OpenAI and Anthropic have clarified their enterprise data privacy policies, but employee use of consumer AI accounts continues to expose corporate data. Studies show that confidential information is often shared through unapproved consumer accounts, potentially feeding into training pipelines.
TL;DR
- OpenAI and Anthropic do not train models on enterprise-tier data, but consumer accounts may still expose corporate information.
- Employee use of consumer AI accounts poses significant privacy risks for enterprises.
What happened
OpenAI and Anthropic have explicitly stated that they do not train their models on data from enterprise tiers, including ChatGPT Enterprise, Team, and EDU for OpenAI, and Claude Enterprise, Team, and Edu for Anthropic.
However, both companies allow training on user chats from consumer tiers unless individuals opt out. This distinction between enterprise and consumer tiers creates a loophole where confidential corporate information can be exposed.
Studies conducted between 2025 and 2026 found that a notable share of AI prompts generated by employees on unapproved consumer accounts contain confidential information, such as proprietary code, internal strategy documents, customer data, and financial projections.
Why it matters
For enterprises, the risk lies in employees using consumer AI accounts for work-related tasks, potentially exposing sensitive data to training pipelines.
Even within enterprise accounts, data retention periods can range from 7 to 30 days, which may not comply with strict regulatory frameworks in industries like healthcare, finance, or legal services.
The primary risk is not the technology itself but the human factor—employees using consumer accounts for work purposes, which can lead to unintended data exposure.
Key facts
- OpenAI does not train models on data from ChatGPT Enterprise, Team, or EDU tiers by default.
- Anthropic does not train models on data from Claude Enterprise, Team, or Edu tiers by default.
- Anthropic updated its consumer-tier policy in September 2025 to allow training on user chats unless individuals opt out.
- OpenAI has maintained a similar approach with its free and Plus consumer tiers.
- Studies found that employee prompts on consumer accounts often contain confidential information.
- Data retention periods for enterprise accounts typically range from 7 to 30 days.
- Industries with strict regulatory frameworks need to carefully evaluate data retention periods.
- The main risk is employee use of consumer AI accounts for work-related tasks.
Context
OpenAI is the company behind ChatGPT, while Anthropic is known for its Claude models. Both companies have been at the forefront of developing large language models with a focus on enterprise and consumer applications.
The use of AI in enterprises has grown significantly, with many companies integrating AI tools into their workflows. However, this integration comes with challenges, particularly around data privacy and security.
Regulatory frameworks in industries like healthcare, finance, and legal services impose strict requirements on data handling and retention, making it crucial for enterprises to understand the implications of using AI tools.
