About 19.8% of US businesses reported using AI in a business function as of May 2026 (US Census Bureau, 2026) - but far more employees are quietly pasting customer emails, contracts, and spreadsheets into ChatGPT, Claude, Gemini, and Copilot without anyone approving it. So the question every operator should ask is simple: does the chatbot keep that text, and does it train its models on it?
Short answer: It depends almost entirely on which tier your team is logged into, not which brand. On free and personal consumer plans - ChatGPT Free/Plus, Claude Free/Pro/Max, the Gemini app, and consumer Copilot - your conversations can be used to train the vendor's models by default, and you have to opt out. On business, enterprise, and API tiers - ChatGPT Enterprise/Team and the OpenAI API, Claude for Work and Anthropic's API, Gemini for Google Workspace, and Microsoft 365 Copilot - the vendors state they do not use your inputs or outputs to train their foundation models. Same chatbot, very different rules.
Does ChatGPT train on my data?
If you use a personal ChatGPT account, yes - by default. OpenAI lets you turn this off under Settings > Data Controls > "Improve the model for everyone," and once you switch it off, new conversations are no longer used to train models (OpenAI, 2026). The important nuance is that this is opt-out, not opt-in: the default on a free or Plus account shares your chats.
Business tiers work the opposite way. For the OpenAI API, OpenAI states that "as of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)" (OpenAI developer docs, 2026). OpenAI also says it does not train on inputs or outputs from ChatGPT Enterprise, Team, or the API by default. It does, however, retain API inputs and outputs for up to 30 days for abuse monitoring before deletion, with a zero-data-retention option for eligible customers.
What about Claude, Gemini, and Copilot?
Claude (Anthropic). In an update dated August 28, 2025, Anthropic began training new models on data from Free, Pro, and Max accounts - including Claude Code - when the training setting is on, and existing users had to make a choice by October 8, 2025 (Anthropic, 2025). If you leave it on, Anthropic extends data retention to five years; if you leave it off, you keep the existing 30-day retention. Critically, Anthropic says this "does not apply" to services under its Commercial Terms - Claude for Work, Claude for Government, Claude for Education, or API use, including through Amazon Bedrock and Google Cloud's Vertex AI.
Gemini (Google). The consumer Gemini app saves your chats in your Activity, and Google states it uses that activity "to provide, develop, and improve its services (including training generative AI models)," with human reviewers involved (Google, 2026). You opt out by turning off the Gemini Apps Activity / Keep Activity setting. One catch worth knowing: chats already seen by a human reviewer "are retained for up to three years" and are not deleted when you delete your activity. For business use, Google's Workspace privacy hub says the opposite: "Your chats and uploaded files in Gemini app won't be reviewed by human reviewers or otherwise used to train generative AI models without your permission" (Google Workspace, 2026).
Copilot (Microsoft). Microsoft 365 Copilot is the clear enterprise case: Microsoft states that "the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models" (Microsoft, 2026). Consumer Copilot is different - Microsoft's privacy FAQ says that "except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training," while excluding users signed in with an organizational Entra ID account, users under 18, and users in several specific countries (Microsoft, 2026).
"Retained" is not the same as "trained"
Even when a vendor promises not to train on your data, it usually still stores it for a while - to run the service, prevent abuse, or comply with the law. Those retention windows vary widely, and they are where a lot of the real risk lives: a breach, a subpoena, or a misconfigured account exposes retained text regardless of whether it ever touched a training run.
The pattern is consistent: business and API tiers keep data briefly (roughly 30 days) for abuse monitoring, while consumer tiers that participate in model improvement can hold it for years. That five-year figure for opted-in Claude consumer accounts and the three-year window for human-reviewed Gemini chats are the ones most people never see coming.
What This Means for Your Business
The single most effective privacy control is not a setting buried three menus deep - it is which account your team uses. If employees are running work through personal free chatbots, assume the content can be retained for years and, depending on the tier and their settings, used to train models. Moving the same work to a paid business, enterprise, or API tier flips the default: the vendors above all state they do not train on that data, and retention drops sharply.
Three practical steps for an operator:
- Pick one sanctioned tool on a business tier and tell staff to use it, so customer and financial data never lands in a personal account. Our best AI tools for small business and AI chatbot cost guides can help you choose.
- Verify the current policy yourself before you commit - these terms changed materially in 2025 and 2026, and the tier you buy determines your protection. Read the vendor's business-data page, not a blog summary.
- Keep regulated data out of general chatbots unless you have a signed agreement that covers it. If you handle health, legal, or financial records, treat that as a compliance decision, not a productivity one - see our note on HIPAA-compliant workflows and healthcare and legal considerations.