Does ChatGPT Have Attorney-Client Privilege?

No. A chat with ChatGPT is not protected by attorney-client privilege. The privilege covers confidential communications between a client and a lawyer made to get legal advice, and a chatbot is neither. In February 2026 a federal judge in New York reached the same result for a public AI tool in United States v. Heppner, calling it a question of first impression. Typing privileged facts into a public AI tool can also be treated as disclosure to a third party. Work product is a separate and closer question, and the two 2026 decisions on it came out differently.

Reviewed and corrected on 11 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

TL;DR

• Privilege does not attach. In Heppner, Judge Rakoff held that a defendant's own chats with Claude were not attorney-client privileged, in a ruling framed around communications with a "publicly available AI platform": the tool is not a lawyer, the exchange was not confidential, and he used it without his lawyers' direction.
• Pasting privileged facts risks waiver. In a footnote, the Heppner court said that even if some of what the defendant typed into the AI platform was privileged, he waived it by sharing it, "just as if he had shared it with any other third party."
• Work product is a different test. In Warner v. Gilbarco (E.D. Mich. 10 Feb 2026) a pro se litigant's ChatGPT use stayed protected work product. In Heppner the defendant's chats were not, because they were not prepared by or at the direction of counsel.
• The OpenAI preservation order has ended. A May 2025 order made OpenAI preserve chats it would normally delete. A stipulated order approved on 9 October 2025 ended that ongoing duty as of 26 September 2025. OpenAI still holds data it set aside before that date.
• Sam Altman said the industry has not yet figured out legal confidentiality for ChatGPT chats. TechCrunch reported the consequence: in a lawsuit OpenAI would be legally required to produce them.
• The open question is lawyer-directed use. Heppner left room for privilege where counsel directs a client's use of an AI tool. We found no court ruling on how that works with an enterprise tool.

The short answer, and why it matters

A common version of the question: if I run a fact pattern past ChatGPT instead of a junior associate, is that conversation privileged? It is not. The model is not a member of the legal team. It is a service run by a company whose privacy policy says it may keep data when it receives a lawful subpoena and may share data with government authorities to comply with a legal obligation.

Privilege comes from a relationship and a duty, and no privacy setting creates it. That framing decides almost every answer below.

This post covers the privilege and discovery angle. For the data-and-training side (which plans train on your inputs), see is ChatGPT confidential for legal work. For the underlying ethics rules, see our ABA Formal Opinion 512 guide.

Why privilege does not attach

Attorney-client privilege has a tight definition. In the Second Circuit, which covers New York, it protects communications between a client and an attorney that are intended to be, and in fact were, kept confidential, for the purpose of obtaining or providing legal advice. Strip out any element and the privilege fails.

A public chatbot fails the first element, because there is no attorney on the other end. It also strains the second and third, as the next section shows.

What United States v. Heppner held

The facts matter, because the ruling is narrower than the headlines. Bradley Heppner was indicted in October 2025 on securities fraud and related charges. When agents arrested him they searched his home under a warrant and seized, among other things, about thirty-one documents memorializing his conversations with the AI platform Claude. He had used it in 2025, after receiving a grand jury subpoena, to prepare reports outlining defense strategy. His lawyers conceded that they "did not direct" him to run those searches.

On 17 February 2026 Judge Jed Rakoff of the Southern District of New York issued a memorandum explaining a ruling he had made from the bench on 10 February. He held the documents were protected by neither attorney-client privilege nor work product. His reasoning on privilege had three parts:

• No attorney. "Because Claude is not an attorney," the court wrote, that "alone disposes of Heppner's claim of privilege."
• No confidentiality. The privacy policy users of the tool accept said the vendor collects inputs and outputs and reserves the right to disclose them to third parties, including governmental regulatory authorities. The court said Heppner could have no reasonable expectation of confidentiality.
• No purpose of obtaining legal advice from the tool. He used it of his own volition, and the tool itself disclaims giving legal advice. Sharing the outputs with his lawyers afterward did not change that, because non-privileged communications are not "alchemically changed into privileged ones upon being shared with counsel."

The court left one door open. It wrote that had counsel directed Heppner to use Claude, the tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent." That is a hint and nothing more.

Limits worth keeping in mind: this is one district judge's written opinion in a criminal case, it involved a publicly available AI platform, and it did not decide how enterprise tools with negotiated confidentiality terms would fare. The case went to trial, and the docket's latest entry we saw (11 September 2026) shows post-trial motions pending and sentencing set for 21 October 2026, so we found no appellate treatment of the ruling. Check the docket (No. 1:25-cr-503, S.D.N.Y.) for anything later.

The waiver problem

Here is the part that should worry litigators most. You can lose privilege you already had.

Say a client tells you something in confidence. That communication is privileged. Now you paste it into a public chatbot to draft a memo. In Heppner, the defendant's lawyers argued that some of what he typed into Claude was information he had learned from counsel. In a footnote, Judge Rakoff answered that even if that information had been privileged, he "waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party."

Waiver is rarely the lawyer's intent. It is a side effect of convenience. The faster the tool, the easier it is to forget that the screen is a pipe to someone else's servers.

This is why the safe move is to keep client-identifying facts out of any tool whose terms you have not confirmed. Anonymize first, or use a tool under a contract you have read. We map where those inputs travel in where your legal AI data actually goes.

What about work product?

The work-product doctrine is the natural fallback. It protects documents prepared in anticipation of litigation by or for a party or its representative (Federal Rule of Civil Procedure 26(b)(3)(A)). It is a qualified protection: an opponent can reach ordinary work product by showing substantial need and undue hardship. But even when a court orders discovery of such materials, Rule 26(b)(3)(B) says it "must protect against disclosure of the mental impressions, conclusions, opinions, or legal theories" of the party's attorney or other representative concerning the litigation. So protection for strategy and legal theory is stronger than for ordinary factual material.

Waiver works differently from privilege too. Disclosure to a third party generally waives attorney-client privilege. Many courts hold that it waives work product only if the disclosure goes to an adversary or substantially increases the opportunities for an adversary to get the material. The Ninth Circuit put it that way in United States v. Sanmina Corp., 968 F.3d 1107 (2020), and circuits phrase the test a little differently. The Warner court below applied the Sixth Circuit's version.

Warner v. Gilbarco (E.D. Mich. 10 February 2026)

In Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (ECF No. 94), the defendants asked the court to compel a pro se plaintiff to produce her materials on using third-party AI tools in the case. Magistrate Judge Anthony Patti denied the motion to compel mainly as untimely, and ruled on the AI request in the alternative. He said the information was not discoverable under Rule 26(b)(3)(A), and he found it not relevant or, if marginally relevant, not proportional. Even if it were discoverable, the court said, it would be work product, which a pro se litigant may assert. On waiver, the order says it "has to be a waiver to an adversary or in a way likely to get in an adversary's hand," and that "ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background."

How the two decisions fit

They do not conflict on doctrine. They differ on facts. The Warner plaintiff was the litigant preparing her own case. Heppner was a represented defendant who worked alone, and the court found his documents were not prepared by or at the behest of counsel and did not reflect counsel's strategy when he wrote them. Warner is a magistrate judge's discovery order and Heppner is a single district judge's opinion, so neither binds courts elsewhere. We did not find a later ruling revisiting either one. In Warner, the public docket we saw (through June 2026) shows a Rule 72(a) objection filed in March 2026, but it targets a different order (ECF No. 108, on subpoenas to her medical providers), not ECF No. 94. Check both dockets before you rely on them.

The practical rule: treat work product as a backstop. If you would not email the prompt to opposing counsel, do not assume a doctrine will hide it.

Delete is not always deletion: the OpenAI preservation order

This is the angle most "is ChatGPT private" posts get wrong, often by describing an order that has since ended.

In the copyright litigation brought by The New York Times and other news organizations against OpenAI, the court entered an order on 13 May 2025 (Dkt. 33) directing OpenAI to "preserve and segregate all output log data that would otherwise be deleted on a going forward basis until further order of the Court." According to OpenAI, that covered ChatGPT Free, Plus, Pro and Team and API customers without a Zero Data Retention agreement. It did not cover ChatGPT Enterprise, Edu or Zero Data Retention API use.

That ongoing duty has ended. A Stipulation and Order approved by Magistrate Judge Ona Wang on 9 October 2025 (ECF No. 922 in No. 23-cv-11195, filed in In re OpenAI, Inc. Copyright Infringement Litigation, No. 25-md-3143, S.D.N.Y.) terminated OpenAI's obligation to preserve and segregate new output logs as of 26 September 2025. Three things continue:

• OpenAI keeps the output log data it had already preserved and segregated before 26 September 2025, except data from requests originating in the European Economic Area, Switzerland or the United Kingdom.
• OpenAI keeps preserving new output logs for accounts associated with the domains the news plaintiffs listed.
• The stipulation does not waive anyone's obligations under Federal Rule of Civil Procedure 37(e), and the parties reserved their rights to seek further relief.

OpenAI's own page, updated 22 October 2025, says it is back to its standard practice: deleted ChatGPT conversations and Temporary Chats are automatically deleted from its systems within 30 days. It also says it still securely stores limited historical data from April to September 2025.

So the accurate statement today is narrower than the old one. A chat you delete now should be removed on OpenAI's normal schedule, but a chat from the April to September 2025 window may still sit in litigation storage.

What the logs fight shows about discovery

A later order, issued on 7 November 2025 (Dkt. 734), directed OpenAI to produce a sample of 20 million de-identified consumer ChatGPT logs to the news plaintiffs. On 5 January 2026 District Judge Sidney Stein denied OpenAI's objections and affirmed that order, as Ars Technica reported. The same day the news plaintiffs asked the court to order OpenAI to show cause why it should not be held in contempt over logs they say it deleted or replaced. We did not confirm how that request was resolved, so check the docket (No. 25-md-3143, S.D.N.Y.) before citing it.

What this shows is that chat logs are discoverable in principle. It does not show that your chat will reach your own adversary. Those 20 million logs went to the news plaintiffs, de-identified, in a copyright case. Whether a particular log is reachable depends on what it is, what the subpoena asks for, and any protective order. In the same 5 January 2026 order (ECF No. 1021) Judge Stein said privacy interests in users' ChatGPT conversations, which users voluntarily disclosed to OpenAI and which OpenAI retains in the normal course of its business, are weaker than the interests in wiretapped phone calls. Heppner cites that order for the point that AI users do not have substantial privacy interests in such conversations.

What Sam Altman said

On a July 2025 episode of Theo Von's podcast, Sam Altman said that if you talk to a therapist, lawyer or doctor there is legal privilege, "and we haven't figured that out yet for when you talk to ChatGPT," as quoted by TechCrunch. TechCrunch's reporter added that OpenAI "would be legally required to produce those conversations today" in a lawsuit. That sentence is the reporter's paraphrase, not Altman's words. Altman's own quoted words were that "we should have the same concept of privacy for your conversations with AI that we do with a therapist or whatever." We found no US statute or court rule that creates an AI privilege.

What this means in practice

Put the pieces together and the practical rule is simple. A consumer chatbot is the wrong place for facts you would fight to keep out of discovery.

The risk is the everyday habit of pasting a real clause, a real party name, or a real fact pattern to save ten minutes. That habit creates a record outside your control and may waive a protection your client is counting on.

None of this means lawyers should avoid AI. It means matching the tool to the duty. A general consumer product and a tool under a signed data agreement are different things, even when the underlying model is similar. A business plan does not make the tool your lawyer, though. Whether lawyer-directed use of a confidential enterprise tool stays privileged has not been decided. The companion piece ChatGPT for lawyers covers which tasks are safe and which are not.

How to keep privilege intact while using AI

ABA Formal Opinion 512, issued on 29 July 2024, applies the confidentiality duty under Model Rule 1.6 to generative AI. It says a client's informed consent is required before a lawyer inputs information relating to the representation into a self-learning tool whose output could disclose it, and that merely adding general, boilerplate provisions to engagement letters is not sufficient to get that consent. Use this checklist as a starting point, and follow your own state bar rules.

• Do not paste client-identifying facts into consumer tools. Names, parties, contract terms, and specific facts stay out unless the terms are confirmed.
• Anonymize before you prompt. Strip identifiers and deal-specific details if you must use a general tool.
• Direct the AI use yourself. Heppner's reasoning leaves room for privilege where counsel directs it. A client who experiments alone gets no such argument.
• Use a tool with a written data agreement. A DPA and a no-train clause are contract terms, not a settings toggle. Confirm the current terms yourself.
• Confirm retention and deletion. Ask how long data is kept and whether deletion is real or just hidden from your view.
• Get informed client consent where it is required. Boilerplate in an engagement letter is not enough under ABA 512.
• Do not lean on Rule 502(b). It does not govern a paste into a chatbot.
• Keep a clean record. Note what you put in, which tool, and under what terms, so you can answer if anyone asks later.

The verdict

ChatGPT does not have attorney-client privilege, and it will not get one from a settings change. Privilege flows from a lawyer-client relationship and a duty of confidentiality, and neither exists between a user and a software vendor. Pasting privileged facts into a public tool can waive protection and creates a record outside your control. The one live argument is lawyer-directed use under a confidential contract, and we found no court ruling on it. Even then, privilege depends on how you use the tool.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

FAQ

Does ChatGPT have attorney-client privilege? No. Privilege protects confidential communications between a client and a lawyer for legal advice. A chatbot is not your lawyer. In United States v. Heppner (S.D.N.Y. 17 Feb 2026) the court held a defendant's own chats with a public AI tool were not privileged.

Can pasting privileged information into ChatGPT waive privilege? It can. Heppner treated sharing information with a public AI platform as disclosure to a third party that waived privilege "just as if he had shared it with any other third party." The record there did not address enterprise terms or training opt-outs, so the answer for a tool with a no-training contract is open.

Is my ChatGPT research protected as work product? Sometimes. In Warner v. Gilbarco (E.D. Mich. 10 Feb 2026) a pro se plaintiff's AI use was protected work product, and the court said waiver requires disclosure to an adversary or in a way likely to reach one. In Heppner, a represented defendant's own chats were not work product because they were not prepared by or at the direction of counsel. Rule 26(b)(3)(B) gives extra protection to an attorney's mental impressions and legal theories even when other work product is ordered produced.

Does Federal Rule of Evidence 502(b) protect me if I paste something by mistake? Not on its own terms. Rule 502(b) applies to disclosures made in a federal proceeding or to a federal office or agency. A paste into a chatbot is decided under the ordinary waiver law of the forum.

If I delete a ChatGPT chat, is it gone? Mostly, going forward. A May 2025 order required OpenAI to preserve deleted output logs (for Free, Plus, Pro and Team accounts, according to OpenAI), but a stipulated order approved on 9 October 2025 ended that duty as of 26 September 2025. OpenAI says it deletes deleted chats within 30 days again, but it still holds data it set aside before that date and logs for accounts tied to the domains the news plaintiffs listed.

Is there an "AI privilege"? We found none in US statutes or court rules. Altman said he thinks conversations with AI should have "the same concept of privacy" as conversations with a therapist, but that is a view, not a rule. Current chats are not privileged.

Can opposing counsel get my ChatGPT logs in discovery? If the logs exist and are relevant, they can be reachable through a subpoena or court order. In NYT v. OpenAI a court ordered 20 million de-identified consumer logs produced to the news plaintiffs. That shows logs are discoverable in principle, not that your own chat will be produced to your adversary.

Does using ChatGPT Enterprise create privilege? No. A business plan does not make the tool your lawyer. Better data terms reduce training and retention risk. Whether lawyer-directed use of a confidential enterprise tool stays privileged is not yet decided.

How do I use AI without risking privilege? Keep client-identifying facts out of consumer tools and anonymize when you can. Direct the use yourself, use a tool under a written data agreement, and get informed client consent where ABA Formal Opinion 512 requires it.

Sources

• United States v. Heppner, No. 25 Cr. 503 (JSR), ECF No. 27 (S.D.N.Y. Feb. 17, 2026) (CourtListener RECAP)
• Warner v. Gilbarco, Inc., No. 2:24-cv-12333, ECF No. 94 (E.D. Mich. Feb. 10, 2026) (CourtListener RECAP)
• Stipulation and Order to terminate OpenAI's ongoing obligations under the preservation order at ECF 33, ECF No. 922 in No. 23-cv-11195 (Oct. 9, 2025) (CourtListener RECAP, In re OpenAI, Inc. Copyright Infringement Litigation)
• Order denying OpenAI's objections, In re OpenAI, Inc. Copyright Infringement Litigation, No. 25-md-3143, ECF No. 1021 (Jan. 5, 2026) (CourtListener RECAP)
• News Plaintiffs letter quoting the May 13 Preservation Order and Production Order (Jan. 5, 2026) (CourtListener RECAP)
• How we're responding to The New York Times' data demands (OpenAI, June 2025, updated October 22, 2025)
• OpenAI privacy policy (updated April 30, 2026)
• News orgs win fight to access 20M ChatGPT logs. Now they want more. (Ars Technica, January 6, 2026)
• Sam Altman warns there's no legal confidentiality when using ChatGPT as a therapist (TechCrunch, July 25, 2025)
• Federal Rule of Evidence 502 and Federal Rule of Civil Procedure 26 (Cornell LII)
• United States v. Sanmina Corp., 968 F.3d 1107 (9th Cir. 2020) (FindLaw)
• ABA Formal Opinion 512, Generative Artificial Intelligence Tools (American Bar Association, July 29, 2024)

Last updated: 11 October 2026.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.