The privacy policies of ChatGPT, Claude, and Gemini are each about twenty pages of legal language, and almost nobody reads them — which is exactly how these companies prefer it, because the differences between them are significant enough to change how you'd use each platform if you understood what you were actually agreeing to.
I went through all three, plus independent audits and third-party comparisons, and the clearest finding is this: the platforms aren't equally private by default, the gaps between free and paid tiers are much larger than the marketing suggests, and Claude is the only one of the three that doesn't train on your conversations unless you explicitly say yes.
This is the second piece in our ongoing series on AI and personal privacy — the first covered what happens to your data the moment you hit send on ChatGPT or Gemini. This one goes deeper into the actual policies: what each platform collects, how long it keeps it, who can see it, and what you can actually do to limit exposure.
Side-by-Side Comparison: The Policies That Actually Matter
| Policy Area | ChatGPT (OpenAI) | Claude (Anthropic) | Google Gemini |
|---|---|---|---|
| What they collect | Conversations, device info, IP address, browser type, usage patterns, uploaded images/files. Mobile app may track third-party social media interactions. | Conversations, account info, usage data. Collection is generally limited to activities within the service itself. | Conversations, location, feedback, call logs and installed apps on mobile, screenshots if Gemini overlay is used. Connected to Gmail, YouTube, Search, Maps if signed in. |
| Training on your data (default) | ON by default. Opt out: Settings → Data Controls → "Improve the model." | OFF by default. Requires explicit opt-in to allow training use. If you clicked through an October 2025 prompt without reading it, you may have opted in — worth checking. | ON by default for consumer accounts. Opt out: Google Account → Data & Privacy → Gemini Apps Activity → Turn off. |
| How long conversations are stored | Until you delete them, then 30 more days. Enterprise: admin-controlled. | 30 days by default. If training is enabled: up to 5 years. | Consumer default: 18 months. Reviewed conversations: up to 3 years. Can be set to 3 or 36 months in settings. |
| Human review of conversations | Yes — OpenAI staff and third-party contractors. All plans including personal Plus. | Yes — Anthropic staff may review for safety. But scope is more limited than ChatGPT. | Yes — Google's trained reviewers. Reviewed data kept up to 3 years separate from your account. |
| Data scope | Extends beyond app use; may include web browsing and social media. | Limited to activities within the Claude service itself. | Broadest: integrates with your entire Google account history across Gmail, Search, Maps, YouTube. |
| Security certifications | "Commercially reasonable measures" — deliberately vague language. | SOC 2 Type II and ISO 42001 certified. Most rigorous of the three. | Strong infrastructure security, but limited specific certifications disclosed for Gemini consumer app. |
| Paid plan privacy upgrade? | Yes — Team/Enterprise plans have training off by default and admin controls. | Yes — API and enterprise plans have stricter isolation. Consumer Claude.ai Pro retains the same no-training default. | Yes — Workspace Business/Enterprise: no training on customer data by default. Consumer Gemini Advanced follows the same default-on training policy. |
| EEA/UK users | Excluded from some court-ordered data preservation obligations. | GDPR applies. Anthropic's European data handling is governed by separate documentation. | EEA/Switzerland/UK users get paid-tier data protections applied even on free consumer plans. |
ChatGPT: The Most Used, The Least Private by Default
ChatGPT's data practices aren't bad — they're just opt-out by design in ways that most people never change. Training is on by default. Chat history is saved indefinitely. Memory, when enabled, carries details about you across sessions — I tested this and it's remarkably persistent. You mention a client name once, reference "the project" a month later, and ChatGPT knows exactly what you mean. Convenient, and also a reason to think carefully about what you say near that feature.
The security language in OpenAI's policy is one of the weakest of the three platforms. The phrase "commercially reasonable technical, administrative, and organizational measures" shows up as their main security commitment — which, from a legal standpoint, means very little. It's a phrase that gives the company significant wiggle room and provides users very little assurance about what's actually happening to their data on the server side.
The Memory feature deserves a specific callout because it changes the privacy calculus significantly. When Memory is on, ChatGPT actively builds a persistent profile of you across sessions — your preferences, your projects, your stated circumstances. If you want to use ChatGPT without that ongoing accumulation, you need to either disable Memory explicitly (Settings → Personalization → Memory → Off) or use Temporary Chat for anything you don't want remembered. Neither of those is the default.
One thing ChatGPT does notably well: the controls, once you know where to find them, are actually functional. Turning off training is straightforward. Temporary Chat is easy to access. The problem is that the defaults work against you, and Tom's Guide's direct comparison of all four major chatbots noted that ChatGPT requires the most deliberate effort to use privately.
Claude: The Default Privacy Winner, With One Catch
Claude is the only one of the three mainstream AI chatbots that doesn't train on your conversations unless you explicitly opt in. That's a meaningful structural difference from the other two, which both default to training-on and require you to opt out. For anyone who uses AI for work, sensitive personal questions, or anything they'd prefer not to feed into a company's model, that default matters a great deal.
The security posture is also stronger than competitors. Anthropic holds SOC 2 Type II and ISO 42001 certifications — actual external audits of their controls, not just internal promises. Claude's data collection is also described as limited to activities within the service itself, without the cross-app data integration that makes Gemini's footprint so much larger.
The catch worth knowing: in October 2025, Anthropic sent a prompt to users that, if clicked through without careful reading, enabled training opt-in. Anyone who accepted that without understanding what they were agreeing to is now in a different data position than Claude's default — with retention potentially extending up to five years for training-enabled data, according to independent policy reviews. If you've been using Claude since late 2025 and aren't sure whether you clicked through that prompt, it's worth checking your settings at claude.ai and looking at the Privacy section.
The other honest limitation: Claude's conversation storage policy isn't as clearly documented as ChatGPT's. The 30-day default retention figure comes from independent analysis rather than a prominently disclosed number in Anthropic's own public-facing documentation, which is less transparent than it should be for a company positioning itself as the privacy leader in this category.
Gemini: The Broadest Data Footprint, Buried in Settings
Gemini's privacy situation is fundamentally different from the other two because of where it lives: inside your Google account. When you use Gemini, you're not just interacting with an AI chatbot — you're interacting with a service that can see your Gmail, your Search history, your YouTube viewing, your Maps location data, and your Chrome browsing, all in a unified profile. That's the trade-off for having AI that actually knows context about your life, and it's a real trade-off.
The retention periods are the longest of the three for most users: 18 months by default for conversations, and up to 3 years for conversations that have been reviewed by human reviewers. That 3-year figure applies even to conversations you've deleted from your account — the reviewed copy sits in a separate system disconnected from your Google profile. Google's own Gemini Apps Privacy Hub confirms this, and it's genuinely longer than what most users would expect.
On mobile, the data footprint expands further. The Gemini mobile app can access call logs, installed apps, and device usage patterns. When you use the Gemini overlay feature (the one that shows the AI what's on your screen), whatever's currently displayed gets captured. Most people using the overlay are thinking about the question they want to ask, not the fact that their banking app is open in the background.
The European exception matters here: if you're in the EEA, Switzerland, or the UK, Google applies the more protective paid-tier data handling to your account even on the free plan. If you're in the US or most other regions, the default consumer data practices apply, which means training-on and the 18-month retention baseline.
The Stuff None of Them Handle Well
There are a few things that are problems regardless of which platform you pick, and it's worth being honest about them.
Voice data is handled inconsistently and somewhat opaquely across all three. ChatGPT retains audio for as long as the chat exists. Claude sends voice to its servers, deletes audio within about 24 hours, but runs text-to-speech through a third-party provider (ElevenLabs) without a disclosed zero-retention arrangement. Gemini processes wake words locally but sends requests to Google's servers.
The legal discovery risk is real on all platforms. A 2026 federal case established that conversations with AI assistants are not protected by attorney-client privilege. If you're discussing anything with legal implications in any of these chatbots, those conversations are potentially discoverable in litigation — and as the 2025-2026 New York Times case showed, even deleted conversations can be preserved and handed over by court order.
And the trained-in-data problem applies everywhere: once your conversation has been used for model training, you can't un-train it. Deleting the conversation from your history doesn't remove what the model learned from it. "The right to be forgotten" doesn't really extend to model weights in any currently practical way.
What You Should Actually Do
- On ChatGPT: Turn off "Improve the model for everyone" in Settings → Data Controls. Disable Memory in Settings → Personalization if you don't need cross-session context. Use Temporary Chat for anything sensitive.
- On Claude: Check your privacy settings to confirm you didn't inadvertently opt into training via the October 2025 prompt. If you use the free consumer plan and didn't opt in, training is off by default and you're in a better position than on the other two platforms by default.
- On Gemini: Go to myaccount.google.com → Data and Privacy → Gemini Apps Activity → Turn off. Go to Gmail Settings and disable Gemini for Gmail separately if you don't want cross-service access. If you're on a US consumer account, change the auto-delete window from 18 months to 3 months in Gemini Apps Activity settings.
- For anything genuinely sensitive: None of these consumer platforms are appropriate. Consider local models (Ollama, LM Studio), or at minimum, enterprise-tier plans where no-training commitments are contractual rather than just a setting you toggled.
Frequently Asked Questions
Which AI chatbot is most private by default in 2026?
Claude (Anthropic) is the most private by default — it's the only mainstream AI chatbot that doesn't train on your conversations without explicit opt-in consent, and its data collection is limited to activities within the Claude service rather than drawing on cross-app data like Gemini does.
Does Gemini access my Gmail and Google Search history?
Yes, when you're signed into your Google account, Gemini can access and connect data across Gmail, Search, Maps, YouTube, and Chrome. You can control this through Google's Personal Intelligence dashboard in Gemini settings, and you can disable Gmail access separately via Gmail Settings → General → Gemini for Gmail.
How long does each AI platform keep my conversations?
ChatGPT keeps conversations until you delete them, then 30 more days. Claude keeps conversations for 30 days by default, up to 5 years if training is enabled. Gemini keeps consumer conversations for 18 months by default and retains human-reviewed conversations for up to 3 years in a separate system.
Can I stop AI chatbots from training on my conversations?
Yes on all three, but the process differs — ChatGPT requires you to opt out in Settings → Data Controls, Gemini requires turning off Gemini Apps Activity in your Google account, and Claude is opt-out by default (you have to actively enable training, which is the reverse of the other two).
Is paying for a premium AI plan actually more private?
For business and enterprise tiers, significantly yes — ChatGPT Team/Enterprise and Google Workspace Business/Enterprise both disable training on your data by default and add admin controls and contractual data handling commitments. Consumer paid plans (ChatGPT Plus, Gemini Advanced) follow largely the same default policies as free plans, with the exception of Claude, where the Pro plan maintains the same no-training-by-default approach as the free version.