AI Chatbots Expose Sensitive Data

The story broadens from OpenAI’s sensitive-data features to a comparative examination of privacy practices across major consumer AI providers. New testing and retention findings make unclear deletion, secondary use, and disclosure risks more concrete, while health-data concerns remain a major application.

The story is sharpened around specific ChatGPT product rollouts for finance and health, with clearer claims about data protections and a new human-review safety feature for self-harm cases. The cyber incident is also reframed as a Japanese allegation involving a teenager and rotating IPs, rather than a more general disruptive-code example.

The biggest change is that the story now includes a new safety-intervention dimension: OpenAI is adding human-reviewed alerts for suspected serious self-harm discussions, which raises fresh concerns about sensitive disclosure. The security angle also broadened, with a reported Bandai incident now described more specifically as ChatGPT-assisted code enabling account disruption and IP-blocking evasion.

• Human-reviewed alerts for suspected serious self-harm discussions are being added.
• Stored files may persist after a conversation is deleted.
• ChatGPT-assisted code reportedly automated account disruption and evaded IP-based blocking.
• The cyber risk now extends beyond OpenAI-operated products.
• Safety intervention creates a new disclosure-versus-protection trade-off.

The story has shifted from general concerns about AI chat retention and privacy into a more concrete platform-risk narrative centered on ChatGPT handling financial, health, identity, and payment data. It now also includes real implementation efforts and a live misuse incident, making the stakes around account compromise, liability, and unsafe automation more immediate.

• ChatGPT now connects to financial accounts and health records.
• OpenAI added deletion, disconnection, temporary-chat, and access-period controls.
• ChatGPT Health is not HIPAA-compliant.
• Visa and OpenAI are developing agentic payments.
• Bandai Channel suffered an alleged ChatGPT-assisted automated attack.

The story has broadened from generic AI privacy and retention concerns into a more concrete dispute over long-lived chat data, especially around OpenAI’s memory, file storage, health features, and litigation-driven preservation. It also now emphasizes that courts and compliance demands can override user expectations about deletion and access.

• OpenAI now retains content through memory, file storage, and linked-data features.
• Chats, files, and logs may persist for days or longer after deletion.
• Preserved chat logs are becoming central in litigation and privilege disputes.
• AI products are extending into health records and other sensitive file categories.
• Courts and litigants now shape deletion and access rules.

The story now extends beyond data retention and deletion limits to a more immediate risk: chatbots can expose personal phone numbers and amplify poisoned web content, enabling doxxing and fraud. It also adds clearer differentiation between consumer tools and enterprise offerings with stronger training-privacy guarantees.

The story is increasingly framed around persistence rather than collection alone: deletion and opt-out controls may leave conversations, files, images, and linked records reviewable or retained. The added provider comparisons and jurisdictional references largely reinforce, rather than materially alter, the existing privacy-risk narrative.

The story has broadened from general AI chat privacy concerns into a more concrete regulatory and product-risk picture, anchored by Canadian findings against OpenAI and new account-linked financial use cases. It now emphasizes that sensitive everyday data is flowing through AI systems faster than privacy controls and deletion guarantees can keep up.

• Canadian regulators found ChatGPT's practices overbroad in data collection.
• Plaid and Intuit appear in account-linked AI financial use cases.
• Chatbots are now handling financial accounts and personal documents.
• Researchers report chatbots can surface phone numbers and addresses.
• Duck.ai is highlighted as a privacy-oriented alternative.

Recent coverage shows AI chat privacy becoming a practical settings-and-retention issue rather than a purely abstract concern. Most material focuses on ChatGPT and comparable assistants storing conversations, using them for training or safety review, retaining files and logs, and exposing users to limited deletion, account-level controls, and legal retention demands.