Turn off "Improve the model for everyone" in ChatGPT, then give a 👎 to a response. OpenAI's own help page says the entire conversation containing that response may still be used for training. The "turn off training" toggle controls less than most people assume.
"Turn off training" only closes one of five exits. After turning it off, your conversations still remain on their servers for 72 hours to several years, and can still be read by classifiers or reviewers; tap 👍, and the entire conversation is handed over again; memory, connectors, and ads each have their own accounts. The most effective action for minimizing data exposure isn't in the settings page—it's before you hit send: first decide which content never enters the cloud at all.
Paying does not buy privacy. Personal subscription tiers buy quotas—and on OpenAI, also an ad-free experience—but the training default remains essentially unchanged. Windsurf is the reverse: terms only grant paid tiers an opt-out right; the free tier has none.
You turn off Improve the model for everyone in ChatGPT's Settings > Data controls. Then, dissatisfied with a response, you tap 👎.
OpenAI's Data controls FAQ has a sentence specifically about this: if you select thumbs up or down on any response, the entire conversation associated with that feedback may be used to train OpenAI's models. The same page also states several other things: the opt-out only applies to new conversations; saved chats are not deleted or hidden as a result; archiving a chat does not change whether it can be used for training.
None of this is hidden—it's all in the help documentation. The problem lies in our imagination of what "turned off" means: we assume "turned off" means "not used, not stored, nobody reads it". In the documentation, "turned off" mostly has one meaning: new conversations after that point will not enter training data.
The same is true elsewhere. Claude's Privacy Center states that after turning off Help Improve our AI models, your data cannot be recalled from training that has already begun or from models already trained; conversations flagged by safety classifiers may still be used to improve internal trust and safety models. Gemini's privacy statement says that after turning off Keep Activity, chats are still saved for 72 hours, and Gemini's settings "do not control" the processing of chats into anonymized data to improve Google services.
So "how to make AI platforms collect less of my data" must first be broken down. I've broken it into five exits, with one section for each below.
This article reads the official privacy policies, help center pages, and announcements of nearly thirty products. Secondary reports are used only to supplement events and dates; each fact is based on the date annotated on the page, as of 2026-10-20. Menu paths are copied verbatim from the interface—English interfaces in English—sourced from official documentation; this publication has not verified each item on a physical device. Policies change fast: in the past two months alone, Microsoft's Copilot switched to a new version on August 18 with contradictory statements about "training" between the old and new documentation; ChatGPT Atlas ceased service on August 9; Mistral's Le Chat was renamed to Vibe on August 12. Treat the tables as a snapshot dated October 20.
The remaining three sections are supplementary: toggles and legal basis for Chinese products (§ 07); approaches that don't rely on "trusting the platform" (§ 08); and finally, a three-tier practice stratified by sensitivity (§ 09).
First, chat assistants. "Default" in the table reflects what the official documentation states; where the official source doesn't say, I mark "not stated"—no inferences added.
Sources in order: OpenAI's Data controls FAQ; Claude's settings explanation; Gemini's Activity page and privacy statement; Microsoft's old FAQ and new documentation; Meta's AI terms and objection rights explanation, Muse privacy page; xAI's FAQ; Perplexity's data collection explanation; Mistral's opt-out explanation.
Now for developer tools, where defaults have been changing fastest recently.
Sources: GitHub's announcement and individual subscriber settings documentation; Cursor's data use page and privacy explanation; Cognition (Windsurf)'s platform terms; Codex via OpenAI's Data controls FAQ; Gemini's developer terms, Code Assist individual notice, and Antigravity terms.
Three takeaways.
First, price does not change defaults. ChatGPT Free, Go, Plus, and Pro share the same training policy; Claude Free, Pro, and Max all fall under consumer terms; GitHub Copilot Free through Pro+ share the same default; Perplexity Free, Pro, and Max are the same. What paying gets you is elsewhere: OpenAI Plus and above have no ads; Free and Go do.
Second, contracts change defaults. OpenAI's API has defaulted to not using data for training since 2023-03-01; ChatGPT Business, Enterprise, and Edu default to no training; Anthropic's commercial products default to no training; Perplexity Enterprise data is never used for training; Mistral Enterprise defaults to opted out. What changes defaults is the contract, not the personal subscription. But "default no training" does not mean "no retention"—§ 08 covers this.
Third, "turn off" only covers the future. Claude explicitly states that data in already-trained models cannot be recalled; Perplexity explicitly states that already-collected training data cannot be deleted; OpenAI states "new conversations." There is one exception among Chinese products, covered in § 07.
Sources same as § 02, plus ChatGPT's temporary chat page and consumer data explanation, Claude's retention explanation and incognito page, Perplexity's incognito mode explanation, xAI's privacy policy, Meta's generative AI privacy guide.
Reading this table, two things are counter-intuitive.
One is that "temporary mode" promises not to enter history and not to train—no platform promises not to store. Among those documented in the table, copies are retained for a period: ChatGPT, Claude, and Grok for 30 days, Gemini for 72 hours. "Temporary" refers to your account interface, not to their servers.
The other is Google's human review retention. Gemini's privacy statement says chats reviewed by the service provider are stored for 3 years after being disassociated from your account—because they're already disassociated, deleting your activity won't remove them; the same page states that Gemini's settings do not control the generation of anonymized data. Turning off Keep Activity can reduce retention and training for new chats, but doesn't control these two paths.
Deletion itself has latency. ChatGPT and Claude both state removal within 30 days; Google's retention page states deletion generally takes about 2 months, including a recovery period of up to one month, with encrypted backups retained for up to an additional 6 months.
The three platforms' statements corroborate each other.
OpenAI: with training off, selecting thumbs up or down means the entire conversation may be used for training, per Data controls FAQ.
>Anthropic: if you tap thumbs up or down, Claude stores the entire related conversation, including content, custom styles, and preferences, on the backend for up to 5 years, first disassociated from the user ID, and may be used to analyze service effectiveness, research, and train models—not merged with your other conversations, per training explanation page.
Google: after turning off Keep Activity, if you submit feedback, Google collects the feedback, the last 24 hours of chats and their uploads and connected app data, sends them for human review; retained for up to 3 years, disassociated from the account, per :Gemini privacy statement.
Three more platforms have similar exceptions: xAI's FAQ states feedback may still be used for training; Mistral states that giving a thumbs up/down with a comment authorizes them to use your ratings, inputs, and outputs to improve the model; Doubao's FAQ states that actively submitted feedback and reports are still used for improvement, and the privacy policy counts thumbs up/down as feedback. Microsoft has a feedback explanation page stating that feedback is not used to train the base model, but that page only covers Copilot in Microsoft 365; the feedback rules for the consumer new Copilot, this publication has not found a separate explanation.
The practice for this one is cheapest: in conversations involving sensitive content, don't thumbs up, don't thumbs down, don't use "Report a problem." If the answer is bad, regenerate, or just say "that's wrong"—don't press that button.
The characteristic of the "context" exit is that each piece has its own toggle, and each has different deletion semantics.
Memory. OpenAI's memory page states: turning off Memory does not delete historical conversations; deleting the original conversation does not automatically delete the separately stored saved memory—to delete completely, you must simultaneously handle memory summaries, saved memories, normal and archived conversations, Library files, and related information in connected apps; after deleting memory, logs may still remain for 30 days for security and debugging. Claude's memory page says almost the same: after a conversation expires or is deleted, the memory entries generated from it are not removed—you must delete them one by one by topic in Settings > Memory, or select Reset memory to clear all. Claude's memory is on by default for Free, Pro, and Max; sensitive topics involving health, race, religion, politics, and gender identity are not stored by default.
Privacy and functionality are bundled. Gemini's Memory, Connected Apps, and Tasks all require Keep Activity to be on. If you want personalization, you must accept the entire retention and review package above; if you want less retention, these features are gone. Gemini's memory also has a deletion condition: to delete a memory, you must delete all chats containing that information from Activity; for memories from connected apps, you must also disconnect that app.
Personal agents. OpenAI's Dots (personal tier only Pro 100 / 200 / 500, outside EEA, UK, Switzerland) privacy FAQ states: a dot's conversations and plugin context are retained until you delete the dot; currently you cannot view, delete, or directly modify individual dot memories; turning off ChatGPT's Memory stops sharing, but does not delete information the dot has already received. Connecting your own computer requires clicking Allow access in the app; you can Revoke access.
Meta's Muse was released on September 8; the privacy page (effective September 17) states: training setting is on at first use, can be turned off in Settings > Data controls; after deleting data, Muse may still "remember" information learned from the deleted data—Forget is best-effort. Time reported on October 6, based on its review of Muse's internal instructions, that Muse updates user profiles hourly, including people mentioned in chats and emails, even if those people don't use Muse; this is a third-party analysis, and Meta's response is that data is not shared with the advertising system. Meta's help page acknowledges that when processing third-party information appearing in others' requests, rights can only be fulfilled for "personally identifiable" information. A colleague or family member you mention in conversation is not on any settings page.
Browser and screen. AI that can see your page has a much larger collection surface than a chat window.
Developer tools. Claude Code saves session logs in plaintext on your local machine at ~/.claude/projects/, default 30 days; its /feedback sends conversation history containing code, with transcripts retained for 5 years; disable with DISABLE_FEEDBACK_COMMAND=1; disable all non-essential traffic with CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1.
The takeaway for this section is a sequence: to clean up, clean everything together—conversations, memories, uploaded files, connector authorizations, share links—missing any one leaves a copy.
How conversation content becomes an ad signal varies widely across platforms.
There is also an unresolved matter. An independent researcher posted on September 20 claiming that the __obi cookie set by OpenAI's ad collector allows pixels on advertiser websites to link your off-site behavior to your ChatGPT account. The author himself notes: observed only on Android Chrome, the linking happens server-side and he did not witness it directly, and OpenAI did not respond to his questions. OpenAI's Cookie Policy (updated October 7) does list __obi, classified under Analytics with a one-year duration, but does not say whether it interacts with advertiser pixels. This is a third-party claim; this publication has not verified it.
The delete key has a prerequisite: no litigation requires you not to delete.
In the New York Times case, OpenAI was ordered by the court to retain output logs that would otherwise have been deleted; this obligation terminated 2025-09-26, and OpenAI's explanation page (updated 2025-10-22) states that a batch of specific user data from April to September 2025 remains under seal, accessible only to a small, audited legal and security team.
On the Anthropic side, CourtListener's docket shows that on 2026-07-16, a magistrate judge in the Northern District of California issued an order regarding Anthropic's preservation obligations for prompts and outputs in the Concord Music Group case; Mealey's July 30 headline mentions over 500 million records. Based on Mealey's headline and lead, this publication has not verified whether these records include conversations from personal accounts or conversations users have already deleted.
Whether Google and Microsoft have similar orders regarding consumer conversations, this publication has not specifically checked, and cannot confirm they do not.
First, the policy text of six products. Paths are as written in the policies; this publication has not verified them on physical devices.
Sources in order: Doubao's privacy policy and Help improve model performance FAQ; DeepSeek's privacy policy and user agreement; Yuanbao's privacy policy and user service agreement; Kimi's privacy policy v2 and help center's data usage explanation; Qwen's privacy policy; Wenxin's personal information protection rules.
One detail about Kimi: the old link without parameters kimi.com/user/agreement/userPrivacy still shows the 2024 version; the current version is the one with version=v2, effective 2026-08-31. Don't confuse them when citing.
The Southern Metropolis Big Data Research Institute's hands-on test on June 8, 2026 is largely consistent with this table: most AI assistants use inputs for training by default, Yuanbao defaults to off, and Wenxin and Kimi lack in-app opt-out options.
What standards and law say.
National standard GB/T 45654—2025 "Basic Requirements for Generative AI Service Security", effective 2025-11-01, Article 6.3 states: when collecting user input for training, an opt-out method must be provided; the method must be convenient, and if using an option, accessible within no more than 4 clicks from the service's main interface; the training status and opt-out method must be prominently disclosed to users. Compared to the table above, the three providers requiring email, customer service, or having no entry can hardly be said to comply. But two things must be separated: this is a recommended (GB/T) national standard, not a mandatory one; and this publication has not counted click depths on physical devices.
At the legal level, three provisions are directly applicable. Personal Information Protection Law (full text also on Xinhua's authorized release) Article 15: individuals have the right to withdraw consent, and processors must provide a convenient withdrawal method; withdrawal does not affect the validity of processing conducted before withdrawal. Article 45: individuals have the right to access and copy their personal information. Article 47: when consent is withdrawn, processors must proactively delete; for undeleted information, individuals have the right to request deletion. Plus Article 29: processing sensitive personal information requires separate consent; precise location, voiceprints, and information of minors under fourteen fall in this category. The "Interim Measures for the Management of Generative AI Services" Article 11 also states that providers must not collect unnecessary personal information, must not illegally retain input information and usage records that can identify users, and must promptly handle requests for access, copying, correction, supplementation, and deletion.
The Personal Information Protection Law has no provision specifically targeting "AI training." Whether one can assert a right to refuse training that is enabled by default is debated in legal academia; the Southern Metropolis piece quotes Liu Jinrui, a researcher at the China Law Society's Rule of Law Research Institute, as saying that the practice of using user inputs for training by default and only providing an opt-out mechanism is of questionable legitimacy. This is one scholar's view, not a judicial precedent.
Three more things written in the policies that are easily overlooked.
On the regulatory side, in the past 18 months, this publication found only one notice naming AI chat products and involving personal information: the May 20, 2025 mobile app notice naming Kimi and Zhipu Qingyan, for collecting personal information not directly related to business functions and exceeding user authorization scope, sourced from a secondary report; the original notice was not obtained.
Taken to its logical conclusion, "collect less" has only three forms, with credibility decreasing in order.
Data never leaves the device. Ollama and LM Studio in local mode: prompts, responses, and documents never leave your machine. They themselves note places that still go online: requests when searching and downloading models, device information and IP when checking for updates; once you enable cloud models or web search, data leaves the local machine. Ollama can disable all cloud features with the environment variable OLLAMA_NO_CLOUD=1. The trade-off is also clear—this is my judgment, not stated in official documentation: local open-source models' capabilities, web-connected information, and multimodal quality are overall weaker than cloud flagships, and there are VRAM and RAM thresholds.
Verifiable confidential computing. On October 15, Brave announced that conversations between Leo and the open-weight model GLM 5.3 Flash achieve end-to-end encryption: the browser encrypts each prompt on-device using Oblivious HTTP; only a trusted execution environment verified through hardware attestation can decrypt it; Brave's gateway sees only your IP, not the content; the model runs in NEAR AI's confidential computing environment, and Brave, NEAR AI, and the model vendor cannot read it. Limitations are also stated in the original text: only covers this one model path, the feature is still in beta, the browser currently still relies on Brave's gateway for key checking, and browser-side self-verification is planned for later. DuckDuckGo's Duck.ai also uses a trusted execution environment for open-source models hosted by Tinfoil.
Contractual promises. This is the most common category, and the one with the most exceptions.
The pattern is: every additional upstream in the chain adds another exception list. The closer you get to "not collected," the more you must either forgo the capabilities of cloud flagship models, or trust one more company's promise.
First, stratify by tier. This is my practice recommendation, not any platform's statement.
Tier 0 | Don't send. ID numbers and bank accounts, keys and tokens, unpublished contracts and financial data, others' medical records, screenshots of chat logs containing third parties, company secrets (check your company's own AI policy first). The approach for this tier is local models, or desensitize before sending. "Desensitize before sending" needs to be a process, not willpower—this is what the entire article Who Reviews Before Release is about; escapegate is a proof-of-concept demo; for why the data itself is valuable, see Data as Ammunition.
Tier 1 | Must send, but sensitive. Use all of these together:
Tier 2 | Daily. Change the defaults in the table below with one-time setup, then re-check quarterly.
Three universal practices:
Finally, a self-Q&A to run through before hitting send:
__obi cookie.