In February 2026, a federal judge in the Southern District of New York ruled that a criminal defendant’s conversations with Anthropic’s Claude carried no attorney-client privilege and could be seized by federal prosecutors as evidence. A month earlier, a different federal court ordered OpenAI to hand over 20 million de-identified ChatGPT conversation logs to The New York Times and other publishers in a copyright lawsuit — not a curated sample, but the entire batch the court demanded.
Neither ruling involved a hack or a leak. Both were ordinary legal process — subpoenas and discovery orders — applied to something millions of people now treat like a private notebook: their chat history with an AI.
What Actually Happened
The Claude ruling came from US District Judge Jed Rakoff, who found that a fraud defendant’s chat logs with Claude were not protected the way conversations with a lawyer would be, and ordered roughly 31 AI-generated documents turned over to prosecutors. The reasoning was straightforward: privilege protects specific relationships — attorney-client, doctor-patient — not “anything you typed into a piece of software.”
The OpenAI case is a different mechanism with a similar result. In a copyright dispute between OpenAI and news publishers, the court ordered the company to produce a large sample of ChatGPT logs from users who were never party to the lawsuit and were never asked. They simply had conversations that happened to sit in a dataset a court decided was relevant.
Together, these cases establish something that was previously more theoretical than concrete: AI conversation logs are discoverable. Not in some edge case — in ordinary criminal and civil litigation, the same way emails and text messages already are.
Why People Didn’t See This Coming
Talking to an AI chatbot feels conversational and private in a way that filling out a form or sending an email doesn’t. There’s no visible recipient, no sense of an audience, no reply that has to account for someone else’s feelings. That interface design — turn-taking, first-person address, a tone that adapts to you — creates a psychological experience closer to journaling or talking to a confidant than to using software.
But the underlying mechanics are closer to email than to a diary. Your messages are sent to a company’s servers, stored, associated with your account, and retained according to that company’s policies — which, for both OpenAI and Anthropic, explicitly state that users shouldn’t expect their inputs to remain private. That’s not a hidden clause; it’s published in plain terms. The gap is between what the policy says and what the interface makes you feel.
Legal privilege has never extended to “things I said to a piece of software I felt comfortable with.” It extends to specific, legally recognized relationships, built around professional duties of confidentiality that AI products don’t have and don’t claim to have.
Why This Matters Even If You’re Not in a Lawsuit
The OpenAI case is the more unsettling of the two for a simple reason: the people whose logs were produced weren’t accused of anything. They weren’t asked. They had no opportunity to object, because they weren’t parties to the case — their conversations were just data that existed in a place a court had authority to reach into.
This is the structural reality of centralized chat logs: once a large volume of conversations exists on a company’s servers, it becomes a single target that litigation, regulators, or law enforcement can reach with one request — rather than millions of separate, dispersed conversations that would each require individual justification. Consolidation that makes a product convenient also makes its contents easier to compel in bulk.
This isn’t unique to AI chatbots. Email providers, cloud storage services, and messaging apps have faced subpoenas for years. What’s new is the category of content people are now putting into chat — health questions they wouldn’t ask a doctor on record, relationship problems, draft messages they never sent, financial worries, half-formed business plans, things said in a moment of stress that wouldn’t survive being read back in a courtroom.
What This Doesn’t Mean
It’s worth being precise about what these rulings establish, because the natural reaction — “nothing I type anywhere is ever safe” — overshoots the actual lesson.
It doesn’t mean every chat is being read in real time. Subpoenas and discovery orders are legal processes tied to specific cases; they’re not surveillance, and the vast majority of conversations are never touched by litigation. The risk is conditional: it activates if you (or, in OpenAI’s case, an unrelated lawsuit your provider is involved in) become legally relevant.
It doesn’t mean AI companies are doing anything wrong by complying. Companies generally have to comply with valid subpoenas and court orders — that’s not optional, and treating compliance as a betrayal misreads how legal process works. The lesson isn’t “this company failed you.” It’s “this category of communication was never protected the way you assumed.”
It doesn’t mean the content disappears once a case is closed. Retention policies vary, but conversation history often persists well beyond any single legal event, which means the exposure window can be longer than the news cycle around any one ruling suggests.
Why Privilege Exists for Some Relationships and Not Others
It helps to understand why attorney-client privilege exists at all, because it clarifies why AI chat was never going to qualify automatically. Privilege isn’t a reward for confiding in someone — it’s a narrow legal carve-out the law grants to a small number of relationships specifically because society has decided the value of full disclosure (so a lawyer can actually defend you, so a doctor can actually treat you) outweighs the cost of that information being unavailable to a court.
That carve-out has always been narrow on purpose. Extending it broadly would mean enormous categories of evidence becoming permanently unreachable, which courts and legislatures have been reluctant to do even for relationships that feel obviously confidential, like talking to a close friend or a religious counselor outside specific recognized contexts. An AI chatbot, however natural the conversation feels, was never going to be added to that short list by default — it would require a deliberate legislative decision to create a new privilege category, which hasn’t happened and isn’t currently being seriously proposed.
Some companies have tried to manufacture a version of this protection contractually — promising not to use certain conversations for training, or offering “temporary chat” modes that aren’t retained the same way. Those are real, useful product features. They are not legal privilege, and they don’t change whether a court can compel production of what is retained. A company’s internal retention promise and a court’s subpoena power operate on entirely different levels, and only one of them is enforceable against the other.
What This Looks Like in Practice for an Ordinary Person
Most people will never be a party to a lawsuit involving their AI chat history. But the OpenAI case is instructive precisely because it shows the more common way ordinary users get swept in: not as defendants, but as bystanders whose data happened to sit inside a dataset that became relevant to someone else’s case.
This pattern already exists elsewhere — email providers and social platforms have handed over user data in response to subpoenas tied to litigation the user had nothing to do with, for years. AI chat platforms are simply the newest large pool of consolidated, searchable personal disclosure to be added to the list of places this can happen. The probability of any single person’s chats being specifically requested remains low. The point isn’t that it’s likely — it’s that “private” was never an accurate description of the underlying legal status, regardless of how unlikely any specific exposure event is.
How to Think About What You Put Into AI Chat
A simple, useful rule: treat conversations with an AI chatbot the way you’d treat an email to yourself, not the way you’d treat a conversation with a lawyer, therapist, or close friend with no paper trail.
That means a few practical adjustments:
Don’t use chat as a place to draft or store things you’d genuinely regret being read aloud in a courtroom or by an opposing party. If you wouldn’t put it in an email, the same caution applies here.
Separate sensitive personal records from conversational AI entirely. Medical details, financial documents, identification, photos of sensitive documents — these belong in storage built to hold files, not in a chat thread with a company whose core product is a model that processes language, and whose logs are exactly the kind of consolidated dataset that gets swept up in discovery requests.
Check what your AI provider’s terms actually say about retention and law enforcement requests. Most publish this; few people read it before their first conversation, which is exactly backwards.
The Bigger Shift
For most of the conversational interfaces people use daily — chat, messaging, AI assistants — the sense of privacy comes from the design of the interface, not from any legal or technical guarantee behind it. That gap has existed for years with email and texting. AI chat just inherited it, dressed in a more intimate-feeling interface, at a moment when people are pouring in more personal disclosure than they ever did into a search bar.
The rulings from early 2026 didn’t change the law so much as confirm what it already implied: AI conversation logs are ordinary business records, discoverable like any other, once stored on someone else’s servers. Knowing that doesn’t mean avoiding AI tools. It means being deliberate about what kind of content goes into a chat window versus what belongs in storage that isn’t built around being read, indexed, and produced on request.
For files, photos, and documents you actually need to keep private — not just feel private — daftei encrypts content in transit with TLS 1.3 and at rest with AES-256, never trains any AI on what you store, and never sells your data. It’s not a chat product, and it isn’t trying to be one. It’s a place built specifically to hold the things you don’t want sitting inside someone else’s conversation log.
See how daftei keeps your files separate from any AI training pipeline