Why a Privacy Policy Is Not the Same as a Data Training Guarantee

A privacy policy is not a data training guarantee. For anyone seeking AI without data collection or monetization, a promise not to train on conversations answers only the training part of a question that also concerns whether the service stores, shares, or sells personal data. The stronger standard is a contractual exclusion backed by architecture that keeps conversations out of training pipelines.

Why privacy policies and training guarantees are structurally different instruments

A privacy policy discloses a company’s intended data practices. A training guarantee would bind it to a specific exclusion, committing that defined data will not be used to build or improve AI models. The distinction lies in the obligation and remedy. A disclosure can support action against misrepresentation, but that is different from a contractual promise the user can invoke. No major consumer AI platform offers that kind of promise as a matter of course.

Regulators and courts can act when a company misrepresents its practices, so a policy is more than an informal statement. Yet its description of how data is handled can leave a particular future use open. Training is one such use, separate from the question of what data a service collects. A careful reader therefore needs to ask not just what the document says, but what commitment its wording actually creates.

How privacy policies are written to describe intent, not to constrain it

Broad purpose clauses leave room for practices readers may not anticipate. Phrases such as “improve services” and “develop products” can encompass model training without naming it. A reader can understand every word and still miss how much those words cover. That ambiguity gives a disclosure flexibility, because the company can describe several uses under one general purpose that leaves the scope of each use open. The same data can consequently acquire a new role without any change to what the service collects.

Anthropic illustrates how the authorized purpose can change. Until August 28, 2025, it did not train on consumer Claude conversations and treated that exclusion as a selling point. Since then, it can train on those conversations where users permit it, and conversations covered by that permission may be retained for up to five years. The instrument remained a policy, but the permitted use shifted. The example does not establish that every change is improper, only that the document itself does not make the earlier position permanent.

The FTC has also identified limits on policy revisions. On February 13, 2024, it warned that quietly adopting more permissive practices through a retroactive amendment may be unfair or deceptive. A company “cannot then unilaterally renege on those commitments after collecting users’ data”. That warning distinguishes the ability to rewrite a document from the right to repurpose data already collected. A binding guarantee would make changing the commitment a question of user assent.

Why the same platform can apply different training rules to the same user's data depending on tier, context, and access method

Policies also differ across a platform at the same moment. The operative terms can depend on the product tier, access method, or account state. Which agreement governs a conversation sent through an API or a consumer app? OpenAI may use standard consumer conversations and files to improve services and train models unless users opt out through Data Controls. Its API-submitted data is excluded from training by default under separate terms.

Anthropic makes a similar distinction between its consumer plans, including Free, Pro, and Max, and its API and enterprise offerings, which remain excluded by default. GitHub Copilot personal accounts have training on by default, while Business and Enterprise seats are excluded by default and allow administrators to enforce exclusion organisation-wide. Hardware does not determine which rule applies. A personal account used on a work machine keeps the personal default, so using it at work does not automatically give it enterprise protection.

Microsoft Copilot adds app version to this fragmented picture. Its older consumer app has a training toggle on by default, while the updated consumer app released August 18, 2026 states that prompts and responses are not used to train foundation models and removes that toggle. Commercial tiers sold with Microsoft 365 have contractual data protection and default training exclusion. Business protection has a separate boundary, however. Under ChatGPT Enterprise, Business, and equivalent Gemini for Workspace agreements, business data is kept out of public model training by default, but employers technically own those chats and can review them.

Why opt-out controls are narrower than users assume, and why exceptions survive them

An opt-out limits how data can be used within the bounds it sets. It is not a restriction attached to a document wherever that document travels. ChatGPT’s training opt-out applies to the user’s account across web and mobile, but not to a colleague who pastes the same document into another account or an integration used without the user’s own account. Finding the switch therefore resolves only part of the question of where that information may enter training.

OpenAI’s official ChatGPT browser extension documentation says that account data controls apply to content sent through the extension. Readers need to check where and how the control applies. Even where a control applies, Anthropic’s policy allows conversations flagged for safety review to be used to improve models whether or not users opt out.

Training and retention are separate controls as well. Turning off training does not delete conversation history, shorten retention windows, or prevent human review of flagged content. A service can therefore honor a training opt-out while continuing to hold a conversation. Keeping data out of training alone does not show which assistant does not store or sell personal data.

How vendor-on-vendor and third-party training chains extend exposure beyond the platform a user chose

The account boundary is only the first boundary data crosses. Business partners and other recipients can bring their own training practices into a relationship the user understood as involving one platform. The FTC’s action announced March 30, 2026 described a concrete example involving OkCupid and Clarifai. OkCupid gave Clarifai unrestricted access to roughly three million user photos, plus precise location and demographic data. Clarifai used the photos to build and refine facial recognition technology.

OkCupid’s privacy policy said it shared data only with service providers, business partners, and affiliates, and Clarifai was none of those. The gap was not simply vague training language. Clarifai later certified deletion of the photos and the facial-recognition models trained on them to the FTC on April 7, 2026. The case shows why reading a sharing list cannot substitute for the company complying with it.

Not every extended training chain involves such a misrepresentation. eBay’s April 2025 privacy update explicitly disclosed that personal data could train its own and third-party AI models. Germany’s Brandenburg data protection regulator still questioned whether users had been given enough information about how their data would be used. eBay’s AI training opt-out page is described as being for EEA, UK, and Swiss users, whose objections keep personal data out of future generative AI training while still allowing it to be used for other purposes.

Why deletion and opt-out cannot reverse training that has already occurred

Deleting a conversation removes logged data while leaving the training signal it has already contributed to updated model weights intact. An opt-out likewise governs future use. This is why retention and training cannot be treated as interchangeable processes. A service may delete the original record without undoing the model’s learning from it.

Machine unlearning addresses the harder problem of removing a specific input’s effect from a trained model. It remains unsolved at production scale, and none of the major assistants examined here documents an architecture that makes true deletion tractable. Clarifai’s certified deletion is a real counterexample, but a different kind of remedy. It deleted the affected models themselves, in a case with a bounded set of data and separate model products. That does not establish a way to remove one person’s contribution from a foundation model trained on billions of tokens.

Further training can make the trail harder to follow. An arXiv paper published April 2026 argues, in the copyright context, that the problem compounds in second- and third-generation models trained on synthetic data because original rights holders are no longer traceable. Personal data faces the same problem of when an opt-out takes effect. The Berkeley Technology Law Journal argues that opt-out schemes begin by assuming content owners are opted in, with ingestion already completed by the time an objection is offered.

What regulators have done and where enforcement still falls short

The FTC’s action against Match Group and OkCupid used Section 5 deception, without requiring a new AI law. Its proposed order permanently bars misrepresentations about data practices but imposes no fine. This targets the source of training data, rather than claims about what an AI product can deliver. The remedy is nonetheless retrospective and case-specific. It acts on the discrepancy between a company’s representations and its conduct after the data has been used.

Connecticut has moved to make businesses spell out their data use before that dispute arises. Since July 1, 2026, privacy notices covered by its privacy law must state whether a business collects, uses, or sells personal data to train large language models, whether the answer is yes or no. Coverage starts at 35,000 consumers a year. Connecticut became the first US state with this requirement, while Vermont’s S.71, signed June 16, 2026, copies it effective January 1, 2028. No federal equivalent exists, and no other state privacy statute currently in force names model training in its notice rules.

California’s CCPA requires purpose disclosure at collection and new notice before an incompatible new use. The CPPA’s automated decision-making regulations, with ADMT duties from January 1, 2027, add no AI-training line to privacy policies but trigger a documented risk assessment before training on data for significant decisions. These duties do not prohibit training. Where users live also affects which controls they have, as eBay’s objection page for specific regions and the Brandenburg regulator’s concerns show, though these do not establish a general EU training guarantee.

What a genuine training guarantee looks like, and how architecture makes it credible

For a reader choosing an assistant, the practical standard is both contractual and architectural. A clear commitment defines the data and uses excluded, while the system’s design makes that exclusion more than an operating preference. Default exclusion alone does not prove technical impossibility. The separate terms for OpenAI’s API and Anthropic’s API and enterprise tiers nevertheless demonstrate that excluding user data from training is a deliberate product decision.

Apple’s stated position offers a different example. It says personal data is not used to train its foundation models, with on-device processing for most requests and Private Cloud Compute for the rest. There is no training opt-out to locate because Apple describes that use as not happening. In particular, no-training language should not be stretched into an unsupported claim about storage, sale, or all data collection.

Architecture strengthens a commitment when conversations are kept out of training pipelines from the start. The protection then depends less on a setting that a later policy update can revise. But architecture and contract answer different questions, namely what the system permits and what the provider is bound to do. Neither a broad privacy label nor a single toggle establishes both. The practical test is whether the exclusion rests on an editable clause, or on a binding commitment backed by a design the provider would have to rebuild to violate.