OpenAI Preserves Deleted ChatGPT Logs Due to Court Order

OpenAI recently revealed that it has been preserving deleted and temporary ChatGPT chat logs since mid-May 2025. This move came in response to a federal court order issued on May 13, 2025, related to a copyright infringement lawsuit filed by The New York Times against OpenAI and Microsoft. The order requires OpenAI to retain all chat data, including those deleted by users, for potential legal review.

This revelation sparked significant user backlash, as many believed that deleting chats from ChatGPT would permanently erase their data. Social media users expressed concerns about privacy violations and the lack of transparency from OpenAI regarding the data retention practices.

OpenAI clarified that the preservation order affects ChatGPT Free, Plus, Pro, Team users, and API customers without zero data retention (ZDR) agreements. However, ChatGPT Enterprise, Edu users, and API clients using ZDR endpoints are exempt, and their deleted chats are properly removed. The retained data is securely stored under legal hold and accessed only by a limited number of legal and security personnel.

OpenAI's COO Brad Lightcap described the lawsuit's data retention demand as "baseless" and emphasized the company's commitment to user privacy. CEO Sam Altman publicly opposed the court order, calling it an "inappropriate request" that sets a dangerous precedent. Altman also introduced the concept of "AI privilege," suggesting that conversations with AI should have confidentiality protections similar to those between lawyers and clients or doctors and patients.

The legal battle is ongoing, with OpenAI appealing the order and requesting it be vacated. The court has indicated the order is temporary and has asked the parties to propose a sampling plan to determine if deleted data materially differs from retained logs.

Implications for Enterprises and AI Governance

For organizations deploying ChatGPT or similar AI tools, this development raises critical questions about data governance and compliance. Enterprises must carefully evaluate which ChatGPT plans and API endpoints they use to understand how user data is retained or deleted. Ensuring that internal policies align with OpenAI's retention practices is essential to mitigate legal and reputational risks.

Security teams should expand threat models to include legal discovery as a potential risk vector. Additionally, organizations need to verify that downstream systems such as analytics, backups, and logs do not inadvertently retain data presumed deleted by users.

This situation underscores the evolving challenges of AI privacy and data rights. OpenAI’s proposal of an "AI privilege" concept could redefine how confidential AI interactions are treated legally and ethically, but it remains to be seen if courts and policymakers will embrace this framework.

Looking Ahead

As AI becomes more embedded in enterprise workflows, the balance between legal compliance, user privacy, and trust will be increasingly delicate. Organizations must stay informed about regulatory developments and vendor policies to safeguard sensitive data and maintain transparency with users.

OpenAI’s ongoing appeal and advocacy for AI privilege highlight the urgent need for new legal and ethical standards governing AI data privacy. For now, enterprises should treat AI data retention policies as a critical component of their overall risk management strategy.