--- title: "AI Privacy Blog" description: "Articles on AI privacy, data protection strategies, and secure AI usage for professionals. Practical guidance for protecting sensitive information." url: "https://sonomos.ai/blog/" source: "https://sonomos.ai/blog/" --- # AI Privacy Blog Insights on privacy, AI security, and protecting your data. ## All posts September 1, 2026•Sonomos Research ### The Anthropic DPA Explained: Claude Data Processing Agreement Guide (2026) Anthropic offers a DPA on Claude Team, Enterprise, and the API — not on Claude.ai Free or Pro. Here is what the Anthropic DPA covers, how it handles EU-US transfers via SCCs and the DPF, what to verify before signing, and where a DPA stops. Claude DPA GDPR +2 September 1, 2026•Sonomos Research ### Claude EU Data Residency in 2026: What Anthropic Offers, and What European Teams Do Instead Anthropic does not currently offer EU data residency for Claude — every prompt is processed on US infrastructure and constitutes an EEA-to-US transfer. Here is how that compares to OpenAI, Microsoft, and Google, what the EU-US Data Privacy Framework does and does not cover, and the supplementary-measure stack European teams deploy instead. Claude Data Residency Europe +2 September 1, 2026•Sonomos Research ### Can My Employer See My Claude Chats? What's Visible in 2026 (and What Isn't) Whether your employer can see your Claude chats depends on the account (personal Claude.ai vs. work-managed Team/Enterprise), the device, and the network. Here is what is visible in each scenario — including Claude Code — and what deleting a chat actually does. Claude Workplace Privacy AI Privacy +1 September 1, 2026•Sonomos Research ### Can My Employer See My Gemini Chats? Google Workspace Visibility Explained (2026) Whether your employer can see your Gemini chats depends on the Google account, the device, and the network. A Workspace-managed account sits inside your employer's estate; company Wi-Fi alone cannot read chat content. Here is exactly what is visible in each setup. Gemini Google Workspace Workplace Privacy +1 September 1, 2026•Sonomos Research ### ChatGPT Temporary Chat: What It Actually Saves (and What It Doesn't) — 2026 Temporary Chat keeps a conversation out of your history, out of Memory, and out of model training — but it still goes to OpenAI's servers, where it can be retained for up to 30 days for abuse monitoring. What Temporary Chat protects, what it doesn't, and when to use it. ChatGPT AI Privacy Data Retention +1 September 1, 2026•Sonomos Research ### Is Claude Confidential? What Anthropic Can See, Store, and Train On (2026) Claude has strong privacy defaults — paid-tier prompts are excluded from training — but confidentiality depends on the tier: consumer Claude.ai has no DPA or BAA, while Team, Enterprise, and the API can be configured defensibly. Here is who can see your chats, what is retained, and what to do with genuinely sensitive content. Claude AI Privacy Confidentiality +1 September 1, 2026•Sonomos Research ### Can an Interviewer See Your ChatGPT or Claude History? How AI Use Actually Gets Discovered (2026) Interviewers and prospective employers cannot open your personal ChatGPT or Claude history — and typing a company's name into a chat notifies no one. What can reveal AI use is different: submitted work, monitored assessment platforms, shared screens, and work-managed devices. Here is the honest map. ChatGPT Claude Workplace Privacy +2 September 1, 2026•Sonomos Research ### Which AI Tools Train On Your Data by Default? The 2026 Audit ChatGPT, Claude, Gemini, Copilot, Cursor, Perplexity, Grok, DeepSeek — one master table of who trains on your data by default in 2026, where the opt-outs live, and why the consumer-vs-business line matters more than the vendor you pick. AI Privacy Training Data ChatGPT +3 September 1, 2026•Sonomos Research ### Is Claude FERPA Compliant? A 2026 Guide for Schools and EdTech Claude is not FERPA compliant by default — no AI is. Consumer Claude.ai accounts cannot hold education records; Claude for Work and the API can sit inside a compliant deployment if the district's contract establishes the school-official conditions. Here is the tier-by-tier analysis, what to verify in Anthropic's terms, and how ChatGPT and Gemini compare. Claude FERPA Education +2 September 1, 2026•Sonomos Research ### Is Claude Code Safe for Sensitive Code? A 2026 Security Review Claude Code reads files from your working directory and sends prompts, file contents, and command output to Anthropic's API. Here is what actually leaves your machine, how the account tier changes the data posture, the failure patterns to avoid — and how to measure what you have already exposed. Claude Code AI Coding Source Code Security +2 June 4, 2026•Sonomos Research ### The Colorado AI Act (SB 24-205): A Compliance Guide for 2026 Colorado's SB 24-205 is the first comprehensive, risk-based US state AI law, imposing a duty of care against algorithmic discrimination in high-risk AI systems. After a delay, it takes effect June 30, 2026. Here are the developer and deployer obligations and how to prepare. Colorado AI Act AI Regulation AI Compliance +3 June 3, 2026•Sonomos Research ### Texas TRAIGA: The Responsible AI Governance Act Compliance Guide (2026) The Texas Responsible AI Governance Act (HB 149) takes effect January 1, 2026. It targets specific intentional misuses of AI — behavioural manipulation, unlawful discrimination, certain biometric and government uses — and is enforced by the Texas AG with a 60-day cure period. Here is what TRAIGA requires and how to prepare. Texas TRAIGA AI Regulation AI Compliance +2 June 2, 2026•Sonomos Research ### AI Agents and Data Privacy: Operator, Computer Use, and Agentic Browsing in 2026 AI agents that browse, click, and act on your behalf see far more than a chat prompt — whole screens, your logged-in sessions, and untrusted web content that can hijack them via prompt injection. Here are the real privacy and security risks of agentic AI, and the controls that hold up in 2026. AI Agents AI Security Prompt Injection +3 June 1, 2026•Sonomos Research ### Is DeepSeek Safe for Work? Privacy, GDPR, and HIPAA Risks in 2026 The hosted DeepSeek app, website, and API send prompts to servers in China under Chinese law, with no enterprise DPA, no BAA, and no EU/US data residency — and have already drawn regulator action and government-device bans. Here is the compliance picture, including how the open-weight models differ. DeepSeek AI Privacy GDPR +3 May 14, 2026•Sonomos Research ### AI Meeting Notetakers: HIPAA, GDPR, and Privacy Compliance in 2026 Otter.ai litigation, Fireflies BIPA claims, Zoom BAA requirements, GDPR DPA gaps — AI notetakers create real compliance obligations that most organisations have not fully addressed. A practical guide to consent, HIPAA, GDPR, and the specific risks of AI transcription at scale. HIPAA GDPR Privacy +3 May 14, 2026•Sonomos Research ### EU AI Act Compliance Checklist for Enterprise Deployers (2026) Prohibited AI practices are enforceable now. GPAI obligations live August 2025. High-risk Annex III requirements hit in August 2026. A practical deployer-focused checklist covering every phase — including employment screening, credit tools, and GDPR overlap. EU AI Act AI Compliance GDPR +3 May 14, 2026•Sonomos Research ### Is Grok GDPR Compliant? A 2026 Guide for European Teams Grok and xAI carry the highest GDPR regulatory risk of any major AI tool in 2026 — with active investigations by the Irish DPC, France's CNIL, and the UK ICO over training-data practices, no enterprise DPA, and no EU data residency. Here is what European organisations need to know. GDPR Grok xAI +3 May 13, 2026•Sonomos Research ### Is Perplexity AI GDPR Compliant? A 2026 Guide for European Teams Perplexity AI does not offer an enterprise DPA, processes data on US-only infrastructure, and is not suitable for EU personal data in business contexts. Here is what the GDPR requires, where the specific gaps are, and how European teams can use Perplexity safely. GDPR Perplexity Europe +2 May 13, 2026•Sonomos Research ### Is Gemini GDPR Compliant? A 2026 Guide for European Teams Gemini is three different products with three different GDPR postures. Consumer Gemini has no DPA. Workspace Gemini is DPA-covered. Vertex AI Gemini provides the strongest posture. Here is the tier-by-tier analysis and the controls that hold up under supervisory-authority scrutiny. GDPR Gemini Google +3 May 13, 2026•Sonomos Research ### Is Claude GDPR Compliant? A 2026 Guide for European Teams Claude.ai consumer accounts have no DPA and are not suitable for EU personal data. Claude for Work and the API are DPA-eligible, but there is no EU data residency option. Here is the tier-by-tier GDPR analysis and the controls that hold up under supervisory-authority audit. GDPR Claude Europe +2 May 12, 2026•Sonomos Research ### GDPR Data Subject Rights and AI: Access, Erasure, and Automated Decisions in 2026 GDPR data subject rights apply to AI interaction logs, AI-generated outputs, and training data — but AI makes erasure and access technically complex. Here is how Articles 15, 17, and 22 apply to ChatGPT, Claude, and other AI tools, and what practical responses look like for EU organizations. GDPR Data Subject Rights Europe +2 May 12, 2026•Sonomos Research ### AI Tools for Legal Research in 2026: Harvey, Westlaw AI, Lexis+ AI, and Why Citation Hallucination Still Matters Harvey, Westlaw AI, Lexis+ AI, and CoCounsel ground their answers in legal databases; ChatGPT does not. Here is the comparison across accuracy, confidentiality terms, and ethics obligations — and the workflow that prevents the hallucinated-citation sanctions that have already been imposed. Legal Legal Research Harvey AI +2 May 11, 2026•Sonomos Research ### ChatGPT API vs Consumer Tiers: The Real Privacy Differences in 2026 ChatGPT Free, Plus, Team, Enterprise, and the API have materially different privacy terms — training use, data retention, DPA availability, and BAA eligibility all vary by tier. Here is the complete tier-by-tier breakdown and a compliance matrix showing which tier is required for which use case. ChatGPT OpenAI API +2 May 11, 2026•Sonomos Research ### NIST AI RMF: How to Use the AI Risk Management Framework for Generative AI Governance in 2026 The NIST AI Risk Management Framework is becoming the de facto AI governance standard for US organizations. Here is how its four functions — Govern, Map, Measure, Manage — apply to using ChatGPT, Claude, and Gemini, and how to build a practical AI governance program around it. NIST AI RMF AI Governance Risk Management +2 May 11, 2026•Sonomos Research ### ISO 27001 and AI Tools: Which Controls Apply and What Auditors Look For in 2026 ISO 27001:2022's supplier management, cloud services, data masking, and DLP controls all apply to AI tools used in certified organizations. Here is which Annex A controls are implicated, what auditors ask about AI in 2026, and how to build the ISMS addendum without rewriting existing documentation. ISO 27001 Information Security AI Governance +2 May 10, 2026•Sonomos Research ### HIPAA-Compliant AI: A Complete Checklist for Healthcare Organizations in 2026 A Business Associate Agreement is necessary but not sufficient for HIPAA-compliant AI. Here is the full administrative, physical, and technical safeguard checklist for healthcare organizations deploying AI tools in 2026 — with specific implementation notes for clinical and operational workflows. HIPAA Healthcare AI Compliance +2 May 10, 2026•Sonomos Research ### AI and the Work Product Doctrine: Privilege Risks When Lawyers Use ChatGPT and Claude Pasting case strategy, client communications, or deposition summaries into a consumer AI tool risks waiving attorney-client privilege and work product protection. Here is what the doctrine protects, which AI tool configurations preserve it, and what state bar opinions say lawyers must do. Legal Work Product Doctrine Privilege +2 May 10, 2026•Sonomos Research ### Is Windsurf AI Safe for Sensitive Code? A 2026 Security Guide Windsurf transmits code context to Codeium's servers, and consumer tiers permit model training on your code. Here is what Windsurf actually sends, how Teams and Enterprise tiers change the data posture, and how it compares to Cursor and GitHub Copilot for regulated-industry engineering teams. Windsurf AI Coding Engineering +2 May 9, 2026•Sonomos Research ### US State AI Privacy Laws in 2026: The Landscape for AI Users Twenty-plus states have comprehensive privacy laws with AI implications, Colorado has the first dedicated high-risk AI statute, and Illinois BIPA has generated hundreds of millions in settlements. Here is the practical compliance map for organizations using AI tools with US consumer and employee data. US Privacy Law CCPA State Law +2 May 9, 2026•Sonomos Research ### Is Microsoft Copilot GDPR Compliant? A 2026 Guide for European Teams Microsoft 365 Copilot on commercial plans with EU data residency can be used in a GDPR-compliant posture. Consumer Copilot cannot. Here is what the GDPR requires, how each Copilot tier measures up, and the configuration steps that matter for European organizations. GDPR Microsoft Copilot Europe +2 May 8, 2026•Sonomos Research ### AI Acceptable Use Policy: A 2026 Template for Organizations A complete guide to writing an AI acceptable use policy — the seven sections every AUP needs, annotated model language for each, common mistakes that leave gaps, and how to communicate it to employees so it actually changes behavior. AI Governance Policy Compliance +2 May 8, 2026•Sonomos Research ### SOC 2 and AI: What Auditors Look For When Your Team Uses ChatGPT and Claude SOC 2 auditors are increasingly asking about AI tool usage — specifically whether confidential data reaches unapproved tools and whether vendor risks are managed. Here is which Trust Service Criteria apply, what evidence auditors want, and the controls that satisfy SOC 2 without blocking AI adoption. SOC 2 Compliance AI Governance +2 May 8, 2026•Sonomos Research ### PCI DSS and AI: Can You Use ChatGPT With Cardholder Data? (2026 Guide) Pasting a card number or transaction record into ChatGPT almost certainly violates PCI DSS. Here is which v4.0 requirements apply to AI tools, how to determine CDE scope for AI, and the workflow controls that let payments teams use generative AI without expanding scope. PCI DSS Payments Financial Services +2 May 7, 2026•Sonomos Research ### Is Cursor AI Safe for Sensitive Code? A 2026 Security Guide Cursor transmits code context to third-party AI providers, and codebase indexing uploads your entire repository. Here is what Cursor actually sends, the settings that reduce exposure, and how it compares to GitHub Copilot for regulated-industry engineering teams. Cursor AI Coding Engineering +2 May 7, 2026•Sonomos Research ### Is Perplexity AI HIPAA Compliant? A 2026 Guide for Healthcare Teams As of May 2026, Perplexity AI did not offer a HIPAA BAA on any tier. Here is what that means for clinical staff who use it for research, how Perplexity compares to ChatGPT and Claude, and the safe-use workflow that keeps PHI off a non-covered tool. HIPAA Perplexity Healthcare +2 May 7, 2026•Sonomos Research ### Is GitHub Copilot HIPAA Compliant? A 2026 Guide for Healthcare Developers GitHub Copilot is not HIPAA compliant by default on any tier. Here is what HIPAA actually requires of an AI coding assistant, why GitHub is not on Microsoft's in-scope list, and how healthcare engineering teams can use AI assistance without putting PHI into a non-covered model. HIPAA GitHub Copilot Healthcare +2 May 6, 2026•Sonomos Research ### AI in Insurance 2026: NAIC Model Bulletin, Colorado Reg 10-1-1, and ChatGPT for Underwriting How insurers can use ChatGPT, Claude, and Gemini in underwriting, claims, and customer service without tripping the NAIC Model Bulletin, Colorado Reg 10-1-1, NY DFS Circular Letter 7, HIPAA, GLBA, or the EU AI Act's high-risk classification — including the controls that hold up under examination. Insurance NAIC AI Compliance +2 May 6, 2026•Sonomos Research ### FERPA and AI: Can Schools and EdTech Use ChatGPT With Student Data? (2026 Guide) FERPA-protected education records cannot be sent to ChatGPT, Claude, or Gemini without consent or a properly documented school-official designation. Here is what the regulation requires of an AI tool, how COPPA and state student-privacy laws stack on top, and the workflow patterns that hold up under audit. FERPA Education Schools +2 May 6, 2026•Sonomos Research ### Is ChatGPT GDPR Compliant? A 2026 Guide for European Teams ChatGPT is not GDPR compliant by default. Here is what the GDPR actually requires of an AI tool, which OpenAI products are DPA-eligible, what the Italian Garante decision held, and the controls that hold up under supervisory-authority audit in 2026. GDPR ChatGPT Europe +2 May 1, 2026•Sonomos Research ### Personal AI Privacy: A 2026 Guide for Individuals Using ChatGPT, Claude, and Gemini Practical, non-corporate steps anyone can take to keep their personal data private when using ChatGPT, Claude, and Gemini in 2026 — settings, habits, and a local-first technical layer for the prompts your habit will miss. Individuals Personal Privacy ChatGPT +2 May 1, 2026•Sonomos Research ### PHI vs PII vs Personal Data: A Plain-English Compliance Glossary for 2026 PII, PHI, and Personal Data overlap but are not interchangeable. Here is what each term means, where it comes from, how they differ, and which one applies when you are using ChatGPT, Claude, or Gemini in 2026. PII PHI GDPR +2 May 1, 2026•Sonomos Research ### Free vs. Paid ChatGPT: What Actually Changes for Your Privacy in 2026 Upgrading from Free to Plus does almost nothing for privacy. Upgrading to Pro flips the training default. The real inflection is Enterprise / API + ZDR + BAA. A 2026 tier-by-tier breakdown of training, retention, contracts, and admin visibility. ChatGPT OpenAI Privacy +2 May 1, 2026•Sonomos Research ### AI in Hiring 2026: EEOC, NYC LL144, the EU AI Act, and the Controls That Hold Up How employers can use ChatGPT, Claude, and dedicated hiring AI tools without tripping the EEOC, NYC Local Law 144, the EU AI Act's Annex III high-risk classification, or the wave of state automated-decisionmaking laws. HR Hiring EEOC +2 May 1, 2026•Sonomos Research ### ChatGPT vs. Claude for Confidential Work: Which Is More Private in 2026? Claude has friendlier privacy defaults; ChatGPT has deeper enterprise tooling. A four-axis comparison covering training, retention, BAAs/DPAs, and workflow surfaces — and the layer that makes the question less load-bearing. ChatGPT Claude AI Privacy +2 April 30, 2026•Sonomos Research ### The Best AI Privacy Tools for ChatGPT, Claude, and Gemini (2026) There is no single best AI privacy tool — there are five categories that solve different problems. A 2026 buyer's guide to local-first browser extensions, prompt-redaction APIs, AI-aware DLP and CASB, privacy vaults, and provider enterprise tiers. AI Privacy Buyer's Guide DLP +3 April 30, 2026•Sonomos Research ### GDPR and AI: A 2026 Compliance Guide for European Teams Using ChatGPT, Claude, and Gemini What the GDPR and the EU AI Act actually require of European teams using generative AI in 2026 — lawful basis, DPAs, international transfers, DPIAs, Article 32 controls, and how local-first redaction reduces the entire downstream burden. GDPR EU AI Act Europe +2 April 30, 2026•Sonomos Research ### Does ChatGPT Save Your Prompts? What OpenAI Actually Retains in 2026 ChatGPT saves your prompts — but the answer to which prompts, for how long, and for what purpose depends on your plan and your settings. Here is the exact retention picture for Free, Plus, Pro, Team, Enterprise, API, and Temporary Chat in 2026. ChatGPT OpenAI Privacy +2 April 30, 2026•Sonomos Research ### Source Code in AI Coding Assistants: Keeping Secrets Out of Copilot, ChatGPT, and Claude How engineering teams can use GitHub Copilot, ChatGPT, Claude, Cursor, and Windsurf without leaking source code, embedded secrets, or pre-disclosure vulnerabilities — with a workflow that does not slow developers down. Engineering Source Code GitHub Copilot +2 April 30, 2026•Sonomos Research ### Can My Employer See My ChatGPT Prompts? A 2026 Guide Whether your employer can see your ChatGPT, Claude, Gemini, or Copilot prompts depends on the account, the device, and the network. Here is exactly what is visible in each combination — and what is not. Privacy ChatGPT Workplace Monitoring +2 April 30, 2026•Sonomos Research ### Financial Services + AI: GLBA, FFIEC, and Securities Compliance for ChatGPT and Claude in 2026 How banks, broker-dealers, and RIAs can use ChatGPT, Claude, and Gemini without tripping GLBA, FFIEC, FINRA, or SEC requirements — including the controls that hold up under examination in 2026. Financial Services GLBA FFIEC +2 April 30, 2026•Sonomos Research ### Is Microsoft Copilot HIPAA Compliant? M365, GCC, and the Real Answer for 2026 Microsoft 365 Copilot can be used for PHI under the Microsoft HIPAA BAA — but Copilot's data protections alone are not enough, the free Copilot is off-limits, and oversharing is the silent failure mode. A 2026 guide for healthcare IT and compliance teams. HIPAA Healthcare Microsoft Copilot +3 April 29, 2026•Sonomos Research ### Is Gemini HIPAA Compliant? Workspace, Vertex AI, and the BAA in 2026 Gemini is not HIPAA compliant by default. Here is what the law actually requires, which Google products fall under the Google Cloud BAA (Gemini in Workspace, the Gemini app, Gemini on Google Cloud), how the consumer Gemini app differs, and how to keep PHI from leaking even when staff use personal accounts. HIPAA Healthcare Gemini +3 April 29, 2026•Sonomos Research ### Prompt Injection Explained: How Attackers Use AI Models to Steal Your Data A plain-English guide to direct and indirect prompt injection — how the attacks work, the patterns showing up in production AI systems, and the defenses that actually reduce risk in 2026. AI Security Prompt Injection LLM Security +2 April 29, 2026•Sonomos Research ### Is Claude HIPAA Compliant? A 2026 Guide for Healthcare Providers Claude is not HIPAA compliant by default. Here is what the law actually requires of an AI tool, which Anthropic services fall under its BAA (Claude Enterprise and the first-party API, with limits), and how to keep PHI from leaking even when staff use personal accounts. HIPAA Healthcare Claude +3 April 29, 2026•Sonomos Research ### Can Lawyers Use ChatGPT? Confidentiality, Privilege, and AI in 2026 How attorneys can use ChatGPT, Claude, and Gemini without breaching the duty of confidentiality, waiving privilege, or violating the technological-competence rule — with a workflow that holds up under bar scrutiny. Legal Confidentiality ABA +2 April 29, 2026•Sonomos Research ### Is ChatGPT HIPAA Compliant? A 2026 Guide for Clinicians and Health Tech Teams ChatGPT is not HIPAA compliant by default. Here is what the law actually requires of an AI tool, which OpenAI products are BAA-eligible, and how to keep PHI from leaking even when staff use unsanctioned accounts. HIPAA Healthcare ChatGPT +2 April 28, 2026•Sonomos Research ### What Is PII Redaction? A Plain-English Guide for AI Users PII redaction means automatically removing personally identifiable information from text before it is sent to an AI. Here is how the techniques work, why local-first matters, and how to choose a tool. PII Redaction AI Privacy +2 April 22, 2026•Sonomos Research ### AI Data Leakage: 7 Ways Sensitive Information Escapes to LLMs (and How to Stop It) From copy-paste accidents to prompt injection, here are the most common ways personal and corporate data leaks into ChatGPT, Claude, and Gemini — and the defenses that actually work in 2026. AI Security Data Leakage LLM Security +2 April 15, 2026•Sonomos Research ### How to Protect Sensitive Data When Using ChatGPT, Claude, and Gemini (2026 Guide) A practical, step-by-step guide for keeping personal and confidential data out of ChatGPT, Claude, Gemini, and other LLMs — without giving up the productivity benefits of AI. AI Privacy ChatGPT Claude +2 ## Stay informed Get privacy insights and product updates delivered to your inbox. [Subscribe on Substack](https://sonomos.substack.com/)