Is ChatGPT Confidential for Legal Work? (2026)

It depends on which plan you are on, and even the best plan does not settle the question by itself. ChatGPT on a consumer tier (Free, Plus, or Pro) is not built for legal confidentiality by default: OpenAI's help page says data sharing for training is on by default for those plans unless you opt out. For ChatGPT Business (the plan formerly called ChatGPT Team) and ChatGPT Enterprise, OpenAI says it does not use your inputs and outputs to train its models by default. That lowers one risk. It does not decide whether you may put client confidences into the tool. ABA Formal Opinion 512 tells lawyers to read a tool's terms of use and privacy policy, and says a client's informed consent is required before you input information relating to the representation into a self-learning tool. This is general information, not legal advice.

Reviewed and corrected on 11 October 2026. OpenAI's plans and terms change, so check the pages linked below before relying on any of this.

TL;DR

• Consumer ChatGPT is not confidential by default. For Free, Plus, and Pro, OpenAI says data sharing for training is on by default and you can opt out in settings. Pro is grouped with Plus and Free, not with the business plans.
• Business and Enterprise differ on training. OpenAI says it does not train on ChatGPT Business, Enterprise or Edu content by default (OpenAI help page), and that it can sign a data processing addendum for Business, Enterprise and the API (OpenAI enterprise privacy page).
• A no-train default is not the whole analysis. Under ABA 512 you still read the terms, assess the risk, and get informed client consent where you input client information into a tool that could expose it. Boilerplate in an engagement letter is not enough.
• Retention can be overridden by a court. From May to September 2025 a federal court order required OpenAI to preserve chats on consumer and Team plans that would otherwise have been deleted. OpenAI said Enterprise and Edu were not affected.
• Courts do not treat chatbot conversations as automatically private. In United States v. Heppner (S.D.N.Y. Feb. 17, 2026), a judge held a defendant's chats with an AI platform were not covered by attorney-client privilege or work product.
• When in doubt, do not paste. Anonymize, use a plan with a written data agreement, or leave client facts out of the prompt.

What "confidential" actually means for legal AI

Lawyers throw the word "confidential" at a tool and expect it to mean one thing. It is really a stack of separate guarantees, and a tool can pass one and fail the others.

• No training on your inputs. Your prompts and documents are not fed back into the model.
• Encryption in transit and at rest, so data is protected on the wire and on disk.
• Access control. Only authorized people in your org can see the data, with admin oversight.
• Retention limits. Data is deleted on a clear schedule, not kept forever (subject to legal holds and court orders).
• A written data agreement, typically a DPA, so the commitment is contractual and not a blog promise.

"Is ChatGPT confidential" really means "does the plan I am on deliver all five, and do I have the client's consent where 512 calls for it." For most consumer use, the honest answer is no.

Consumer vs Business vs Enterprise: the split that matters

OpenAI's consumer terms and its business terms are different products. This is the most important distinction for a lawyer.

Sources: OpenAI's help page on model training, its enterprise privacy page (updated January 8, 2026) and its ChatGPT Business rename FAQ, which says the Team plan was renamed ChatGPT Business as of August 29, 2025.

Two traps to flag. First, Pro is a consumer plan. OpenAI's help page lists Plus, Pro and Free together as plans where data sharing is on by default, so the higher price does not buy business data terms. Second, turning off training in consumer settings is a setting and not a contract. It can change, and it does not give you a signed commitment. Always confirm the current terms directly, because vendor policies move.

For the broader map of where your inputs travel across any legal AI tool, see where your legal AI data actually goes.

The training-on-inputs risk, concretely

Why does training matter so much for a lawyer? Because if a tool learns from your inputs, a client confidence you pasted could, in principle, surface or influence a later output to someone else. ABA Formal Opinion 512 raises exactly this concern for self-learning tools. It says that many of today's self-learning tools are designed so that their output could lead directly or indirectly to the disclosure of information relating to the representation of a client.

Even if the odds of a specific leak are low, the duty of confidentiality is not a probability game. You either control where the data goes or you do not.

This is also why a vendor's no-train claim is worth verifying rather than trusting on faith. We walk through how to check one in we do not train on your data: how to verify it.

What ABA Formal Opinion 512 requires

The confidentiality duty under Model Rule 1.6 does not pause for new technology. ABA Formal Opinion 512, issued July 29, 2024, applies it to generative AI directly.

Three points matter most for a ChatGPT decision.

• Read the terms. The opinion says that as a baseline, all lawyers should read and understand the terms of use, privacy policy, and related contractual terms of any generative AI tool they use, to learn who has access to the information they input, or consult a colleague or outside expert who has.
• Informed consent for self-learning tools. Because many self-learning tools can disclose what you input, it says a client's informed consent is required before inputting information relating to the representation into one. Merely adding general, boilerplate provisions to engagement letters is not sufficient.
• No consent when nothing about the matter goes in. The opinion notes that where a lawyer does not input information relating to the representation, for example when using a tool only for idea generation, client informed consent is not required.

Whether a given ChatGPT plan counts as a tool that could expose the information is a judgment about its terms, and 512 leaves it to you. Our ABA Formal Opinion 512 guide covers the full set of duties. Check your own state bar too, since several have issued their own AI guidance.

Retention and deletion: what OpenAI says, and what a court can override

OpenAI describes its retention practices in several places, and they differ by plan.

• Consumer plans. OpenAI says that when you delete a chat, it is removed from your account immediately and scheduled for permanent deletion from its systems within 30 days, unless it is required to retain it for legal or security reasons (OpenAI, "How we're responding to The New York Times' data demands"). Temporary Chats are deleted after 30 days, are not used to train its models, and may be reviewed only to monitor for abuse (OpenAI Data Controls FAQ).
• Business and Enterprise. OpenAI's enterprise privacy page says workspace admins can control how long data is retained (its Business FAQ says so, although the summary list of commitments names only Enterprise, Healthcare and Edu for retention control, and OpenAI's June 2025 page described Team differently, so check your own workspace settings), and that deleted conversations are removed from its systems within 30 days unless it is legally required to retain them (for Business, also if longer retention is reasonably necessary to protect its services or others from harm). It also says Business workspace admins can view, access, export and delete end-user conversations in the workspace. If your firm sets up a Business account, someone at the firm can read what the lawyers type.

Those are policies. A court order can override them, and in 2025 one did.

The 2025 preservation order

On May 13, 2025, a federal court in the consolidated copyright litigation against OpenAI in the Southern District of New York entered an order (ECF 551 in No. 23-cv-11195) directing OpenAI to "preserve and segregate all output log data that would otherwise be deleted on a going forward basis," whether the deletion would happen at a user's request or because of privacy laws.

OpenAI said the order affected ChatGPT Free, Plus, Pro and Team subscribers and API customers without a zero data retention agreement. It said ChatGPT Enterprise and Edu customers were not affected.

The order did not last. In a stipulation and order entered October 9, 2025 (ECF 922 in the same case), the court ended OpenAI's going-forward obligation to preserve and segregate that data as of September 26, 2025. OpenAI must keep the data it had already segregated before that date, except data from users in the European Economic Area, Switzerland and the United Kingdom, and it must keep preserving data for accounts tied to a list of domains the news plaintiffs identified.

OpenAI says it has returned to its standard 30-day deletion practices. It also says it is securely storing limited historical April to September 2025 user data, accessible only to a small, audited legal and security team, and that the data will not be turned over to the New York Times, the court or anyone else at this time (OpenAI's page, updated October 22, 2025).

The lesson for a lawyer is practical. Deleting a chat does not guarantee it is gone, and the plan you are on decided whether your chats were swept into the order. Treat anything you type into a consumer tool as something that could be preserved, produced or disclosed later.

When a court looks at your chatbot history: United States v. Heppner

Confidentiality has a second legal meaning: whether your conversations are privileged if someone asks for them. On February 17, 2026, Judge Jed Rakoff of the Southern District of New York issued a memorandum (ECF 27) in United States v. Heppner, No. 25 Cr. 503 (JSR). He described it as answering a question of first impression nationwide: whether a user's communications with a publicly available AI platform, in connection with a pending criminal investigation, are protected by the attorney-client privilege or the work product doctrine. His answer was no.

The defendant had used Claude, a platform operated by Anthropic, to prepare reports about defense strategy. His lawyers conceded they had not directed him to do so. The court gave three reasons for finding no privilege:

• The exchanges were not communications with a lawyer, and the platform is not an attorney.
• They were not confidential. The court pointed to the platform's written privacy policy, which said the company collects users' inputs and outputs, uses such data to train its model, and reserves the right to disclose data to third parties, including governmental regulatory authorities.
• He did not use the platform to obtain legal advice from it, and the platform itself disclaims giving legal advice. The court added that if counsel had directed him to use it, the platform might arguably be said to have functioned like a trained professional acting as the lawyer's agent. It also held that sending the outputs to his lawyer afterward did not help, because "non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel."

Keep the limits in view. This is one district court's ruling in a criminal case about a defendant acting on his own with a publicly available AI platform. It does not address ChatGPT, business plans, or a lawyer's ethical duties. What it shows is the mechanism: a vendor's written terms on collection, training and disclosure can be used to argue that a user had no expectation of confidentiality. That is one more reason to read the terms before you paste anything, and to prefer an arrangement with a written data agreement over a click-through.

Why the consumer default is the actual risk

The consumer tier is the path of least resistance. A lawyer signs up with a personal email, lands on Free or Plus, and starts pasting. Nobody read a contract.

Three things separate the consumer tiers (Free, Plus, Pro) from the business tiers (Business, Enterprise), and each one matters for client data.

• Training use. On consumer plans your inputs may be used to improve the models unless you turn that off in settings. On Business and Enterprise, OpenAI says it does not train on that content by default. Confirm the current setting and policy yourself, because both can change and a default is not a promise.
• Retention and access. Consumer deletion is a user action governed by OpenAI's policy, which is subject to legal and security holds. For Business and Enterprise, OpenAI's enterprise privacy page says workspace admins can control retention (check your own workspace settings), and Business admins can also access end-user conversations.
• A data agreement. OpenAI says it can execute a data processing addendum for ChatGPT Business, ChatGPT Enterprise and the API, and does not list consumer plans among them. Without a written agreement you are relying on a policy page.

The Pro plan deserves its own warning because the price misleads people. Pro is expensive, so lawyers assume it carries business protections. OpenAI's help page groups it with Plus and Free.

What to demand in an AI vendor's DPA and subprocessor list

Before any client or matter data goes into a tool, the data agreement is the document that turns vendor promises into something enforceable. You do not need to be a privacy specialist to read one. You need to confirm a handful of terms are present and say what you expect.

• A no-train clause in writing. The agreement should state plainly that your content is not used to train or improve the vendor's models. A toggle in settings is not this.
• A defined retention and deletion term. The DPA should say how long data is kept and commit to deletion on request or on termination. Ask what happens if a court orders preservation.
• A current subprocessor list. Most AI tools route data to other providers: a model host, cloud infrastructure, sometimes analytics. The vendor should publish who those subprocessors are and commit to notifying you before adding new ones.
• Security and breach-notification terms. Encryption in transit and at rest, access controls, and a commitment to notify you within a defined window if there is a breach.
• Confidentiality and use-limitation language. The vendor should be contractually barred from using your data beyond delivering the service. Watch for broad "to improve our products" carve-outs.
• Audit or compliance evidence. A SOC 2 report or equivalent, available on request. OpenAI says ChatGPT Business and Enterprise have completed a SOC 2 Type 2 audit and points customers to its trust and security portals. Ask for the report and read it.

The subprocessor list matters more than it looks. A no-train promise from the vendor means little if the underlying model provider has different terms for the same data. Trace the chain: your prompt goes to the tool, the tool sends it to a model host, and the host has its own policy.

A confidentiality checklist before you paste anything sensitive

Run this before a client matter, a draft contract, or any privileged material goes into a chatbot. This is general guidance; your bar rules and your client's instructions control.

• Identify the plan. Are you on a consumer tier (Free, Plus, Pro) or a business tier (Business, Enterprise)? Pro counts as consumer.
• Confirm the training default. Is your content used to train the model? On consumer plans, opt out if you have not.
• Find the written terms. Is there a data agreement or DPA you can actually point to, not just a marketing line?
• Check retention. How long is data kept, can you delete it, and what are the legal-hold and court-order exceptions?
• Check access and encryption. Who in your org can see it (on Business, workspace admins can), and is it encrypted in transit and at rest?
• Match tool to sensitivity. High-stakes or privileged material may need a plan with a written data agreement.
• Handle consent. If you are inputting information relating to a representation into a tool that could expose it, get the client's informed consent. Do not rely on engagement-letter boilerplate.
• Anonymize when unsure. Strip names, identifiers, and deal-specific details if you are on a consumer tier.

A confidentiality checklist for any AI tool

The checklist above is tuned to ChatGPT's plan structure. This shorter one works on any AI product a vendor pitches to your team. Ten minutes here saves a confidentiality problem later.

• Is there a DPA? If the vendor cannot produce a data processing agreement, treat the tool as consumer-grade regardless of price.
• Does it train on my inputs? Find the written commitment, not the settings toggle.
• Who are the subprocessors? Get the list. Confirm the model provider behind the tool has terms that match the vendor's promises.
• What is the retention period? Read the current number, confirm you can delete data, and note any legal-hold exceptions.
• How is data encrypted? In transit and at rest, with access limited to authorized people in your org.
• Is there breach notification? A defined window and a named contact, in writing.
• Does the matter need consent? Where you input information relating to the representation, 512 calls for informed consent. Engagement-letter boilerplate is not enough.
• Can I anonymize instead? If any answer above is shaky, strip identifiers before the data goes in, or do not put it in at all.

When you compare any vendor, ask for the same five things in writing: no training on your inputs, a data processing agreement, encryption, access controls and a retention term. Verify the claims the way you would verify an AI legal citation before filing, and use the steps in we do not train on your data. Our companion guide ChatGPT for lawyers covers the safe tasks and the citation risk.

FAQ

Is ChatGPT confidential for legal work? Not on consumer tiers by default. For Free, Plus, and Pro, OpenAI says data sharing for training is on unless you opt out, and there is no business data agreement. For Business and Enterprise, OpenAI says it does not train on your content by default and can sign a DPA. Even then, ABA 512 asks you to read the terms and get informed client consent before inputting client information into a tool that could expose it.

Does ChatGPT train on what I type? On Free, Plus and Pro, data sharing for training is enabled by default and you can opt out under Settings, Data Controls, "Improve the model for everyone." On Business, Enterprise and Edu, OpenAI says it does not use inputs and outputs to train its models by default (OpenAI help page). Confirm the current terms, since they change.

Is the ChatGPT Pro plan private enough for client data? Pro is grouped with Plus and Free on OpenAI's help page, so the higher price does not buy business data terms. For client-confidential matters, consider a plan with a written data agreement, and anonymize or avoid pasting sensitive material on Pro.

Is ChatGPT Team still a plan? OpenAI renamed ChatGPT Team to ChatGPT Business as of August 29, 2025. OpenAI says it was a name change only and that features, pricing and limits stayed the same (OpenAI rename FAQ).

Can I use ChatGPT and stay compliant with ABA 512? It can be done, but 512 makes it a case-by-case judgment. You need to understand how the tool handles data by reading its terms, decide whether you are inputting information relating to the representation, and if so get the client's informed consent where the tool could expose it. Boilerplate consent in an engagement letter is not enough under the opinion.

Can a court order make OpenAI keep my deleted chats? It happened in 2025. A federal court order in May 2025 required OpenAI to preserve output logs that would otherwise be deleted, including for consumer and Team accounts. OpenAI said Enterprise and Edu were not affected, and the court ended the going-forward obligation as of September 26, 2025, though OpenAI says it still holds limited April to September 2025 data under legal hold.

Are my chats with an AI tool privileged? Not automatically. In United States v. Heppner (S.D.N.Y. Feb. 17, 2026), the court held a defendant's chats with an AI platform were not covered by attorney-client privilege or work product, in part because the platform's privacy policy undercut any expectation of confidentiality. It is one trial-court ruling on specific facts, so ask your own counsel before relying on any tool for privileged work.

Is turning off training the same as a no-train guarantee? No. An opt-out on a consumer plan is a setting that can change. A business plan with a written data agreement gives you a contractual term you can point to, which is what client-confidential work calls for.

What should I never paste into consumer ChatGPT? Avoid client-identifying details, privileged communications, deal-specific terms, and anything covered by a confidentiality obligation, unless you have confirmed the data terms and obtained any required consent. When in doubt, anonymize.

Is a legal-specific AI tool more confidential than ChatGPT? Not automatically. Compare the written terms: a no-training clause, a DPA, a retention term and a subprocessor list. Verify any vendor's claims the way you would verify a citation.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.