I delete a ChatGPT conversation, is it gone?
- Normally OpenAI removes deleted chats from its systems within 30 days, unless it is legally required to keep them. In 2025 it was: a court order in The New York Times’ lawsuit required OpenAI to preserve deleted chats on the Free, Plus, Pro and Team plans and the standard API until 26 September 2025, and OpenAI still holds a limited set of April to September 2025 data under legal hold.
- Is ChatGPT Business or Enterprise safe for confidential client information?
- Safer, not guaranteed. Business plans are not used for training by default, but not training on data is a different promise from not keeping it. The 2025 preservation order covered the Team plan, while Enterprise, Edu and zero-retention API customers were excluded. Read the terms of the plan you are on before putting anything in that you could not strip of identifying detail.
- Do lawyers need client consent to use ChatGPT?
- In the US, the American Bar Association’s Formal Opinion 512 of July 2024 says lawyers need a client’s informed consent before putting information relating to the representation into a generative AI tool that can learn from its inputs, and that a general clause in an engagement letter is not enough. Using the tool without entering client information, for example to generate ideas, does not need consent. State rules and other countries may differ.
- How can I use ChatGPT without exposing client data?
- Describe the task without the client in it. Replace names with roles, remove or round identifying figures, and paste only the paragraph you need help with rather than the whole thread or document. Material that cannot be stripped of identifying detail should go on a business plan whose terms you have read, or stay out of the model entirely.