ChatGPT Privacy Guide

Privacy score: 50/100. Transparency score: 60/100. Overall 52/100 (Not Recommended), reviewed 2026-06-29 and fact-checked against OpenAI's documentation on 2026-08-24.

What the vendor documents (verified)

• Training on conversations. Consumer chats may be used to improve models depending on your settings. "Improve the model for everyone" can be switched off in Settings → Data Controls; turning it off does not delete existing history.
• Temporary Chat. Conversations started in Temporary Chat are not used to train models.
• Memory. ChatGPT can retain details across conversations. Memory can be reviewed, edited, and cleared in settings.
• Retention. Deleted conversations are removed from OpenAI's systems within 30 days unless retained for legal or security reasons.
• Business, Enterprise and Edu. Inputs and outputs from these tiers are not used to train models by default, and OpenAI publishes enterprise privacy commitments and a data processing addendum.
• Age. 13+, or the local digital-consent age where higher, with parental permission under 18; 13-17 year olds are placed into ChatGPT for Teens.

What this means for a family

The default consumer configuration is not privacy-protective for a child. Three settings changes do most of the work:

1. Data Controls → turn off "Improve the model for everyone."
2. Use Temporary Chat for anything sensitive.
3. Review and clear memory periodically, especially names, school, and location details.

Then teach the rule that outlasts any setting: never type your full name, address, school, phone number, passwords, or images of yourself or friends into a chatbot.

What this means for a school (SafeGradeAI assessment)

A consumer ChatGPT account is not an appropriate place for student data — there is no school agreement, no admin console, and no district data controls. If a district wants ChatGPT, the only defensible path is ChatGPT Edu or Enterprise with a signed data processing addendum, a completed privacy review, and documented age eligibility for the students involved.

Compliance framing: the consumer product is outside COPPA's intended scope because it excludes under-13s rather than serving them with verifiable parental consent; FERPA obligations require a school-official agreement the consumer tier does not provide; GDPR transfers rely on the DPA and standard contractual clauses; EU AI Act general-purpose-model transparency obligations apply to the provider, not to your district's use.

The residual risks settings cannot fix

• Anything a student types is a disclosure, regardless of the training setting.
• Age assurance is self-declared plus estimated, so protections can be bypassed.
• A shared or second account has none of the family's configuration applied.
• Screenshots and copy-paste move data out of the platform entirely.

What this article does not claim

Findings labelled as vendor-documented come from OpenAI's own public documentation, linked in Sources below and last checked on the date shown. Anything framed as an assessment is SafeGradeAI's professional guidance. Defaults change frequently — re-check before a district-level decision.

---

Read the full ChatGPT evaluation and rubric scores · ChatGPT parent guide · ChatGPT FAQs