Have you ever stopped to consider what someone would find if they could see your internet search history? You might be embarrassed by what would be revealed. Most people don’t think twice about asking ridiculous, embarrassing, or even deeply personal questions:
“Why is my goldfish not swimming?”
“What’s the best place for sushi in Mexico City?”
“What rhymes with fart?”
But very little of our life on the internet is private. And nowhere is that more misunderstood than with AI tools like ChatGPT or Claude.
The core problem is the gap between how people experience AI and what’s actually happening. The conversational interface feels private – like talking to an advisor, a therapist, or no one.
Legally, it may be closer to speaking on a recorded line.
Recently, a case out of the Southern District of New York should raise every lawyer and client’s spidey senses about using AI. Conversations with AI may not be as insulated as they seem, and they may be discoverable, particularly depending on the subscription tier being used.
Roadmap
I. What Is Discovery / Attorney-Client Privilege / Work Product Doctrine?
II. History: Your Deleted ChatGPT Logs Are Discoverable - New York Times v. OpenAI/Microsoft
III. Fast Forward: AI Searches Can Destroy Privilege?! - United States v. HeppnerIV. Digging into the Terms of Service, Privacy, and Usage Policies of Claude and ChatGPT
V. What the Heppner Ruling Didn’t Address
VI. Potential Ways to Mitigate Risk
VII. Public Policy Thoughts
VIII. SourcesI. What Is Discovery / Attorney-Client Privilege / Work Product Doctrine?
Let’s start with the basics.
A) Discovery
When a lawsuit is filed, the parties enter a phase called discovery—the pretrial process where each side must formally exchange relevant, non-privileged information and evidence to evaluate claims and defenses. My Cousin Vinny provides a helpful illustration of how discovery works:
Discovery is designed to ensure both sides have access to the facts before resolution or trial. Because discovery is broad, the law also recognizes important limits. Two of the most significant limitations are (i) the Attorney-Client Privilege and (ii) the Work Product Doctrine.
B) Attorney-Client Privilege (A-C Privilege)
A-C Privilege is a rule that protects confidential communications (oral, written, or electronic) between a client and their attorney made for the purpose of seeking or providing legal advice. The privilege protects both individuals and institutions. For example, communications between Vandeley Industries employees and Vandeley attorneys are protected if they are made in confidence and for the purpose of seeking legal advice about Vandeley’s legal matters. When the privilege applies, those communications cannot be disclosed to opposing parties or required to be produced in legal proceedings (with some exceptions).
C) Work Product Doctrine (The WPD)
The WPD protects materials prepared by or at the direction of an attorney in anticipation of litigation. Unlike A-C Privilege, it focuses on documents and strategy (notes, memos, research, etc.). In rare cases, it can be overcome if the opposing party shows a substantial need and inability to obtain the equivalent without undue hardship.
Why do we have privilege?
The A-C Privilege exists for a very practical reason: the legal system works better when clients can speak openly and honestly with their lawyers. If people fear that anything they tell their attorney could later be exposed in court, clients would be more likely to withhold facts, soften details, or avoid seeking legal advice altogether. That prevents attorneys from fully understanding the situation and providing effective representation. In this way, the privilege not only protects the client’s interests but also supports the fair administration of justice.
What are the limits to privilege?
Many clients assume that if a lawyer is involved in any conversation or copied on an email, the communication is automatically protected. However, that’s not always the case. The primary purpose of the exchange must be to seek or deliver legal guidance—not merely to discuss business strategy, operational decisions, or general information in the presence of counsel.
Additionally, you can lose the A-C Privilege when:
The communication is shared with a third party (called waiver).
There was no intent for the communication to be confidential.
The advice was used to further a crime or fraud (crime-fraud exception).
The client puts the advice “at issue” in litigation (e.g., “I relied on my lawyer’s advice”).
How far does privilege extend in terms of legal tools and service providers?
Not every disclosure to a third party automatically destroys A-C privilege.
Under United States v. Kovel, the protection may extend to third parties who are engaged to assist counsel in providing legal advice, so long as they are retained for that purpose, operate under the attorney’s supervision and direction, and are bound by confidentiality obligations. Courts have consistently applied this doctrine to professionals such as forensic consultants, translators, and e-discovery vendors when their involvement is necessary to facilitate legal representation.
The same principle applies to the WPD. It does not cover every document a lawyer touches; it protects materials prepared by or at the direction of counsel in anticipation of litigation. This means the material must be created because of a real and identifiable prospect of litigation—not merely as part of routine business operations or general risk management. Documents created in the ordinary course of business, even if reviewed by a lawyer, may not qualify. These protections are specific and conditional — not automatic or absolute.
II. History: Your Deleted ChatGPT Logs Are Discoverable - New York Times v. OpenAI/Microsoft
In N.Y. Times Co. v. Microsoft Corp. (2023), pending in the Southern District of New York, the Times alleged that OpenAI and Microsoft used millions of its articles without permission to train AI models like ChatGPT, which can at times reproduce or closely paraphrase its reporting in ways that threaten subscriptions and paywalls. OpenAI and Microsoft denied infringement, arguing that training on publicly available text was fair use because the models learn linguistic patterns rather than store or republish articles, and that verbatim outputs are rare and unintended. See a previous post for more information.
As the case progressed, discovery became a central battleground. The Times sought access to up to 120 million user chat logs; the court ultimately ordered production of a smaller, anonymized sample of roughly 20 million conversations under a protective order. OpenAI argued discovery should be limited to chats tied to specific Times articles or exemplar prompts, but the Times contended it needed broader data to assess how the models function in real-world use and whether they generate Times-like content at scale. The court rejected OpenAI’s narrower proposal, holding that privacy concerns do not automatically bar discovery of relevant electronic data where safeguards are in place.
The case also raised issues about preserving and deleting data. At one point, the court required OpenAI to preserve and separate certain ChatGPT log data that would normally have been deleted—including conversations users thought they had already deleted.
This ruling highlights a tension between what users expect and what the law requires during litigation. Even if a platform makes conversations temporary, the underlying data may have to be kept once there is a legal duty to preserve it as evidence.
More broadly, it underscores an important point for both AI companies and users: even deleted conversations may not be fully or immediately erased.
III. Fast Forward: AI Searches Can Destroy Privilege?! - United States v. Heppner
I’m sure most lawyers at this point have had a client put whatever they said into an AI chat or use AI to try to teach their own lawyers. Well, this case is a bit of schadenfreude for legal eagles….
Bradley Heppner, a financial executive facing fraud charges, used the consumer version of Anthropic’s Claude after receiving a grand jury subpoena. He input information he had learned from his defense counsel, generated 31 AI-produced documents, and sent them to his lawyers. The FBI later seized those materials during a search.
Heppner argued they were privileged.
Judge Rakoff disagreed. The ruling turned on several key principles:
Routing AI material through counsel does not create privilege. Simply sending AI-generated documents to a lawyer does not automatically shield the client from discovery.
Independent research is not privileged. A client’s self-directed research—whether Googling case law, drafting personal notes, or posing legal questions to an AI platform—does not become protected simply because it relates to a legal issue. If the work was not prepared by or at the direction of counsel, and is not itself a communication seeking legal advice, it may be discoverable.
AI tools are not lawyers. No attorney directed the AI use, and AI platforms cannot form A-C relationships.
The purpose was not to obtain legal advice from counsel. The documents were generated through Claude, which expressly disclaims providing legal advice, undermining any claim that the communications were made for the purpose of seeking legal counsel.
There was no reasonable expectation of confidentiality. Anthropic’s policies permitted disclosure to government authorities and use of data for model training, defeating any claim that the communications were confidential.
Privilege cannot be created after the fact. Sending AI-generated documents to counsel did not retroactively cloak them in privilege, and the work product doctrine did not apply because the lawyers had not directed the AI research.
As the Casey Anthony trial demonstrated years ago, even internet search histories can become evidence. AI prompts are simply a more sophisticated version of the same concept.
So here’s the bigger question:
If using a consumer AI platform can defeat privilege, would the result change if the same client used an enterprise AI system with stricter confidentiality terms, limited training usage, and more targeted data controls?
IV. Digging into the Terms of Service, Privacy, and Usage Policies of Claude and ChatGPT
Let’s review the ToS for the consumer v enterprise versions of Claude and ChatGPT.
A) Claude
B) ChatGPT
Training & Privilege Risk (Consumer vs. Enterprise)
Consumer plans may use inputs/outputs for training unless users opt out; business/enterprise plans are opted out by default. However, both permit internal access for safety, security, abuse prevention, and legal compliance. Courts have not yet addressed how these commercial AI arrangements affect A-C privilege. Because companies can access data internally in some situations, parties in litigation may argue that these communications are not completely private.Disclosure of Confidential Information
Both platforms allow disclosure when legally required. Claude states it will coordinate with Enterprise administrators to narrow compelled disclosures; OpenAI says it will make reasonable efforts to notify customers where permitted. Still, these policies do not remove the risk of subpoenas or discovery in lawsuits. Organizations should pay close attention to provider notices, especially if litigation is expected or ongoing.Data Retention Controls
Claude Enterprise offers clearer, configurable retention settings (e.g., minimum 30-day retention). OpenAI retains data “as long as needed,” with deletion subject to legal and security exceptions. While deleting data can lower risk, it does not completely eliminate it because AI companies may still have to keep information for legal or compliance purposes.Webpage Structure, Contract Complexity, and Enforceability
Claude’s policies are spread across several different documents, which can make them harder to follow. OpenAI’s policies are more centralized and organized by user type, though they are still divided across multiple documents. This structure can create confusion in litigation, especially when questions about privilege, confidentiality, and data access depend on how different provisions interact. It may also raise enforceability questions if certain terms appear only in a privacy policy—which is typically a notice rather than a contract—or on informational webpages outside the formal terms of service.
V. What the Heppner Ruling Didn’t Address
Heppner involved a criminal defendant using a consumer AI platform on his own initiative, without attorney involvement. However, the court did not address how the analysis might change under different facts, including:
Whether an enterprise version of Claude (or equivalent AI tool) that contractually guarantees confidentiality, prohibits training use, and provides data isolation could preserve the reasonable expectation of confidentiality required for privilege.
Whether an AI tool directly used by an attorney as part of legal analysis, similar to a research database or litigation support tool, would be treated differently.
Because the decision leaves these questions unanswered, there is no clear rule governing how privilege applies to attorney-supervised AI use or enterprise systems. This uncertainty does not mean privilege is automatically lost, but it does mean lawyers and clients must proceed carefully.
VI. Potential Ways to Mitigate Risk
Commercial-grade tools offer more protection but still require caution. Consumer-grade AI platforms generally do not provide the same level of contractual confidentiality protections as enterprise agreements, and even where users opt out of model training, other data access, retention, or disclosure provisions may still apply.
Don’t enter anything you don’t want seen. Sensitive information entered into these systems may not receive the same protections as communications made directly within the A-C relationship. In an abundance of caution, users should assume that information submitted to consumer platforms could be retained, accessed, or disclosed beyond their immediate control.
A) Considerations for Non-Lawyers (Clients)
Leave legal questions for the attorneys. Legal questions should be directed through attorneys, rather than having clients—or, in a business setting, managers or employees—independently rely on AI tools to conduct their own legal assessments outside of attorney direction. If research is conducted, documentation should clearly reflect that it was performed at the direction of counsel, demonstrating that the attorney was involved in and supervising the process.
Privilege isn’t magic. You have to work to keep it….Sending unprivileged AI-generated material to your lawyer does not retroactively make it privileged.
Be cautions with sensitive matters. Exercise extreme caution when using AI in connection with sensitive matters, especially for HR decisions, workplace complaints, investigations, or regulatory issues. Having a good AI policy in place at your company is key.
B) Considerations for Lawyers
Educate clients that AI usage may waive privilege or generate discoverable material. Clients should be cautioned against using consumer-grade generative AI platforms to analyze privileged or sensitive legal matters, as such platforms often retain, process, or train on user inputs. If you learn that a client is independently using AI to assess their legal situation, address the issue immediately and provide clear guidance.
Attorneys must also exercise caution with the information they input into large language models. Identifiable or sensitive client information should not be entered into AI systems unless adequate safeguards are in place. When AI tools are necessary, enterprise-level applications should be used where possible—particularly those that limit data retention, prohibit model training on user inputs, and impose strict contractual limits on use and disclosure. Lawyers should also understand and manage platform retention policies, including adjusting privacy settings and deleting prompts or histories where permitted.
VII. Public Policy Thoughts
From a public policy perspective, especially given longstanding access-to-justice challenges, courts should not penalize individuals for researching their own legal issues. Legal representation is often unaffordable, so many people turn to available tools not to replace lawyers, but to understand when they need one. Just as consulting WebMD reflects a desire to be informed, the law should not discourage individuals from educating themselves about their rights.
Informed clients make better decisions, participate more effectively in the legal process, and are less likely to act out of panic or misinformation. The real concern is not self-education, but ensuring that the tools people use do not unintentionally undermine legal protections like A-C privilege.
Privilege should not hinge on technological literacy. Expanding waiver doctrine, as in Heppner, would disproportionately harm less sophisticated users who lack knowledge about data storage or platform practices or perhaps the funds to purchase an enterprise-grade version. If routine internal platform access defeated confidentiality, the same logic could threaten email, cloud storage, and other essential communication tools—an outcome courts like Kovel have rejected by recognizing that necessary intermediaries do not destroy privilege.
The justice system functions best when people have tools that help them engage with it responsibly. Research from The Bail Project similarly shows that supportive measures—such as reminders and transportation assistance—improve court participation. AI can serve a comparable supportive function: it does not replace lawyers, but helps individuals better understand and navigate the system. People engage more responsibly when given tools that promote clarity, not when barriers are raised.
When structured to preserve privilege, AI enhances meaningful participation without displacing professional representation. Public policy should reflect that reality by integrating modern tools in ways that expand access to justice while safeguarding core legal protections.
VIII. Sources
United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). https://law.justia.com/cases/federal/appellate-courts/F2/296/918/131265/
N.Y. Times Co. v. Microsoft Corp., et al., No. 1:23-cv-11195 (S.D.N.Y. filed Dec. 27, 2023). https://nytco-assets.nytimes.com/2023/12/NYT_Complaint_Dec2023.pdf
Motion for a Ruling that Documents the Defendant Generated Through an Artificial Intelligence Tool Are Not Privileged, United States v. Heppner, No. 25 Cr. 503 (JSR), Doc. 22 (S.D.N.Y. Feb. 6, 2026). https://storage.courtlistener.com/recap/gov.uscourts.nysd.652138/gov.uscourts.nysd.652138.22.0.pdf
Pete Brush, AI Docs Sent By Exec to Attys Not Privileged, Judge Says, Law360 (Feb. 11, 2026). https://www.law360.com/pulse/legal-tech/articles/2440082
Wednesday Testimony Delved into Internet Searches on Casey Anthony’s Computer, Jacksonville.com / Florida Times-Union (June 9, 2011). https://www.jacksonville.com/story/news/crime/2011/06/09/wednesday-testimony-delved-internet-searches-casey-anthonys-computer/15900821007/
Andrew R. Lee, Jason M. Loring & Graham H. Ryan, Your AI Conversations Are Not Privileged: What a New SDNY Ruling Means for Every Lawyer and Client, Jones Walker LLP, AI Law and Policy Navigator Blog (Feb. 13, 2026). https://www.joneswalker.com/en/insights/blogs/ai-law-blog/your-ai-conversations-are-not-privileged-what-a-new-sdny-ruling-means-for-every.html?id=102mif8
Andrew R. Lee, OpenAI Loses Privacy Gambit: 20 Million ChatGPT Logs Likely Headed to Copyright Plaintiffs, Jones Walker LLP, AI Law and Policy Navigator Blog (Jan. 6, 2026). https://www.joneswalker.com/en/insights/blogs/ai-law-blog/openai-loses-privacy-gambit-20-million-chatgpt-logs-likely-headed-to-copyright-p.html?id=102lzo9.
Parker Hancock, Your AI Conversations May Not Be Privileged: What United States v. Heppner Means for Every Organization Using AI, Baker Botts LLP, Our Take Blog (Feb. 13, 2026). https://ourtake.bakerbotts.com/post/102mibz/your-ai-conversations-may-not-be-privileged-what-united-states-v-heppner-means
Daniel Schwartz, A Court Just Confirmed What Employers Need to Hear: Your AI Conversations Are Not Privileged, Shipman & Goodwin LLP, Connecticut Employment Law Blog (Feb. 16, 2026). https://www.ctemploymentlawblog.com/2026/02/articles/a-court-just-confirmed-what-employers-need-to-hear-your-ai-conversations-are-not-privileged/
Michael Peltz, LinkedIn post re: United States v. Heppner ruling (Feb. 2026). https://www.linkedin.com/posts/mpeltz_ai-docs-sent-by-exec-to-attys-not-privileged-activity-7427479054242721792-n2LC/
Attorney-Client Privilege, Legal Information Institute, Cornell Law School, Wex Legal Encyclopedia. https://www.law.cornell.edu/wex/attorney-client_privilege
Attorney Work Product Privilege, Legal Information Institute, Cornell Law School, Wex Legal Encyclopedia. https://www.law.cornell.edu/wex/attorney_work_product_privilege
Updates to Our Consumer Terms, Anthropic, https://www.anthropic.com/news/updates-to-our-consumer-terms (last visited Feb. 28, 2026).
Commercial Terms of Service, Anthropic, https://www.anthropic.com/legal/commercial-terms (last visited Feb. 28, 2026).
Consumer Terms of Service, Anthropic, https://www.anthropic.com/legal/consumer-terms (last visited Feb. 28, 2026).
Usage Policy, Anthropic, https://www.anthropic.com/legal/aup (last visited Feb. 28, 2026).
Privacy Policy, Anthropic, https://www.anthropic.com/legal/privacy (last visited Feb. 28, 2026).
Privacy Policy, OpenAI, https://openai.com/policies/row-privacy-policy/ (last visited Feb. 28, 2026).
Terms of Use, OpenAI, https://openai.com/policies/terms-of-use/ (last visited Feb. 28, 2026).
Service Terms, OpenAI, https://openai.com/policies/service-terms/ (last visited Feb. 28, 2026).
Data Processing Addendum, OpenAI, https://openai.com/policies/data-processing-addendum/ (last visited Feb. 28, 2026).
The Bail Project, “The False Promise of Bail: An Analysis of Release Mechanisms and Court Appearance in Tulsa County, Oklahoma,” June 10, 2025, bailproject.org/false-promise-of-bail.
Disclaimer: This post is for general information purposes only. It does not constitute legal or tax advice. This post reflects the current opinions of the author(s) and are for educational purposes only. The opinions reflected herein are subject to change without notice.
Images: All original images are AI-generated with using a combination of Dall-E, Firefly, DreamStudio and Pixlr.
 | A guest post by
|