Is Claude Private for Legal Work?

It depends on which Claude you mean. A personal Free, Pro or Max account is not the setup to use for client-confidential work. Anthropic's Consumer Terms say it may use your chats to train its models unless you opt out in your settings, and if you allow training it may keep de-identified data for up to five years. Claude for Work (the Team and Enterprise plans) and the Anthropic API run under Commercial Terms, and Anthropic's pages say it does not train on that content by default. Even then, the contract does not settle your ethics duties. ABA Formal Opinion 512 still expects you to read the terms, assess the risk and get informed client consent where it applies.

Reviewed and corrected on 12 October 2026. Vendor facts below come from the Anthropic pages named in the sources, as read on 12 October 2026. Anthropic changes its terms, so check those pages before relying on this. This is general information, not legal advice.

TL;DR

• Consumer Claude can train on your chats. Anthropic's Consumer Terms say it may use your Materials to train its models "unless you opt out of training through your account settings." This applies to Free, Pro and Max, including Claude Code used from those accounts.
• Allowing training lengthens retention. If you allow it, Anthropic's retention page says it may keep your data in a de-identified format for up to five years in its training pipelines.
• Opting out is not total erasure. Even if you opt out, Anthropic says it will use Materials for training when you submit feedback or when they are flagged for safety review, and chats flagged as violating its Usage Policy can be kept for up to two years.
• Team, Enterprise and the API are under a different contract. Anthropic's Commercial Terms say it "may not train models on Customer Content from Services," and a data processing addendum is incorporated automatically.
• Zero data retention is narrow. Anthropic describes it for eligible API use and Claude Code on Enterprise plans, subject to Anthropic's approval. It does not describe it as a setting for everyday Team or Enterprise chat.
• A court has already read Anthropic's privacy policy against a user. In United States v. Heppner a judge held a defendant's chats with Claude were not privileged, partly because of what the privacy policy told users.

The Claudes are not the same product

People say "Claude" as if it were one thing. For confidentiality it is at least two products with different promises.

• Consumer Claude. The Free, Pro and Max plans, including Claude Code used from those accounts. Governed by the Consumer Terms and the Privacy Policy.
• Commercial Claude. Claude for Work (which Anthropic says includes its Team and Enterprise plans), Claude for Government and Education, and the Anthropic API. Governed by the Commercial Terms.

A lawyer who signs up with a personal email is on the first one. Anthropic's Privacy Center also says that if you reach Claude through a third-party platform or service provider, the third party's terms of service govern that use (Privacy Center, DPA article).

What changed in August 2025

On 28 August 2025 Anthropic announced updates to its Consumer Terms and Privacy Policy. It said it was "giving users the choice to allow their data to be used to improve Claude," and that the updates apply to Free, Pro and Max plans, including Claude Code from those accounts. They "do not apply to services under our Commercial Terms, including Claude for Work, Claude for Government, Claude for Education, or API use" (including through Amazon Bedrock and Google Cloud's Vertex AI). The Consumer Terms in force today took effect on 8 October 2025.

Anthropic's announcement made these points (Updates to Consumer Terms and Privacy Policy):

• New users choose at signup. Existing users had until 8 October 2025 to make a choice and, after that date, had to select a preference to keep using Claude.
• Allowing training extends retention to five years. "We are also extending data retention to five years, if you allow us to use your data for model training." If you do not, "you'll continue with our existing 30-day data retention period."
• The setting is not retroactive. It applies to new or resumed chats and coding sessions.

The announcement describes a choice. The Privacy Policy now in force (effective 10 September 2026) lists, among the sources of model-training data, "Inputs and Outputs from our Services (unless users opt out)," so the written terms are an opt-out. The pages we read do not say how the toggle is preset for each user, so check your own account's Privacy Settings.

What Anthropic's pages say about consumer Claude

• Training. Consumer Terms section 4 says Anthropic may use Materials "including training our models, unless you opt out of training through your account settings." The Privacy Center article for consumer products (updated 16 March 2026) says it will use your chats and coding sessions to improve its models if you choose to allow it, if a conversation is flagged for safety review, or if you otherwise explicitly opt in to training. Incognito chats are not used to improve Claude, even if the setting is on.
• Retention. Anthropic's retention page for consumer products (1 July 2026) says deleting a conversation removes it from your history immediately and from back-end storage within 30 days. If you allow model improvement it may keep your data "in a de-identified format for up to 5 years in our model training pipelines." Feedback you submit is kept for 5 years.
• Flagged content. If a chat is flagged by its automated systems as violating the Usage Policy, Anthropic says it retains inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years.
• Disclosure. The Privacy Policy says Anthropic may share personal data with government authorities, law enforcement or other third parties where it has a good-faith belief that disclosure is reasonably necessary to "comply with applicable law, regulation or legal process, including for legal, tax or accounting purposes, or in response to an enforceable governmental request."

Consumer Claude and Team, Enterprise and API compared

This table is the short version of Anthropic's own pages, as read on 12 October 2026. Confirm the current terms yourself, since vendor policies move, as this one did in 2025.

Two traps. First, a personal account is the path of least resistance. Second, an opt-out is a setting. A signed commercial agreement is something you can point to if a client or regulator asks how the data was handled.

What Anthropic says about Team, Enterprise and the API

The commercial side reads differently because it is a different contract. Section B of the Commercial Terms (effective 17 June 2025) says that as between the parties the customer retains rights to its Inputs and owns its Outputs, that Anthropic "disclaims any rights it receives to the Customer Content," and that "Anthropic may not train models on Customer Content from Services." Section C says data is processed under Anthropic's Data Processing Addendum, which is incorporated by reference (Commercial Terms). The Privacy Center says accepting the Commercial Terms also accepts the DPA.

Some details a lawyer should know:

• Who can see chats inside your firm. Anthropic says the organization's Primary Owner can export user data, which may include conversations, uploaded files and usage patterns. Its help center says incognito chats on Team and Enterprise plans are included in organizational exports and are retained for 30 days for safety or longer under the organization's policy.
• Retention is partly yours to set. On Enterprise plans an Owner can set custom retention periods with a minimum of 30 days. By default data is retained indefinitely unless a period is set, and projects follow their own retention period.
• Zero data retention is narrow. Anthropic's zero data retention article says some Claude Platform (API) and Claude Code for Enterprise customers, "subject to Anthropic's approval," may have arrangements under which it does not store inputs or outputs except where needed to comply with law or combat misuse. It says Anthropic still retains User Safety classifier results, that the arrangements are reviewed per organization, and that the only products they apply to are eligible APIs, products using your commercial organization API key, and Claude Code on Enterprise plans.
• Covered models. Anthropic's "covered models" article (5 September 2026) says that for models it designates as covered, prompts and outputs are retained for 30 days to support its safety work, including for organizations that otherwise use zero data retention. It says the policy took effect on 9 June 2026. Check whether the model you use is designated.
• Government requests. Anthropic's policy page (16 March 2026) says it does not disclose information about customers or end users in response to government requests except under valid legal process such as a subpoena or warrant, and that where data is sought on an API or enterprise customer it will generally ask the requester to contact the customer first.
• Certifications. The Privacy Center lists ISO 27001:2022, ISO/IEC 42001:2023 and SOC 2 Type I and Type II for its commercial products and points to its Trust Portal for the documents. Ask for the report and read it.

The protections attach to the commercial products under their terms. A personal login does not carry them. Read your own agreement, confirm whether any zero retention arrangement applies to you, and check the admin settings your team has chosen. For a wider look at what Claude can do on legal tasks, see our guide to Claude for legal work.

What a court did with Claude's privacy policy: Heppner

In United States v. Heppner (S.D.N.Y., 17 February 2026), Judge Jed Rakoff held that a defendant's written exchanges with Claude, which the court called a publicly available AI platform, were protected by neither attorney-client privilege nor the work product doctrine. On confidentiality, the court relied on Anthropic's Privacy Policy as of 19 February 2025. It said that policy provides that Anthropic collects data on users' inputs and Claude's outputs, uses it to train Claude, and reserves the right to disclose it to third parties, including "governmental regulatory authorities." The court said the defendant could have had no reasonable expectation of confidentiality (memorandum, ECF No. 27).

This does not settle how a business plan would fare. The privacy policy the court read is from February 2025, six months before Anthropic's consumer update, and the opinion never mentions Team, Enterprise or API terms. The court did leave a door ajar on a different point: if counsel had told the defendant to use Claude, the court wrote, the tool might arguably be treated like "a highly trained professional who may act as a lawyer's agent." The court did not decide that. For the privilege analysis in full, see does ChatGPT have attorney-client privilege.

A second federal order points the same direction on contracts. In Morgan v. V2X (D. Colo., 30 March 2026) a magistrate judge amended a protective order to bar inputting confidential information into any AI platform unless the provider is contractually prohibited from storing or using inputs to train its model and from disclosing inputs to third parties (except where essential to delivering the service), and the provider must let the user delete the information on request (order). The order was tailored to that case and applies to no one else.

Safe and unsafe lawyer uses, tied to confidentiality

The duty of confidentiality under Model Rule 1.6 does not pause for a new tool. ABA Formal Opinion 512 (29 July 2024) applies it to generative AI. It says that because many self-learning tools are designed so that their output could lead directly or indirectly to disclosure of information relating to a representation, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool," and that "merely adding general, boiler-plate provisions to engagement letters" is not sufficient. As a baseline it says lawyers "should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use." It also says consent is not required where the lawyer does not input information relating to the representation, for example when using a tool for idea generation. The opinion applies the ABA Model Rules, so your state's rules and ethics opinions control in practice. See our ABA Formal Opinion 512 guide.

Mapped to consumer Claude:

Reasonable on consumer Claude (no client confidences):

• Drafting a plain-English explainer of a public legal concept.
• Rewriting or shortening text that carries no client or matter detail.
• Brainstorming a deposition outline using hypothetical, anonymized facts.
• Summarizing a published statute or a public court opinion.

Not appropriate on consumer Claude:

• Pasting a client contract, term sheet or settlement figure.
• Entering names, parties or any detail that identifies a matter.
• Uploading privileged communications or attorney work product.
• Running anything you would not want kept for years or reviewed if flagged.

The dividing line is simple. If keeping or reviewing it would breach a confidence, it does not belong in consumer Claude. On Claude for Work or the API the calculus changes, but you still read the agreement and match the tool to the sensitivity of the matter.

The verdict

Consumer Claude on a personal account is not the setup to use for client-confidential work. Anthropic's Consumer Terms let it use your chats for training unless you opt out, and allowing that lets it keep de-identified data for up to five years. Opting out narrows the exposure but leaves feedback and safety-flagged content, which can be kept for up to two years. Claude for Work and the API sit under Commercial Terms that say Anthropic may not train on customer content, with a DPA incorporated and the customer as controller. That is a real difference, but it is conditional. The protection lives in the commercial agreement and the admin settings, and zero data retention is a narrow arrangement that Anthropic approves case by case. Confirm which product you are on, read the current terms, and handle client consent under ABA 512.

The same plan-versus-terms split shows up with other tools. See our guides on whether ChatGPT is confidential for legal work, whether Copilot is private for legal work and whether Gemini is private for legal work. For task selection across tools, see the best legal AI tools for in-house counsel.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

FAQ

Is Claude private for legal work? Not on a personal account. Anthropic's Consumer Terms say it may use your chats for training unless you opt out, and if you allow training it may keep de-identified data for up to five years. Claude for Work and the API run under Commercial Terms that say Anthropic may not train on customer content.

Does Claude train on what I type? On consumer Claude (Free, Pro, Max), Anthropic's Privacy Policy lists inputs and outputs among its training data "unless users opt out," and its Consumer Terms say the same for Materials, with exceptions for feedback and safety-flagged content that apply even after you opt out. Incognito chats are not used to improve Claude. On commercial products Anthropic says it does not train on your inputs or outputs by default.

What changed with Claude in August 2025? On 28 August 2025 Anthropic announced updated Consumer Terms and Privacy Policy for Free, Pro and Max. Users choose whether to allow their chats to be used to improve Claude. Allowing it extends retention to five years, and not allowing it keeps the existing 30-day retention period. Commercial services were not affected.

How long does Claude keep my conversations? On consumer plans, deleted chats leave back-end storage within 30 days, and if you allow training Anthropic may keep de-identified data for up to five years. Flagged chats can be kept up to two years. On the API, inputs and outputs are deleted within 30 days with exceptions. On Team and Enterprise, chats stay in the product until deleted, and Enterprise can set a retention period of at least 30 days.

If I opt out of training, is my Claude data safe? Opting out helps but is not total erasure. Anthropic says feedback and conversations flagged for safety review can still be used, and your data stays in training that has already started and in models already trained.

Is Claude for Work or Enterprise safe for client data? It is built on different terms: no training on customer content under the Commercial Terms, a DPA incorporated, and the customer as controller. You still read your agreement, check the admin controls, and decide under ABA 512 whether client consent is needed. A Primary Owner can export user data that may include conversations.

Does the Anthropic API train on my data? By default, no. Anthropic's Privacy Center says it will not use inputs or outputs from its commercial products to train its models by default, unless you explicitly submit feedback or otherwise choose to allow it. If you reach Claude through a third-party platform, Anthropic's Privacy Center says that platform's terms govern.

Does Anthropic have zero data retention? Anthropic describes zero data retention arrangements for some API and Claude Code on Enterprise customers, subject to its approval. It still retains safety classifier results, and it says that for designated covered models it requires 30-day retention of prompts and outputs.

Can I use Claude and stay compliant with ABA 512? With care. You must read and understand the tool's terms, evaluate the risk, and get the client's informed consent before inputting information relating to the representation into a self-learning tool that could expose it. A boilerplate clause in an engagement letter is not enough. Your state's rules also apply.

Sources

All Anthropic pages read on 12 October 2026.

• Updates to Consumer Terms and Privacy Policy (Anthropic, 28 August 2025)
• Anthropic Privacy Policy (effective 10 September 2026) and Consumer Terms of Service (effective 8 October 2025)
• Commercial Terms of Service (effective 17 June 2025)
• Anthropic Privacy Center, consumer: Is my data used for model training? (16 March 2026), How long do you store my data? (1 July 2026), How do I change my model improvement privacy settings? (3 August 2026)
• Anthropic Privacy Center, commercial: Is my data used for model training? (18 August 2026), How long do you store my organization's data? (1 July 2026), zero data retention agreement, custom data retention for Enterprise plans, Data retention practices for Covered Models (5 September 2026), Data Processing Addendum (16 March 2026), processor or controller (16 March 2026), who owns and manages the data of my team (16 March 2026), governmental requests (16 March 2026), certifications (16 March 2026)
• Use incognito chats (Claude Help Center)
• United States v. Heppner, No. 25 Cr. 503 (JSR), ECF No. 27 (S.D.N.Y. 17 February 2026) and Anthropic Privacy Policy, effective 19 February 2025 (archived)
• Morgan v. V2X, Inc., No. 25-cv-01991, Doc. 65 (D. Colo. 30 March 2026)
• ABA Formal Opinion 512, Generative Artificial Intelligence Tools (American Bar Association, 29 July 2024)

Last updated: 12 October 2026.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.