Black October, explainedAppsGuidesAI DictionarySmall FixesOn RecordAboutFollow the lab

AI and privacy

Also called privacy, data privacy, is my data used for training

AI and privacy is about what happens to personal information when AI is trained on it or when you share it with an AI tool.

Safety and societyEveryday

Products, laws and numbers here change fast. Checked October 2026.

In plain words

Privacy and AI meet in two places. First, training: AI models learn from huge amounts of data, which can include public posts, photos and web pages about real people, often collected without asking them. Second, use: when you type into a chatbot, your words go to the company's servers, may be stored, may be read by reviewers, and on some services may be used to train future models unless you switch that off.

There is also a rarer risk. Models sometimes memorise bits of their training data and can repeat them, including names, phone numbers or emails.

Privacy laws apply to AI like any other technology. Europe's GDPR has already led to fines. India's Digital Personal Data Protection (DPDP) Act will give people rights over their data, with most duties starting in May 2027 as of October 2026.

Everyday example

Telling your problem to a call centre

You call a bank helpline and explain a problem, including your address. The call "may be recorded for training purposes". That recording might help train new staff, sit in a database for years, or be heard by someone you never meet. A chatbot conversation is similar: helpful in the moment, but stored and possibly reused, unless you check the settings.

Where the example breaks: A trainee who hears your call will not recite your address to the next customer. An AI model trained on your data very occasionally can, which is a risk recorded calls do not usually carry.

Go deeper

How it actually works

Here is what actually happens to data, and what the law says, as of October 2026.

  1. Training data and scraping

    Language models are trained on web-scale data. Companies filter some personal details out, but not all. In 2025, Meta began training on the public posts of adult EU users under GDPR's "legitimate interest" basis, offering an objection form, after review by Ireland's regulator.

  2. Memorisation

    A 2020 study extracted hundreds of exact passages from GPT-2's training data by querying it, including names, phone numbers and email addresses, some appearing only once in the data. Larger models memorised more. Makers now test and filter for this.

  3. Your chats

    Consumer chatbot settings differ by company and change over time. Some use conversations to improve models by default with an opt-out; business and API plans often exclude training. Check the data or privacy settings of each tool, and avoid pasting passwords, ID numbers or other people's private details.

  4. Europe: GDPR

    In December 2024, Italy's data protection authority fined OpenAI €15 million, citing no adequate legal basis for training on personal data, weak transparency, missing age checks and an unreported breach. OpenAI said it would appeal.

  5. India: the DPDP Act

    The DPDP Act (2023) and its Rules (notified 13 November 2025) require notice and consent for most use of personal data, with extra protection for children (no tracking or targeted ads for under-18s), and give people rights to access, correct and erase their data. Most duties apply from 13 May 2027; the government has proposed bringing some forward. The Act does not cover personal data that a person made public themselves, which matters for scraping.

India's privacy law
Digital Personal Data Protection Act, 2023. Rules notified 13 November 2025; main obligations from 13 May 2027 (as of October 2026)
A big AI privacy fine
€15 million, OpenAI, Italy's Garante, December 2024
Memorisation study
"Extracting Training Data from Large Language Models", Carlini and colleagues, December 2020
Related
Facial recognition, AI memory features, on-device AI that keeps data on your phone

We are not lawyers. Laws and company settings change; check the current privacy policy of any tool you use.

Questions people ask

Is my data used to train AI?

Possibly, in two ways. Public posts and web pages may have been included in training data. And chats with some consumer AI tools may be used for training unless you opt out in settings. Business and API plans often exclude training. Check each tool's privacy settings.

Is it safe to share personal information with ChatGPT?

Treat a chatbot like an email to a company: it is stored on their servers and may be reviewed. Avoid sharing passwords, Aadhaar or PAN numbers, bank details, medical records or other people's private information unless the service is approved for that use.

Can AI reveal my personal data to others?

Rarely, but it has happened in research. Models can memorise text that appeared in training and repeat it when prompted. Companies filter for this. The larger risk is usually data stored in accounts or leaked in breaches.

Does the DPDP Act apply to AI companies?

Yes, when they process digital personal data of people in India, or offer services to them from abroad. Most duties start on 13 May 2027 (as of October 2026). Data a person made public themselves is outside the Act. We are not lawyers.

How can you delete your data from a chatbot?

Most services let you delete individual chats or your whole account in settings, and turn off chat history or training. Deleting may not remove what is already inside a trained model. Under GDPR, and later under India's DPDP Act, people can also formally request erasure.

Further reading

Prepared by Mundhra Labs. Reviewed by Aditya Mundhra. Checked October 2026.