Personalized AI Makes Privacy About Use, Not Just Training

AI privacy has outgrown the familiar question of whether a company trains a future model on your prompts. Axios opened a new examination of consumer chatbot data on August 17 by focusing on what a service can do with information now: retain memories, personalize replies, recommend content, support advertising, and draw context from connected apps or a wider device history.

That distinction matters because people disclose different information to a conversational system than they do to a search box. A chat about debt, symptoms, a workplace conflict, or a relationship can reveal not just an interest but a decision in progress, an insecurity, and the language most likely to persuade the person. More useful assistants need context. The risk comes from quietly letting that context travel into purposes the user did not associate with the conversation.

One prompt can enter several separate data systems

Training, history, memory, personalization, safety review, advertising, and third-party access are separate operations even when one settings screen makes them feel interchangeable. Turning off model improvement may keep new chats out of a training pipeline while leaving them in visible history. Deleting a conversation may not remove a saved memory derived from it. A temporary mode may avoid history and memory while still retaining content briefly for abuse monitoring.

OpenAI says its Temporary Chats are deleted automatically, do not create memories, and are not used to train models. It separately lets users disable model training and review, edit, or delete memories. Its consumer privacy page also says advertisers do not receive chats, history, memories, or personal details and that ads do not influence answers. Those are material boundaries, but users still need to choose the right control for the outcome they want.

Meta documents a different product model. It says interactions with its AI features can help personalize content and ad recommendations across connected Meta products. The company says certain sensitive conversation topics, including health, religion, politics, and sexual orientation, are not used to show ads, and Accounts Center choices affect which accounts share signals. That makes an AI conversation part of a broader recommendation system even when it is not treated like a public post.

Architecture can constrain use more strongly than a promise

Apple describes an architecture that handles requests on device when possible and sends only relevant request data to Private Cloud Compute when a larger model is needed. Apple says Private Cloud Compute does not store request content or make it accessible to Apple, and that users can export an Apple Intelligence Report showing off-device requests. Those claims are backed by system-design requirements intended to prevent privileged runtime access and post-response retention.

That is not a universal solution. On-device systems may have less context or capability, and Apple notes that a request sent to a third-party service such as ChatGPT follows that service’s rules. Still, the design demonstrates an important hierarchy: a setting asks a company not to use data in a certain way; a stateless architecture aims to make the unwanted use technically unavailable.

Consumers should not have to infer this topology from scattered policies. A useful privacy panel would show, separately, whether a conversation is stored, remembered, used for model improvement, reviewed for safety, used for recommendations or ads, shared with connected apps, and available to human support. Each purpose needs its own plain-language state, retention period, deletion path, and effective date.

The practical privacy test is purpose limitation

Before sharing sensitive information, decide what result you actually need. Use a temporary or incognito mode for a one-off question. Disable memory when long-term personalization is unnecessary. Review saved memories separately from chat history. Disconnect apps that no longer need access, and do not assume deleting one record erases derived profiles elsewhere.

For employers and schools, a blanket “do not train” requirement is incomplete. Procurement should cover prompt retention, administrator access, subprocessors, regional routing, human review, connected-app permissions, ad use, safety exceptions, legal requests, deletion, and whether the provider can change those terms without a new approval. Sensitive workflows need contractual and architectural controls, not just user discipline.

The core rule is simple: information volunteered for an answer should not silently become a general-purpose behavioral signal. Personalized AI can be valuable, but meaningful consent requires telling people which system learned what, for which purpose, for how long, and how to make it forget.