OpenAI vs. New York Times: Whose Data Is Really at Risk?

Remember the Apple vs FBI dispute, where the government demanded Apple help unlock an iPhone tied to a terrorism case? Apple refused, warning that creating such a workaround would risk the privacy and security of all iPhone users. Fast forward to today, a similar standoff is unfolding—this time between OpenAI and The New York Times. While it’s not about unlocking phones, it’s still a battle over access, privacy, and control over data. And just like before, the lines between right and wrong aren’t so clear.

The New York Times has taken OpenAI and its major investor Microsoft, to court, alleging that the popular AI platform is engaging in plagiarism. Specifically, the Times claims its copyrighted material was used unlawfully to train OpenAI’s GPT language models.

The lawsuit states:

“Defendants’ unlawful use of The Times’s work to create artificial intelligence products that compete with it threatens The Times’s ability to provide that service. Defendants’ generative artificial intelligence (“GenAI”) tools rely on large-language models (“LLMs”) that were built by copying and using millions of The Times’s copyrighted news articles, in-depth investigations, opinion pieces, reviews, how-to guides, and more... Defendants seek to free-ride on The Times’s massive investment in its journalism by using it to build substitutive products without permission or payment.”

In response, OpenAI stated on its blog:

“The New York Times and other plaintiffs have made a sweeping and unnecessary demand in their baseless lawsuit against us: retain consumer ChatGPT and API customer data indefinitely. This fundamentally conflicts with the privacy commitments we have made to our users... We strongly believe this is an overreach by the New York Times. We’re continuing to appeal this order so we can keep putting your trust and privacy first.”

OpenAI has offered a sample of 20 million chat records to the court, but The New York Times rejected the offer, demanding access to chats from the full 120 million ChatGPT users. The core allegation is copyright infringement, but what’s raising eyebrows among users is the realisation that even prompts they thought were deleted may still be stored on OpenAI’s systems.

So, whose data is at risk, exactly?

OpenAI has clearly stated that if you are a user of ChatGPT Free, Plus, Pro, or Team subscriptions—or use the OpenAI API without a Zero Data Retention (ZDR) agreement—your data may be subject to retention under this legal order.

However, there are exceptions:

• ChatGPT Enterprise and ChatGPT Edu users: Your data is controlled by workspace admins and is not shared.
• API users with Zero Data Retention: Inputs and outputs are never logged and are not retained.

OpenAI’s data handling policy

• When you delete a chat (or your account):
  The chat is removed from your account immediately and scheduled for permanent deletion within 30 days, unless OpenAI is legally required to retain it for security or legal purposes.
• ChatGPT Team:
  Each end user controls whether their conversations are retained. Any deleted or unsaved chats are removed from OpenAI’s systems within 30 days, unless legal obligations require otherwise.
• ChatGPT Enterprise and Edu:
  Workspace admins determine data retention policies. Deleted chats are also removed within 30 days unless legally required to be kept.
• API Users:
  Business users control data retention based on endpoints and configurations. After 30 days, API inputs and outputs are removed from OpenAI logs unless legally required otherwise.
• Zero Data Retention API:
  For users who’ve enabled ZDR endpoints, data is never stored or logged.

So how long will OpenAI keep this data?

• Currently, due to the court order, OpenAI is required to retain consumer ChatGPT and API data going forward.
• However, OpenAI is actively appealing the order, and if successful, it will return to its standard data retention policies.

How is this data stored, and who can access it?

• The retained content is stored in a secure, separate system under legal hold. It cannot be accessed or used for anything beyond legal compliance.
• Only a small, audited team from OpenAI’s legal and security departments can access the data, and only for legal obligations.

Will this data be shared with The New York Times or others?

• No, this data is not automatically shared with The New York Times or any other parties.
• It is locked under legal hold, and OpenAI has stated it will fight to protect user privacy if plaintiffs continue to seek access.

Read More: OpenAI Fights to Limit NYT’s Access to 120 Million ChatGPT Logs