ChatGPT (OpenAI)

Does ChatGPT train on what you type into it? On the consumer tiers it does by default, and the opt-out is a single setting most people never open.

Plain-English risk rating: 3 of 5 (Free/Go/Plus/Pro) / 2 of 5 (Business, Enterprise, and API with zero data retention)

Mid-range risk. ChatGPT's free and Plus tiers train on your inputs by default unless you actively opt out. The business tiers (Business, Enterprise) contractually exclude training, but most SMB owners use the consumer tiers without changing the default settings. The Samsung incident (April 2023, three separate leaks of semiconductor IP in 20 days) and the March 2023 Redis bug that exposed billing data for 1.2% of Plus subscribers are concrete examples of what can go wrong. OpenAI has improved significantly since 2023 — the business tiers offer genuine privacy protections, the API supports zero data retention for enterprise customers, and incident disclosure is faster. The risk now sits primarily with the user, not the platform. The business tiers are rated 2 rather than 1 because band 1 requires no documented serious incidents, and the Samsung leaks and the March 2023 Redis exposure described above are documented. The split was added on 14 August 2026; the underlying facts in this profile are unchanged.

Recommended for

  • Sole proprietor: Yes, with the training opt-out turned on, OR pay for ChatGPT Business at NZ$33 a user a month (billed annually)
  • Small team (2-10 people): ChatGPT Business is the right tier. The NZ$33 a user a month (billed annually) buys you a contractual no-training guarantee and basic admin controls
  • Regulated industry (healthcare, legal, finance): Only ChatGPT Enterprise with a signed BAA (where applicable), or API with Zero Data Retention. The free and Plus tiers are not appropriate
  • The honest answer for most 1-10 employee businesses: ChatGPT Business is the cheapest credible tier. If you're using ChatGPT Plus for work, you're probably not protecting your data the way you think you are

Data retention default

  • Free and Plus: Conversations retained indefinitely by default, until the user deletes them. Deleted conversations are removed from OpenAI's systems within 30 days (returned to standard practice after the New York Times v. OpenAI retention order was terminated by Magistrate Judge Ona T. Wang on 9 October 2025, effective as of 26 September 2025) — but not for everyone, and this profile previously implied it was. Logs already preserved under the earlier order REMAIN preserved, data connected to accounts FLAGGED BY THE NEW YORK TIMES must still be preserved, and the Times may keep expanding that flagged list as it reviews records. Separately, OpenAI was pressed to produce 20 million conversations from December 2022 to November 2024, de-identified and under a protective order. If you used ChatGPT in that window, deletion did not necessarily mean deletion. Corrected 3 September 2026 against Engadget and TechRepublic, both read that day.
  • Business: chats are kept until deleted, and deleted chats are removed from OpenAI's systems within 30 days; workspace admins control how long data is kept. Corrected 24 October 2026: we previously gave a 30-day abuse-monitoring default, which is the API's rule, not Business's (OpenAI Enterprise privacy page, updated 8 January 2026).
  • Enterprise: Configurable; minimum 90-day retention if a custom policy is set
  • API (standard): 30 days for abuse monitoring, then deleted
  • API (Zero Data Retention): Inputs and outputs are never logged or stored

Training opt-out

  • Free, Go, Plus and Pro: Training is ON by default. To turn it off: Settings → Data Controls → "Improve the model for everyone" toggle. This is the most important setting most ChatGPT users have never changed.
  • Business, Enterprise, Edu and API: Training is OFF by default — contractually excluded. OpenAI does not train on business customer content from these tiers.

The opt-out for free/Plus is available but takes three clicks to find, and it's framed in marketing language ("help improve the model") rather than risk language ("OpenAI may use this for training"). Most SMB owner-operators don't know it's there.

Zero Data Retention (ZDR) availability

  • API only. Not available for ChatGPT consumer or Business tiers.
  • Available for qualifying enterprise customers, by request, for eligible API endpoints (not all endpoints support it — Web Search, for example, is excluded)
  • Process: contact OpenAI sales to enable on the API account. Not a self-serve toggle.

Plan tiers and pricing (NZ$, as shown to a New Zealand visitor on 24 October 2026)

TierPrice (NZ$)Training on your data?Suitable for
Free$0Yes, unless opted outPersonal experimentation only
Go$14 a month (may include ads)Yes, unless opted outPersonal use only
Plus$40 a monthYes, unless opted outPersonal use; not appropriate for client work without opt-out
ProFrom $190 a monthYes, unless opted outHeavy individual use; same training default as Plus
Business (renamed from Team in August 2025)Standard seat $33 a user a month billed annually, or $41 monthly; premium seat $165 or $205No, contractually excludedTeams, from 2 users
EnterpriseCustom (contact sales)No, contractually excludedLarger organisations, regulated industries
APIPay-per-tokenNo, by defaultDevelopers building applications

Re-checked 24 October 2026 against OpenAI's pricing page, read in a browser from New Zealand, and its help centre. The pricing page marks Free, Go, Plus and Pro “Opt-out available” for training on your content, and OpenAI's Data controls article says data sharing is on by default for Free, Plus and Pro. By default OpenAI does not train on content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces, or on API inputs and outputs. One exception survives the opt-out: if you give feedback on a response, such as a thumbs up or down, OpenAI says the whole conversation may be used for training. Voice mode has its own training control. Earlier versions of this table were in US dollars and left out Go and Pro.

Jurisdiction

  • Controller for users outside the EEA and Switzerland, New Zealand included: OpenAI OpCo, LLC, 1455 Third Street, San Francisco, California 94158, USA (Privacy Policy, updated 6 February 2026). Corrected 24 October 2026: we previously named “OpenCorp Inc., 3180 18th Street”, which is not in OpenAI's policy.
  • Sub-processors include cloud infrastructure providers. The full sub-processor list is published in OpenAI's Trust Portal.
  • Personal plans: OpenAI's Privacy Policy says data is processed and stored in the United States and in other countries where its affiliates and vendors are. ChatGPT Enterprise and Edu workspaces can choose to store content at rest in one of ten regions, Australia among them; model processing can be kept in-region only in Europe, the United States and the UAE, so prompts from a workspace stored in Australia are still processed overseas (OpenAI help centre, read 24 October 2026). It is not automatic: an eligible workspace has to set it up.
  • For users in the EEA and Switzerland, OpenAI Ireland Limited is the controller.

Breach history (public incidents)

March 20, 2023 — Redis race condition (CVE-2023-28858, CVE-2023-28859) A bug in the redis-py open source library caused a nine-hour window in which some ChatGPT users could see the titles and first messages of other users' conversations. Approximately 1.2% of ChatGPT Plus subscribers active during that window had limited billing information exposed: names, email addresses, payment addresses, credit card type, and last four digits of credit card numbers. OpenAI shut down ChatGPT to investigate and notified affected users. Source: OpenAI postmortem; Help Net Security, 2023-03-27

March-April 2023 — Samsung semiconductor leaks Not a breach of OpenAI's systems, but the canonical SMB-relevant data leakage incident. Samsung engineers in the semiconductor division pasted (1) proprietary semiconductor database source code, (2) yield and defect measurement code for chip equipment, and (3) a transcript of a confidential internal meeting (which discussed unreleased semiconductor process technology) into ChatGPT across three separate incidents in under 20 days. Reported by The Economist (South Korea) on March 30, 2023. Samsung banned generative AI on company devices and networks in May 2023 and began developing its own internal AI tool. Source: Bloomberg; The Economist (Korea); incidentdatabase.ai #768

2023 — Group-IB credential theft report Cybersecurity firm Group-IB identified 101,134 stealer-infected devices that had saved ChatGPT credentials between June 2022 and May 2023. The credentials were sold on dark web marketplaces. This was not a breach of OpenAI's systems — it was infostealer malware on user devices harvesting credentials — but it surfaced the risk that ChatGPT logins are valuable to attackers because conversation history may contain sensitive business data. Source: Group-IB report, 2023

December 2023 — Training data extraction (research disclosure) Researchers from Google DeepMind, Cornell, and four other universities demonstrated that prompting ChatGPT to repeat certain words repeatedly could cause it to leak training data, including personally identifiable information. They extracted over 10,000 unique verbatim memorized training examples for approximately $200 of API spend. OpenAI patched the specific attack quickly. The broader research significance is that some training data is memorized and recoverable. Source: Nasr et al., "Scalable Extraction of Training Data from (Production) Language Models", 2023

December 2024 — Italian Garante €15M fine The Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) fined OpenAI €15 million for processing personal data without sufficient legal basis, failing to implement adequate age verification, and inadequate transparency in its 2023 training data collection. This was one of the largest regulatory actions taken against an AI provider to that date. Source: Garante decision, December 2024

November 9, 2025 — Mixpanel third-party breach Mixpanel, a third-party analytics provider that OpenAI used to track user interactions on its API platform (platform.openai.com), suffered an SMS phishing attack that gave an attacker access to part of its systems; OpenAI was among the customers affected. Mixpanel has about 8,000 corporate customers in all and has not said how many were affected. Limited analytics data was exported, including names, email addresses, approximate locations, and technical details about customer systems. No chat content, API requests, passwords, credentials, API keys, or payment details were exposed. Mixpanel shared the affected dataset with OpenAI on November 25, 2025; OpenAI removed Mixpanel from its services and notified affected users. Affected: API users and a limited number of ChatGPT users who had submitted help center tickets or had been logged into platform.openai.com during the exposure window. Source: OpenAI incident page, 2025-11-27

December 2025, malicious Chrome extensions OX Security reported on 30 December 2025 that two extensions on the Chrome Web Store, with over 900,000 downloads between them, were sending users' ChatGPT and DeepSeek conversations, and the addresses of their open tabs, to a remote server every 30 minutes. Not a breach of OpenAI — a browser ecosystem failure — but a reminder that conversation history visible in the browser is a high-value target. Source: OX Security, 30 December 2025

Agent features: what it can reach, keep, pass on and do

Checked 23 September 2026. This section describes agent features only and does not change the rating above: agents are not yet part of our scoring method. Everything here comes from OpenAI’s own published pages, linked at the end of the section. Where OpenAI does not say something, we say so rather than guess.

First, a change of name. OpenAI’s help page for “ChatGPT agent” now opens by saying the agent is no longer available and points to ChatGPT Work and a cloud browser instead. This section describes those replacements. Where we rely on a statement OpenAI made about the retired agent mode, we say so.

What it can reach. OpenAI describes Work as an agent for longer, multi-step tasks. It can use connected apps and plugins, and a cloud browser that can sign in to websites for you, fill in forms and keep working after you close your computer. Once you sign in to a site, that session persists for later tasks until it expires. In the desktop app Work can also use local files and desktop apps with your permission. For eligible Enterprise and Edu workspaces, OpenAI says Work is enabled by default for members on the default role unless an owner or admin turns it off.

What it keeps. The cloud browser keeps its own cookies and signed-in sessions until they expire or you clear them in settings. OpenAI says messages and task context may be stored in the cloud even when Work runs on your own computer. For the retired agent mode, OpenAI’s page says chats, browsing history and screenshots were kept until you deleted them, then removed from its systems within 90 days. We have not found an equivalent statement for Work.

Where your content goes. OpenAI says information from websites the cloud browser uses is handled under your ChatGPT data controls. On Business, Enterprise and Edu, its agent page says business data, including data accessed during agent sessions, is not used for training by default; on Plus and Pro that depends on the “Improve the model for everyone” setting. The same page says authorised OpenAI staff and service providers may access agent content, including screenshots, to investigate abuse or security incidents, provide support, handle legal matters, or improve model performance unless you have opted out.

What it can do without asking. OpenAI says ChatGPT asks for confirmation before actions that are hard to reverse or that create a financial, legal or account commitment, such as a booking or a payment. By default it asks before visiting a new website, but a setting lets it approve sites itself or allow every site, which OpenAI itself does not recommend. OpenAI names prompt injection and says its safeguards do not eliminate every risk. For the retired agent mode, its page said individual agent actions did not appear in Compliance API logs.

What to do.

  • Enterprise owners: check whether Work is switched on for your default role, and decide on purpose.
  • Leave the cloud browser website setting on “always ask”.
  • Clear cloud browser sessions after anything sensitive, because sign-ins persist for later tasks.

Sources for this section, read 23 September 2026: ChatGPT agent; ChatGPT Work and Codex; Using cloud browser in ChatGPT.

What this means in plain English for SMB owners

Three honest takeaways:

  1. If you use ChatGPT Plus for client work without changing the training setting, you are sending client information to OpenAI's training pipeline. It is not malicious. It is the default. The setting takes 30 seconds to change.
  1. The biggest risks are not OpenAI's systems being hacked — they are (a) employees pasting things they shouldn't paste, and (b) third-party tools in the supply chain. Samsung is the canonical example of the first. Mixpanel is the canonical example of the second.
  1. If you are using ChatGPT for anything that touches client data, regulated information, or proprietary work, you should be on Business or Enterprise, not Plus. NZ$33 a user a month (billed annually) is cheaper than one billable hour. The contractual no-training guarantee is what you are paying for.

Sources

  • OpenAI Enterprise Privacy page: https://openai.com/enterprise-privacy/ (updated 8 January 2026; read 24 October 2026)
  • OpenAI Business Data Privacy: https://openai.com/business-data/ (read 24 October 2026)
  • OpenAI response to NYT data demands: https://openai.com/index/response-to-nyt-data-demands/ (2025-09-26)
  • OpenAI Mixpanel incident disclosure: https://openai.com/index/mixpanel-incident/ (2025-11-27)
  • OpenAI Academy data governance and compliance resource (2025-08-29)
  • Help Net Security: "A bug revealed ChatGPT users' chat history…" (2023-03-27)
  • SecurityWeek: ChatGPT data breach confirmation (2023-03-28)
  • AI Incident Database, incident 768: Samsung Data Leak (incidentdatabase.ai/cite/768/)
  • Bloomberg: Samsung ChatGPT/Bard ban (May 2023)
  • Nasr et al., "Scalable Extraction of Training Data from (Production) Language Models" (2023)
  • Garante per la Protezione dei Dati Personali decision (December 2024)
  • Information Security Media Group: OpenAI suspends Mixpanel (2025-11-28)
  • OpenAI Privacy Policy (rest of world): https://openai.com/policies/row-privacy-policy/ (updated 6 February 2026; read 24 October 2026)
  • OpenAI help centre, Data controls in ChatGPT: https://help.openai.com/en/articles/7730893 (read 24 October 2026)
  • OpenAI help centre, Data residency and inference residency for ChatGPT: https://help.openai.com/en/articles/9903489 (read 24 October 2026)
  • OpenAI Academy, Data governance and compliance (updated 17 September 2026; read 24 October 2026)
  • ChatGPT pricing: https://chatgpt.com/pricing/ (read 24 October 2026 from New Zealand)
  • OX Security: malicious Chrome extensions steal ChatGPT and DeepSeek conversations (30 December 2025)
  • TechCrunch: a data breach at analytics giant Mixpanel leaves a lot of open questions (2 December 2025)
  • Engadget: OpenAI no longer has to preserve all ChatGPT data, with some exceptions (read 3 September 2026)
  • TechRepublic: OpenAI versus the New York Times on conversation logs (read 3 September 2026)
  • In re OpenAI Copyright Infringement Litigation, order of 9 October 2025, ECF No. 992 (S.D.N.Y.)

Related on AI Leakage

Compare similar tools: ChatGPT (OpenAI) is one of 6 tools in AI chat assistants compared, which sets out each one’s rating and what it does with your data, side by side.