We may earn money or products from the companies mentioned in this post.
Disclosure: This article contains affiliate links. If you sign up for a product through one of these links, AI for Law Firms may earn a commission at no extra cost to you.
Most lawyers who ask “Is ChatGPT safe for client data?” really have a narrower question in mind: which AI plan, configured how, can hold client information without breaching my duty of confidentiality? The vendor’s own terms answer most of it. Training defaults, retention, admin controls, and who counts as the “customer” all change from one plan tier to the next. The price of the plan often tells you less than whether it is a personal account or one your firm manages.
This guide sets out what OpenAI, Anthropic, and Microsoft publicly say about each tier and how ABA Formal Opinion 512 applies that to your duties. It ends with a short decision framework you can bring to your managing partner, or use yourself if you’re a solo.
Not legal advice. This article is general information about vendor terms and ethics guidance as of October 2026. Vendor terms change, and your jurisdiction’s rules control. Read the current terms and your state’s opinions before you act.
The short answer: consumer plans vs. business plans
The line that matters most is whether the plan is a consumer product or a business (commercial) product. It matters more than free vs. paid.
- Consumer plans (ChatGPT Free, Plus, Pro; Claude Free, Pro, Max): by default, the vendor may use your content to improve its models unless you opt out. Your firm has no admin control over the account.
- Business plans (ChatGPT Business and Enterprise; Claude Team and Enterprise; Microsoft Copilot under an organizational Entra account): the vendor commits that it will not train on your content by default, and the account belongs to your organization.
Here is what each vendor publishes.
OpenAI: ChatGPT Free, Plus, Pro vs. Business, Enterprise, API
OpenAI’s help center says this about its individual plans:
“When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models. You can choose whether your conversations help improve our models. To opt out, turn off Improve the model for everyone under Settings > Data controls…”
Two points in the same article are easy to miss. First, opting out does not cover feedback: “If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models.” One thumbs-up on a client-related chat can pull that whole conversation back into training. Second, “Temporary chats are not used to improve OpenAI models while they remain temporary.”
For business products, the default flips:
“By default, we don’t use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models.”
Source: OpenAI Help Center, “How your data is used to improve model performance”. OpenAI’s Enterprise privacy page covers the business commitments in more detail.
What this means in practice: a Plus or Pro subscription is still a personal account, even though you pay for it. A paid personal account gives your firm no admin console, no central retention settings, and no way to recover the account if a lawyer leaves. For firm work with client information, a Business or Enterprise workspace is the minimum tier worth evaluating.
Anthropic: Claude Free, Pro, Max vs. Team, Enterprise, API
Anthropic’s privacy center separates “commercial” products from consumer ones. For commercial offerings, which it lists as “Anthropic API, Console, Claude for Work (Team & Enterprise plans),” it states:
“We will not use your chats or coding sessions to train our models, unless you choose to participate in our Development Partner Program.”
Feedback is the exception here too: “If you explicitly report materials to us (e.g. via our thumbs up/down feedback mechanisms), or by otherwise explicitly opting in to training, then we may use those materials to train our models.”
Source: Anthropic Privacy Center, “How do you use personal data in model training?”
Anthropic’s pricing page lists model training as “Opt-out” for Free, Pro, and Max, and “None by default” for Team and Enterprise. The same page shows the admin gap. Consumer plans have no SSO or central administration. Team adds SSO, central billing, and admin controls for connectors. Audit logs, custom data retention controls, and a “HIPAA-ready offering” appear only on Enterprise.
Microsoft: Copilot with enterprise data protection
Microsoft has renamed “Microsoft 365 Copilot” to “Microsoft Copilot,” which makes the naming confusing. What matters is whether the user is signed in with an organizational (Entra) account. If so, Microsoft says its use “is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor,” and:
“the prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models.”
Microsoft’s page also has a caveat lawyers should note. Web search queries sent to Bing fall under a different agreement, and for those queries Microsoft “acts as an independent data controller.” Microsoft also notes that HIPAA compliance “doesn’t apply to web search queries.” If a prompt includes client facts and Copilot grounds it with a web search, part of that prompt leaves the DPA’s protection.
Source: Microsoft Learn, “Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat”. For workflows built on this, see our guide to Copilot workflows that keep data inside your tenant.
Comparison table: training defaults by plan
| Vendor / plan | Trains on your content by default? | Firm-managed admin? | Source |
|---|---|---|---|
| ChatGPT Free / Plus / Pro | Yes, unless you opt out (feedback can still be used) | No | OpenAI Help Center |
| ChatGPT Business / Enterprise / API | No, by default | Yes | OpenAI Help Center |
| Claude Free / Pro / Max | Opt-out (user choice) | No | Anthropic pricing page |
| Claude Team / Enterprise / API | No, unless you opt in or send feedback | Yes (audit logs and custom retention on Enterprise only) | Anthropic Privacy Center, pricing page |
| Microsoft Copilot (Entra account) | No, for prompts, responses, and Graph data | Yes | Microsoft Learn |
Check each source again before you rely on it. All three vendors update these pages often.
Why “not used for training” isn’t the whole answer
Training exclusion stops your client’s facts from shaping the model that everyone else uses. It does not mean:
- The data isn’t stored. Chat history, memory features, projects, and custom GPTs or skills can all keep content after the conversation ends.
- Nobody can access it. Business terms generally allow limited vendor access for security, abuse monitoring, or legal compliance. Read the specific terms.
- It’s privileged. Using a tool doesn’t make content privileged, and careless use can create waiver arguments.
- It’s safe from your own mistakes. Shared conversation links, connectors to your document management system, and browser extensions can each expose client data, whatever the vendor’s training policy.
That is why the ethics opinions focus on whether your precautions are reasonable, not on any single setting.
What ABA Formal Opinion 512 requires
ABA Formal Opinion 512 (July 29, 2024) is the national baseline. On self-learning tools it says:
“because many of today’s self-learning GAI tools are designed so that their output could lead directly or indirectly to the disclosure of information relating to the representation of a client, a client’s informed consent is required prior to inputting information relating to the representation into such a GAI tool.”
On how to get that consent:
“To obtain informed consent when using a GAI tool, merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient.”
Source: ABA news release on Formal Opinion 512. Our ABA Formal Opinion 512 policy template turns the opinion into a firm policy.
State opinions follow the same pattern. Texas Opinion 705 says a lawyer “should be reasonably satisfied that the program will not reveal confidential information to others or permit the use of such information to the disadvantage of the client,” and, if not, should “not input any confidential information to the program without client consultation and consent” (Texas Opinion 705). Florida Opinion 24-1 tells lawyers to research “the program’s policies on data retention, data sharing, and self-learning” and recommends informed consent before using a third-party generative AI program that would involve disclosing confidential information (Florida Bar Ethics Opinion 24-1). For your state, see our AI ethics rules by state hub.
Low-risk uses (no client data at all)
The safest prompt has no client information in it. These uses are generally low risk on any plan:
- Building a checklist of elements for a claim in a named jurisdiction
- Drafting a generic template clause or engagement-letter section
- Explaining a legal concept in plain English for client communications
- Creating training scenarios with fictional facts
- Reorganizing or summarizing public documents
Then apply the generic output to the real matter in your own systems. Any authority it produces still has to be checked. See our citation verification workflow.
Higher-risk uses (client data involved)
Once you paste in client communications, settlement positions, medical or financial records, or strategy, you need:
- A firm-managed business or enterprise plan with no training by default.
- An understanding of retention, history, memory, and connector settings for that account.
- Informed, matter-specific client consent where your jurisdiction’s guidance calls for it. Under Opinion 512, that means more than boilerplate.
- A check of any protective order, client outside-counsel guidelines, or regulatory limits (HIPAA, for example) that restrict where data can go.
Some matters call for extra caution on any plan: criminal defense, domestic violence, juvenile matters, trade secrets, active government investigations, and anything under a protective order that limits third-party processing.
Data minimization beats “the perfect tool”
Removing names doesn’t anonymize a matter. A rare procedural posture, a small town, or an unusual injury can identify a client on its own. Practical habits:
- Upload only the clause, excerpt, or page range the task needs.
- Replace identifying combinations of facts, not just names.
- Turn off memory, and avoid shared links, for client work.
- Connect document systems only with matter-level permissions.
For document uploads, an AI-assisted redaction tool like Redactable can strip identifiers and metadata before the file reaches a chatbot.
Our checklist on redacting client details before you prompt walks through this step by step.
Legal-specific AI platforms
Legal research platforms with built-in AI (Clio Work, CoCounsel, Lexis+ AI, and others) are built around legal content and sold on business terms. Clio, for example, states that Clio Work client files “are processed under strict zero data retention (ZDR) agreements and are never used to train public AI models” (Clio Work product page). Treat any vendor’s marketing claim as a starting point. Get the data-processing terms for your tier in writing. Our comparison of legal AI software data-security terms covers what to look for, and Copilot vs ChatGPT for confidential matters compares the two general-purpose options. If AI features are part of a practice management decision, our best legal practice management software roundup compares plans and pricing.
A five-question test before client data goes in
- Is this a firm-managed business account, or someone’s personal subscription?
- What do the current terms say about training, including feedback?
- What is retained, for how long, and can we delete it? (history, memory, files, logs)
- What else is connected? (web search, connectors, plugins, browser extensions)
- Does the client know and agree, where your jurisdiction’s guidance calls for consent?
If you can’t answer all five in writing, keep client data out of the tool.
Frequently asked questions
Is ChatGPT Plus safe for client data?
Plus is an individual plan. OpenAI says it may use content from Free, Plus, and Pro to train models unless you opt out, and feedback can still be used after you opt out. It also gives your firm no admin control. Most firms should not use it for confidential client information.
Does Claude Team train on our data?
Anthropic says it will not train on chats from commercial products, including Team and Enterprise, unless you join its Development Partner Program, opt in, or submit feedback.
Is Microsoft Copilot safe for confidential matters?
With an organizational account, Microsoft says prompts, responses, and Graph data aren’t used to train foundation models and are covered by its DPA. Web search queries sent to Bing are handled under separate terms, so think about web grounding for sensitive prompts.
Do I need client consent to use AI?
ABA Formal Opinion 512 says informed consent is required before you put client information into self-learning tools that could disclose it, and that boilerplate isn’t enough. State guidance varies, so check your jurisdiction.
Key takeaways
- The key split is consumer vs. business plan, not free vs. paid.
- OpenAI, Anthropic, and Microsoft all say their business tiers don’t train on customer content by default. Each has exceptions to check, such as feedback and web search.
- “Not used for training” doesn’t mean not stored, not accessible, or privileged.
- Opinion 512 makes the lawyer responsible for confidentiality. Boilerplate consent isn’t enough.
- Data minimization and firm-managed accounts do more than any single vendor promise.