Loading story…
A U.S. court overseeing The New York Times copyright litigation ordered OpenAI to preserve ChatGPT output logs, including conversations users delete, as potential evidence. The preservation requirement creates a significant retention obligation for AI-service data that would ordinarily be subject to user deletion and minimization practices.
The order raises compliance concerns under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), which establish rights to deletion and impose limits on retaining personal data. Organizations using or building generative-AI services should review litigation-hold processes, data-retention disclosures, cross-border data handling, and procedures for responding to privacy-rights requests when records must be retained for legal claims.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
A court order involving OpenAI was reported as raising legal and privacy risks for AI companies. The reference does not specify the order's date or further details.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
kartalegal.com
Open sourceoag.ca.gov
Open sourceeur-lex.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI has implemented significant changes to its data retention policies for ChatGPT users following a legal dispute with major news organizations, including The New York Times. The lawsuit alleged that users were leveraging ChatGPT to bypass paywalls, often by using temporary or deleted chat logs, prompting a court order that required OpenAI to preserve these logs indefinitely. OpenAI initially resisted the order, citing user privacy concerns, but ultimately lost the legal battle. By July, news plaintiffs began reviewing the preserved logs, which contained only ChatGPT's outputs, while attempts by some users to intervene in the case were denied due to their status as non-parties. On September 26, OpenAI was permitted to cease the controversial practice of retaining all output log data that would otherwise be deleted, following a joint motion approved by US Magistrate Judge Ona Wang. However, some users' deleted and temporary chats remain subject to monitoring under the agreement. This development marks a shift in OpenAI's approach to user data privacy and legal compliance, as the company balances regulatory demands with user expectations. Concurrently, OpenAI has experienced a dramatic increase in AI bot traffic, particularly after the release of its GPT-5 model on August 5, 2025. According to Akamai, OpenAI's bots—including ChatGPT-User, GPTBot, and OAI-SearchBot—now account for the majority of AI bot traffic across major web applications and APIs, with overall traffic rising nearly 300% year-to-date. The release of GPT-5 led to a surge in activity: OAI-SearchBot traffic increased by 136%, ChatGPT-User by 65%, and GPTBot by 66% during August and September. These changes in bot behavior are attributed both to increased adoption of the improved GPT-5 model and to modifications in how the bots interact with external sources. The period following the legal settlement and the GPT-5 launch has been characterized by unusual and intensified bot activity, impacting organizations that rely on web and API security. OpenAI's evolving platform and policy landscape underscore the complex interplay between technological advancement, user privacy, and legal oversight. Organizations are advised to monitor these developments closely, as changes in OpenAI's data handling and bot operations may have direct implications for data privacy, compliance, and web infrastructure security. The ongoing adjustments to OpenAI's practices reflect broader industry trends in AI governance and the challenges of managing large-scale AI deployments in a rapidly changing regulatory environment. Security teams should remain vigilant for further changes in bot behavior and data retention practices as OpenAI continues to adapt to legal and market pressures. The intersection of legal action, user privacy, and technical innovation at OpenAI provides a case study in the evolving risks and responsibilities associated with AI-driven platforms.
Jun 29, 2026
ChatGPT and other AI-chatbot conversations are increasingly being introduced as evidence in U.S. criminal and civil cases because they generally lack attorney-client, medical, or therapist privilege. The Washington Post identified chatbot records in at least 12 public cases over two years; investigators and litigants may obtain them through consensual device searches, subpoenas, civil discovery, or provider disclosures in credible imminent-threat situations. In litigation over the 2020 Watson Grinding explosion in Houston, plaintiffs obtained about 350 pages of 3M expert witness Josh Autenrieth's ChatGPT history after he used the tool to prepare an expert report. The logs reportedly included prompts seeking to frame 3M as not at fault; a jury awarded $61 million and assigned 30% fault to 3M. Organizations and legal teams should treat AI-chat records—especially those used to develop expert opinions or containing confidential material—as potentially discoverable records, while recognizing that European discovery rules and GDPR constraints may limit comparable access.
Sep 2, 2026
The rapid adoption of generative AI chatbots, such as ChatGPT, is transforming both consumer and enterprise environments, with significant growth in usage and market value. These chatbots are being used for a wide range of applications, from customer service to code generation and mental health support. However, their increasing prevalence raises concerns about risks such as hallucinations, dangerous suggestions, and the need for robust guardrails to ensure safe deployment and use. Simultaneously, privacy concerns have emerged regarding how major technology companies, like Google, may use personal data to train AI models. Google recently denied allegations that it analyzes private Gmail content to train its Gemini AI model, following a class action lawsuit and public confusion over changes in Gmail's smart features settings. The company clarified that while smart features have existed for years, Gmail content is not used for AI model training, and any changes to terms or policies would be communicated transparently. These developments highlight the ongoing tension between AI innovation, user privacy, and the need for clear communication about data usage.
Jun 29, 2026