Is Perplexity AI Private for Legal Work?

Mostly no on the individual plans, because of the default. Perplexity's help center says AI data retention is enabled by default for Free, Pro and Max accounts, which means your data may be used for AI model training unless you turn the setting off, and the opt-out does not reach back to data already collected. Perplexity also answers questions by searching the web and routing the query to third-party models. For Enterprise, Perplexity says data is never used for AI training, and its agreements with model providers prohibit them from training on it. That still leaves the lawyer's work: read the written terms for your plan, and decide under ABA Formal Opinion 512 whether client information goes in at all. This is general information, not legal advice.

Reviewed and corrected on 12 October 2026. Perplexity changes its plans and terms often, so check the Perplexity pages linked below, which we read on that date, before relying on any of this.

TL;DR

• Free, Pro and Max are not private by default. Perplexity's help center says AI data retention is enabled by default on those plans, and that if the toggle is on your data is being collected for AI training (Data Collection at Perplexity, last updated July 16, 2026).
• The opt-out is partial. Per the same page, opt-outs apply only to data collected after the opt-out date, and previously collected training data cannot be deleted or removed.
• It is a search product, not just a chatbot. Perplexity's third-party models page says that depending on your plan and query, the service may use models from OpenAI, Anthropic, Google, xAI and its own Sonar models.
• Enterprise is the business contract. Perplexity says Enterprise data is never used for AI training, uploaded files are retained for 7 days, and its agreements with AI providers prohibit training on your data. Its Enterprise page says it is SOC 2 Type II certified.
• The API is separate. Perplexity's API documentation states a Zero Data Retention policy for the Chat Completions API.
• ABA 512 sets the bar. Read the tool's terms. Informed client consent is required before you input information relating to the representation into a self-learning tool, and boilerplate in an engagement letter is not enough.

Why Perplexity is a different question than ChatGPT

Most "is this AI private" guides treat every tool the same. Perplexity is not the same, and the difference matters for a lawyer.

ChatGPT and Claude are mainly chat tools. We cover those in is ChatGPT confidential for legal work and Claude for legal work. The plan-tier logic there still applies here, so we will not restate it.

Perplexity is an answer engine. Its Enterprise page describes finding sources on the web and returning answers with citations. Perplexity's Third-Party Models & Terms page (last updated November 25, 2025) lists models from OpenAI (also through Microsoft Azure), Anthropic (also through Google and Amazon Web Services), Google, and xAI, plus Sonar, which it says is based on Meta's Llama 3.1 70B and fine-tuned and operated by Perplexity. It adds that, depending on your plan and query, the service may use some, all or none of them. So your query can reach more than one company's models.

The structural wrinkle: your query goes places

Think of Perplexity as a discovery tool: it helps you find and frame public information. A privileged analysis belongs somewhere with a controlled set of legal sources and written confidentiality terms for client data.

Perplexity states that its agreements with third-party model providers prohibit them from using Perplexity data to train their models: "No, Perplexity's agreements with third party model providers like OpenAI and Anthropic prohibit using Perplexity data for training their models" (Are third-party model providers training on my data?, last modified September 14, 2026). That is a real protection. It is also a promise about other companies' handling that you cannot audit directly.

We could not find a Perplexity page that says whether text you type is used to build outbound web searches or what, if anything, those searches expose. Not verified in our October 2026 review. Ask Perplexity in writing before you put client facts into the search box.

Free vs Pro vs Max vs Enterprise: the split that decides everything

Perplexity's help center separates Free, Pro and Max users from Enterprise users. Here is how it describes each, as of 12 October 2026. Confirm the current terms yourself, because vendor policies change.

Sources: Data Collection at Perplexity (July 16, 2026), Data retention and privacy for Enterprise organizations (October 5, 2026) and the Perplexity Privacy Notice (July 8, 2026).

Two traps. First, Pro and Max are individual plans on the same default as Free, so the higher price does not buy business data terms. Second, the toggle is a setting and not a signed no-train contract, and it covers only data collected after you change it. If a subscription lapses or you downgrade from Enterprise, Perplexity says your data follows the standard policy and you would need to opt out yourself.

The Perplexity Privacy Notice says it does not apply to data collected through Perplexity's Enterprise and API offerings, where Perplexity acts as a service provider or processor. Perplexity's Data Processing Addendum says it is part of agreements with business customers, including the Perplexity Pro for Enterprise Terms of Service and the API Terms of Service.

For where inputs travel across any legal AI tool, see where your legal AI data actually goes.

The training default, concretely

Why does the default matter so much? Because if a tool can learn from your inputs, a confidence you pasted could in principle come back in someone else's output. ABA Formal Opinion 512 raises this for self-learning tools: information relating to one client's representation, once input, can later be revealed in response to prompts by lawyers working on other matters.

On Free, Pro and Max, Perplexity's help center says AI data retention is on by default and that the toggle controls whether your data is used for AI model training. The opt-out helps going forward and is weaker than a contractual no-train term.

This is also why a vendor's no-train claim is worth checking rather than trusting. We walk through how in we do not train on your data: how to verify it.

What Enterprise changes, and what it does not

Enterprise is the version with business data terms. Perplexity's help center says Enterprise data is never used for AI training, that Enterprise Pro and Enterprise Max users get uploaded-file retention of 7 days, and that it has Zero Data Retention and Zero Data Training agreements with AI providers (OpenAI, Anthropic and more) that prevent training on Enterprise data. Its Enterprise page says Perplexity is SOC 2 Type II certified and that Enterprise includes SSO, SCIM and audit logs. Its API documentation separately states a Zero Data Retention policy for the Chat Completions API, with only billing metrics such as token counts and timestamps collected (Privacy & Security).

Perplexity's own pages do not line up on file deletion. The help center says uploaded files are retained for 7 days, while the Enterprise marketing page describes "configurable file retention" with automatic file deletion "up to 1 day." Treat the written contract as the answer, not either page.

That is a real shift in posture, because these are terms written for an organization. It does not remove your duty to read them. The firm still has to confirm the no-train clause, the retention schedule and the subprocessor list, and that the third-party model providers are bound to match those terms.

Confidentiality due-diligence checklist

Run this before Enterprise touches a client matter. A no-train statement is the start, not the finish. Send these as written questions to Perplexity sales and keep the answers.

Questions to ask sales:

• Do the Zero Data Retention and Zero Data Training agreements with model providers apply to every model your plan can route to, and can we see them?
• Which model providers see our queries, and are they named in a current subprocessor list (the Trust Center says one is available)?
• Are prompts logged for abuse or safety review, and for how long? The help pages we read do not say.
• Are web searches generated from our queries logged or shared anywhere?
• Does our seat count qualify for custom retention periods (50 or more Enterprise Pro seats, or one Enterprise Max seat, per the help center), and which retention is in our contract: 7 days for uploaded files, or something else?

Contract clauses to request:

• A written no-train clause covering Perplexity and all downstream model providers.
• A defined retention and deletion term, with deletion on request and on termination.
• A subprocessor list with advance notice before any new provider is added.
• Breach notification within a stated window, plus SOC 2 Type II evidence on request.
• A use-limitation clause barring use beyond delivering the service, with no broad "to improve our products" carve-outs.

To document client consent:

• Record which tool, which plan, and which data terms applied at the time of consent.
• Get specific, informed consent for the matter, not engagement-letter boilerplate, where information relating to the representation will be input.
• Note the date, the client contact, and the version of the data agreement you relied on.

Safe vs unsafe uses for lawyers

Perplexity is useful for public-source research. The line is whether the input carries client information. ABA Formal Opinion 512, an advisory ethics opinion, says lawyers should read and understand a tool's terms of use and privacy policy. It says informed consent is required before inputting information relating to the representation into a self-learning tool, and not required where the lawyer inputs no such information, for example idea generation that uses no client facts.

Reasonably safe on an individual plan (no client information):

• Researching a public legal concept or general statutory background, with citations to chase down.
• Finding public secondary sources, news or regulator pages on a topic.
• Locating a published court opinion or public filing, then reading it at the source.
• Drafting generic, non-client language such as a definition or a neutral explainer.

Unsafe unless terms and consent are confirmed:

• Pasting client names, deal terms or matter facts into the search box.
• Entering privileged communications or anything under a confidentiality obligation.
• Uploading client documents, contracts or sensitive files on an individual plan.
• Treating a Pro or Max subscription as if it carried business data protections.

The reliable move is to anonymize. Strip identifiers and deal-specific details before you research, and keep the privileged work in a tool whose terms are written for client data. Any cited answer also needs verification at the primary source: open the cited page and confirm it supports the statement. Confidentiality and accuracy are separate problems.

The verdict

Perplexity is built for cited research on public sources. On Free, Pro and Max, the training default and the route to third-party models make it a poor place to paste privileged facts, and the opt-out does not reach data already collected. Enterprise comes with a no-training statement, provider agreements and a defined file-retention schedule, but the firm still has to verify those terms in writing. Keep individual-plan use to public, anonymized research. For the wider buyer's view, see our roundup of the best legal AI tools for in-house counsel.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

FAQ

Is Perplexity AI private for legal work? Not on Free, Pro or Max by default. Perplexity's help center says AI data retention is enabled by default on those plans, and that if the toggle is on your data is being collected for AI training. Enterprise is different: Perplexity says Enterprise data is never used for AI training. You still need to read the contract and decide under Opinion 512 whether client information goes in.

Does Perplexity train on what I type? On Free, Pro and Max, it may, unless you turn off AI data retention in Account, then Preferences. The opt-out applies only to data collected after you switch it off. Perplexity says Enterprise data is never used for AI training. Confirm the current terms, since they change.

Is Perplexity Pro private enough for client data? No. Pro is on the same AI data retention default as Free, so the higher price does not buy business data terms. For client matters, look at Enterprise with a written data agreement, or keep client facts out of the prompt.

Does Perplexity send my data to third-party AI models? Its Third-Party Models & Terms page lists providers including OpenAI, Anthropic, Google and xAI, and says the service may use some, all or none of them depending on your plan and query. Perplexity says its agreements with those providers prohibit using Perplexity data to train their models.

Is the AI data retention opt-out the same as a no-train guarantee? No. It is a setting, it can change, and it applies only to data collected after you switch it off. Perplexity says previously collected training data cannot be deleted or removed. A business plan with a written data agreement gives you a contractual term you can point to.

Does Perplexity comply with ABA Formal Opinion 512? The opinion applies to you, not to the tool. You should read the tool's terms, assess the risk, and get a client's informed consent before inputting information relating to the representation into a self-learning tool. General boilerplate in an engagement letter is not enough under the opinion.

What should I never paste into Perplexity on an individual plan? Client names, deal terms, privileged communications and uploaded client files, or anything under a confidentiality obligation, unless you have confirmed the data terms and obtained any required consent. When in doubt, anonymize.

Is Perplexity HIPAA compliant? Perplexity's pages word it differently. Its Enterprise page says Perplexity is "GDPR and HIPAA compliant", its API documentation lists a "2025 HIPAA Gap Assessment" among its certifications and assessments, and its Enterprise security page (read in Spanish) describes safeguards "aligned with" HIPAA. Whether Perplexity offers a business associate agreement for your plan is not verified in our October 2026 review. Ask Perplexity in writing before any health information goes in.

Is Perplexity's API the same as the web app for privacy? No. Perplexity's API documentation states a Zero Data Retention policy for the Chat Completions API and says it does not retain data sent through it. That page does not cover the consumer web product, which has the AI data retention default described above.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.