AI is secretly violating our privacy, awareness is key

Given that the role of artificial intelligence has grown so rapidly, it’s not surprising that issues like unauthorized incorporation of user data, unclear data policies, and limited regulatory safeguards have created significant issues with AI and privacy. When users of AI models input their own data in the form of queries, there’s the possibility that this data will become part of the model’s future training dataset. When this happens, this data can show up as outputs for other users’ queries, which is a particularly big issue if users have input sensitive data into the system.

In a now-famous example, three different Samsung employees leaked sensitive company information to ChatGPT that could now possibly be part of ChatGPT’s training data. Many vendors, including OpenAI, are cracking down on how user inputs are incorporated into future training. But there’s still no guarantee that sensitive data will remain secure and outside of future training sets. A growing number of personal devices use facial recognition, fingerprints, voice recognition, and other biometric data security instead of more traditional forms of identity verification. Public surveillance devices are also beginning to use AI to scan for biometric data so individuals can be identified quickly.

While these new biometric security tools are incredibly convenient, there’s limited regulation focused on how AI companies can use this data once it’s collected. In many cases, individuals don’t even know that their biometric data has been collected, much less that it is being stored and used for other purposes. When a user interacts with an ad, a TikTok or other social media video, or pretty much any web property, metadata from that interaction—as well as the person’s search history and interests—can be stored for more precise content targeting in the future.

For example, OpenAI’s privacy policy says it can “provide Personal Information to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, email communication software, web analytics services, and other information technology providers, among others. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.”

In this case, several types of companies can gain access to your ChatGPT data for various reasons as determined by OpenAI. It’s especially concerning that “among others” is a category of vendors that can collect and store your data, as there’s no information about what these vendors do or how they might choose to use or store your data.

OpenAI’s policy provides additional information about what data is typically stored and what your privacy rights are as a consumer. You can access your data and review some information about how it’s processed, delete your data from OpenAI records, restrict or withdraw information processing consent, and/or submit a formal complaint to OpenAI or local data protection authorities.

This more comprehensive approach to data privacy is a step in the right direction, but the policy still contains certain opacities and concerning elements, especially for Free and Plus plan users who have limited control over or visibility into how their data is used.