--- title: "Which AI Tools Train On Your Data by Default? The 2026 Audit" description: "ChatGPT, Claude, Gemini, Copilot, Cursor, Perplexity, Grok, DeepSeek — one master table of who trains on your data by default in 2026, where the opt-outs…" url: "https://sonomos.ai/blog/which-ai-tools-train-on-your-data-2026/" source: "https://sonomos.ai/blog/which-ai-tools-train-on-your-data-2026/" --- [Back to Blog](https://sonomos.ai/blog/) September 1, 202617 min read AI Privacy Training Data ChatGPT Claude Gemini Data Protection # Which AI Tools Train On Your Data by Default? The 2026 Audit S [Sonomos Research](https://sonomos.ai/team/) · Sonomos The Sonomos research team writes about AI privacy, data protection, and how to use generative AI safely at work. **Short answer:** The 2026 pattern is remarkably consistent: consumer tiers of AI tools may train on your data by default (with an opt-out buried in settings), while business, enterprise, and API tiers exclude your data from training by default. ChatGPT Free and Plus train unless you opt out; Team, Enterprise, and the API do not. Claude Free may train unless you opt out; Pro, Team, Enterprise, and the API do not. Consumer Gemini may be used for training and quality review; Workspace Gemini and Vertex AI are excluded. The exceptions cluster at the edges — Perplexity's training posture is not disclosed in enterprise-grade detail, Grok's training-data practices are under regulatory investigation, and hosted DeepSeek trains on your inputs with no enterprise alternative. This audit puts every major tool's training default in one table, explains why "trains on your data" is only one of four questions that matter, and shows what to do when the policy isn't good enough — or when you don't want to bet on a policy that can change. ## Why "does it train on my data" is the wrong single question "Training" is the risk everyone asks about — the vivid one, where your confidential prompt gets baked into a model that later repeats it to a stranger. It is real, but it is one of four distinct risks: 1. **Training.** Does the vendor use your prompts to improve future models? 2. **Retention.** How long does the vendor store your prompts, and why? Even tools that never train typically retain prompts for a window — OpenAI, for example, keeps conversations up to 30 days for abuse monitoring even with history and training off. Retained data can be breached, subpoenaed, or reviewed. 3. **Human review.** Can vendor staff read your conversations? Consumer Gemini conversations may be reviewed by humans for quality and safety; abuse-monitoring pipelines at other vendors also involve potential staff access. 4. **Sub-processors.** Who else sees the data? Cursor transmits your code to Anthropic, OpenAI, or Google as underlying model providers. Windsurf routes through Codeium's backend. Perplexity's retrieval architecture can push query terms to third-party search infrastructure. Each hop has its own terms. A tool can score well on training and badly on the other three. A "we never train on your data" banner says nothing about retention windows, staff access, or the sub-processor chain. Keep all four in view as you read the table. ## The master table: training defaults by vendor and tier (2026) Every cell below is drawn from our per-vendor deep dives, linked at the end of this post. Where our research did not establish a definitive answer, the cell says "verify current policy" — these defaults have changed before and will change again. | Vendor / tier | Trains on your data by default? | Opt-out available? | Notes | | --- | --- | --- | --- | | ChatGPT Free | Yes | Yes — Data Controls | Up to 30-day abuse-monitoring retention applies even after opt-out | | ChatGPT Plus | Yes | Yes — Data Controls | Same training defaults as Free; no DPA | | ChatGPT Pro | No — excluded by default | n/a | Default flipped in 2024–2025; verify in Data Controls | | ChatGPT Team | No | n/a | Workspace admins have visibility; DPA available | | ChatGPT Enterprise / Edu | No | n/a | Zero Data Retention and BAA available on request | | OpenAI API | No | n/a | 30-day abuse-monitoring retention; ZDR on request | | Claude Free (Claude.ai) | May be used for training | Yes — in settings | Consumer contract; no DPA | | Claude Pro | No — excluded by default | n/a | Still a consumer contract; no DPA | | Claude Team (Claude for Work) | No | n/a | Anthropic DPA covers this tier | | Claude Enterprise | No | n/a | Strongest Claude posture; BAA available | | Claude API | No | n/a | Zero-data-retention option for eligible customers | | Gemini (consumer) | May be used for training / quality; human review possible | Yes — opt-out | Personal Google account; no enterprise DPA | | Gemini for Google Workspace | No — excluded for Workspace customers | n/a | Covered by the Workspace DPA; verify the current DPA schedule | | Vertex AI Gemini | No | n/a | Zero-retention option; EU-only inference for eligible workloads | | Microsoft Copilot (consumer) | Verify current policy | Verify current policy | Consumer privacy statement governs; different terms from commercial | | Microsoft 365 Copilot (commercial) | No — customer content not used to train foundation models | n/a | Includes Copilot with Commercial Data Protection; tenant boundary | | GitHub Copilot Free / Individual | Code snippets may be used for product improvement | Yes — individual opt-out | No BAA on any Copilot tier | | GitHub Copilot Business / Enterprise | No — excluded by default | n/a | Verify the org-level setting in the admin console | | Perplexity | Not disclosed in enterprise-grade detail | Verify current policy | Personalisation uses query history; no enterprise DPA as of 2026 | | Cursor Free / Pro | May use data to improve services unless Privacy Mode is on | Yes — Privacy Mode | Codebase indexing uploads your repository; disable it | | Cursor Business | No — Privacy Mode on by default | n/a | DPA and SOC 2 Type II available | | Windsurf Free / Pro | Yes — anonymized completions may improve models | Yes — in settings | No DPA on consumer tiers | | Windsurf Teams / Enterprise | No | n/a | DPA available; on-premises option at Enterprise | | Grok (X Premium / Grok.com) | X posts and interactions have been used for training; conversation policy: verify current policy | Partial — X offered an EU opt-out, adequacy contested | Under investigation by the Irish DPC, CNIL, and ICO; no enterprise tier | | DeepSeek (hosted app / web / API) | Yes, per consumer policy | Verify current policy | Data stored in China under Chinese law; no enterprise no-training tier | Two reading notes. First, "No" in the training column never means "no data leaves your device" — every hosted tool transmits and processes your prompt to answer it. Second, self-hosted open-weight models (including DeepSeek's R1 and V3 run on your own infrastructure) are a different category: no vendor is in the loop, so there is no vendor training question. ## The consumer-vs-business dividing line Read the table column by column and one pattern dominates: the dividing line is not which vendor you choose, it is which relationship you have with the vendor. **Consumer tiers train (or reserve the right to).** ChatGPT Free and Plus, Claude Free, consumer Gemini, GitHub Copilot Individual, Cursor and Windsurf's consumer tiers, hosted DeepSeek — the free and prosumer products either train by default or permit product-improvement use of your data unless you opt out. That is the deal: the product is cheap or free, and your usage improves it. **Business tiers don't.** ChatGPT Team and Enterprise, Claude for Work, Workspace Gemini, Vertex AI, Microsoft 365 Copilot, GitHub Copilot Business, Cursor Business, Windsurf Teams — every major vendor excludes business-tier customers from training by default, because no procurement team would sign otherwise. The no-training commitment arrives bundled with the rest of what procurement demands: a [Data Processing Agreement](https://sonomos.ai/glossary/data-processing-agreement/), sub-processor disclosure, configurable retention. The practical consequence is the most common failure mode we see: an employee doing work on a personal Free or Plus account. The organization believes it has "no training" because it signed an enterprise contract; the employee is pasting customer data into a consumer tier that trains by default. The tier follows the account — not the person, and not the employer. The exceptions are worth naming. Perplexity and Grok have no enterprise tier with a contractual no-training commitment at all, so the dividing line cannot save you there. DeepSeek's hosted service has no enterprise tier either — and adds Chinese data-residency and state-access law on top. ## How to actually opt out, where you can Where an opt-out exists, it is a settings toggle, and it is worth five minutes: - **ChatGPT (Free / Plus):** Settings → Data Controls → turn off "Improve the model for everyone" (older accounts may see a combined "Chat history & training" switch). This stops training use; it does not shorten the abuse-monitoring retention window. - **Claude (Free):** Training exclusion is controlled in the consumer settings; Pro and all business tiers are excluded by default. Verify rather than assume. - **Gemini (consumer):** An opt-out exists for training and quality use. On Workspace and Vertex, exclusion is the default and the control surface is the admin console. - **GitHub Copilot (Individual):** Disable the setting that allows GitHub to use your code snippets for product improvements. On Business and Enterprise, confirm the org-level exclusion in the admin console. - **Cursor:** Enable Privacy Mode (on by default on Business, optional on Pro). Separately — and more importantly for code exposure — disable codebase indexing unless you have reviewed the retention terms. - **Windsurf:** The consumer-tier training use has an opt-out in settings; Teams and Enterprise exclude training contractually. - **Perplexity, Grok, DeepSeek:** No documented, enterprise-grade opt-out mechanism in our research. Verify each vendor's current policy — and for regulated work, treat the absence of a contractual commitment as the answer. Two caveats apply everywhere. Opt-outs govern the future, not the past — data already used for training is not clawed back by a toggle. And defaults have flipped repeatedly across the industry, so an opt-out you set in 2025 deserves a re-check after every major product announcement. ## "No training" is not "no risk" Suppose you are on an enterprise tier of everything and training is contractually off. You are not done: - **Retention.** Your prompts still sit on vendor servers for some window — 30 days for abuse monitoring at OpenAI even in the strictest consumer configuration, configurable-but-nonzero on most business tiers unless you have negotiated [zero data retention](https://sonomos.ai/blog/chatgpt-api-vs-consumer-privacy-2026/). Retained data is breachable data: DeepSeek's publicly exposed database of chat logs in 2025 was a retention incident, not a training incident. - **Legal process.** Stored prompts can be produced in response to subpoenas, court orders, and law-enforcement requests. Every major vendor complies with valid legal process; the retention window determines what is producible. - **Human review and admin visibility.** Abuse-monitoring pipelines involve potential staff access, and on Team and Enterprise tiers your own workspace admins — your employer — may have access to conversations. "Private from the vendor's training pipeline" and "private from your admin" are different claims. - **Sub-processors.** The no-training commitment binds one company. Your prompt may transit two or three (an IDE vendor, a model provider, a cloud host), each with its own terms. This is why compliance frameworks treat "the vendor doesn't train on our data" as one control among many. [Data minimization](https://sonomos.ai/glossary/data-minimization/) — not sending the sensitive values at all — is the only control that addresses all four risks at once. ## The API question: "privacy-first AI API, no training" If you are building a product and searching for an AI API that does not train on your data, the 2026 answer is more reassuring than most people expect: **the major-vendor APIs all exclude your data from training by default.** The OpenAI API, the Claude API, Vertex AI Gemini, and Azure OpenAI each commit, by default, to not using API traffic to train foundation models. You do not need an exotic "privacy-first" niche provider — you need the standard API terms of the majors, verified. What separates a defensible deployment from a hopeful one: - **Sign the DPA.** The no-training default is a policy; the [DPA](https://sonomos.ai/glossary/data-processing-agreement/) makes it a contract with [GDPR](https://sonomos.ai/glossary/gdpr/) Article 28 standing. For [CCPA](https://sonomos.ai/glossary/ccpa/) purposes, the service-provider terms play the equivalent role. API keys are easy to provision without signing anything — a gap our per-vendor guides flag repeatedly. - **Ask about zero data retention.** No-training still usually means a 30-day-class abuse-monitoring window. OpenAI and Anthropic offer ZDR arrangements for eligible customers; Vertex AI offers a zero-retention configuration. - **Check residency if GDPR applies.** A no-training API processing EU personal data on US infrastructure still needs a Chapter V transfer mechanism. Vertex AI offers EU-only inference for eligible workloads; M365 Copilot falls under Microsoft's EU Data Boundary; Anthropic currently does not offer EU residency. - **Pseudonymize before the call.** Mask personal data in your application layer before the API request is made — then the no-training, retention, and transfer questions all apply to placeholders instead of people. ## The employer nuance: your company training on your prompts is a different question A recurring search that deserves a direct answer: "if I use ChatGPT for work, can the company use what I type to train their model?" Notice this is not a question about OpenAI — it is a question about your employer, and the honest answer is: possibly, depending on your contract and jurisdiction. On Team and Enterprise tiers, workspace admins can generally access workspace conversations, and what you type into a company-managed AI account is, in most employment contexts, company data — like your work email. If the company later fine-tunes an internal model on its own workspace data, your prompts could be part of that corpus under the company's policies, not the AI vendor's. The vendor's no-training commitment binds the vendor; it says nothing about what your employer does with data it can lawfully access. The levers here are organizational, not technical: your employment agreement, the company's AI acceptable-use policy, works-council or privacy-notice obligations where they exist. The personal rule stays simple — nothing goes into a work AI account that you would not put in a work email. For the fuller picture, read [Can My Employer See My ChatGPT Prompts?](https://sonomos.ai/blog/can-my-employer-see-my-chatgpt-prompts-2026/) ## The control that doesn't depend on anyone's policy Everything above this line is policy analysis — and policies churn. Training defaults have flipped at multiple vendors in the past two years, in both directions. Products get acquired; terms get updated between your annual vendor reviews. If your protection is "we read the policy and it was fine," your protection has a shelf life. The one control that survives policy churn is not sending the sensitive values in the first place. Sonomos Locke runs on your device and detects sensitive entities — names, account numbers, health terms, secrets — before the prompt leaves, replacing them with one-way placeholders. The AI tool receives a usable prompt; the underlying values never reach the vendor. If a training default flips tomorrow, your masked prompts train nothing sensitive — there is nothing sensitive in them. If a retention window turns out longer than documented, or a breach exposes stored conversations, the stored copies contain placeholders. And it works the same across every tool in the table, sanctioned or not, on whatever tier the account happens to be. Locke does not change any vendor's policy, and it is not a substitute for signing the right contracts on the tools your organization sanctions. It is the layer that keeps working when the policies move. Because detection and masking happen locally, no third party — including Sonomos — sees the unmasked content. ## Frequently asked questions ### Does OpenAI use ChatGPT conversations for training? On ChatGPT Free and Plus, yes — unless you opt out in Settings → Data Controls. ChatGPT Pro, Team, Enterprise, Edu, and the OpenAI API are excluded from training by default, and Temporary Chats are not used for training on any tier. The defaults have changed several times, so verify your own Data Controls rather than relying on any article, including this one. ### Does Cursor's privacy mode stop it from training on my code? Privacy Mode prevents Cursor from using your prompts and code to improve its models. It is on by default for Business accounts and optional on Pro. It is not the same as disabling chat history (a UI setting that does not change server-side behavior), and it does not disable codebase indexing — which uploads your repository to Cursor's servers and should be turned off separately. ### Does Gemini for Google Workspace use customer data for training? No, according to Google's current Workspace DPA and product documentation: Workspace customer data is not used to train Google's general-purpose models, and Vertex AI prompts are similarly excluded by default. Consumer Gemini is different — conversations may be used for training and quality improvement, including possible human review, unless the user opts out. Verify the current DPA schedule at the time of your assessment. ### If I use ChatGPT for work, can my company use what I type to train its own model? Possibly — that is governed by your employment relationship and your company's policies, not by OpenAI's. On workspace tiers, admins can generally access workspace conversations, and data your employer lawfully holds can typically be used per its internal policies — which in some organizations include fine-tuning internal models. The AI vendor's no-training commitment does not restrict your employer. ### Is there a privacy-first AI API that doesn't train on my data? The major-vendor APIs — OpenAI, Anthropic (Claude), Google (Vertex AI), and Azure OpenAI — all exclude API traffic from training by default. The differentiators are the contract and the residuals: sign the DPA, ask about zero-data-retention, verify data residency if GDPR applies, and pseudonymize personal data before the API call. ### Which AI tools have no way to turn training off? Based on our research: hosted DeepSeek trains on inputs per its consumer policy with no enterprise no-training tier; Perplexity does not disclose its training posture in enterprise-grade detail and offers no DPA; and Grok's training practices are under investigation by three European supervisory authorities, with no enterprise contractual infrastructure. For regulated work, the absence of a documented opt-out plus the absence of an enterprise contract is itself the answer. ## Related reading Every cell in the table above traces to one of our per-vendor deep dives: - [Does ChatGPT Save Your Prompts?](https://sonomos.ai/blog/does-chatgpt-save-your-prompts-2026/) - [Free vs. Paid ChatGPT: What Actually Changes for Your Privacy](https://sonomos.ai/blog/free-vs-paid-chatgpt-privacy-differences-2026/) - [Is Claude GDPR Compliant?](https://sonomos.ai/blog/is-claude-gdpr-compliant-2026/) - [Is Gemini GDPR Compliant?](https://sonomos.ai/blog/is-gemini-gdpr-compliant-2026/) - [Is Microsoft Copilot GDPR Compliant?](https://sonomos.ai/blog/is-microsoft-copilot-gdpr-compliant-2026/) - [Is GitHub Copilot HIPAA Compliant?](https://sonomos.ai/blog/is-github-copilot-hipaa-compliant-2026/) - [Is Perplexity AI GDPR Compliant?](https://sonomos.ai/blog/is-perplexity-ai-gdpr-compliant-2026/) - [Is Cursor AI Safe for Sensitive Code?](https://sonomos.ai/blog/is-cursor-ai-safe-sensitive-code-2026/) - [Is Windsurf AI Safe for Sensitive Code?](https://sonomos.ai/blog/is-windsurf-ai-safe-sensitive-code-2026/) - [Is Grok GDPR Compliant?](https://sonomos.ai/blog/is-grok-gdpr-compliant-2026/) - [Is DeepSeek Safe for Work?](https://sonomos.ai/blog/is-deepseek-safe-gdpr-hipaa-2026/) For the tooling that protects you regardless of which vendor and tier you land on, see [The Best AI Privacy Tools for ChatGPT, Claude, and Gemini](https://sonomos.ai/blog/best-ai-privacy-tools-chatgpt-claude-gemini-2026/). ## The bottom line The 2026 training-data audit reduces to three rules. First, the consumer/business line matters more than the vendor: every major provider trains (or may train) on consumer-tier data by default and excludes business-tier data by default. Second, "no training" answers one of four questions — retention, human review, and sub-processors still apply. Third, policies are moving targets; the only control that doesn't expire with a terms-of-service update is keeping the sensitive values out of the prompt entirely. Opt out where you can, contract where you must, and mask on the device — so whatever any vendor's policy says next quarter, it's ruling on placeholders, not on your data. ### Protect your data while using AI Locke detects and masks sensitive information on your device, before it reaches an AI model. [Download Locke](https://sonomos.ai/downloads/) This article is general information about privacy and AI, not legal advice, and reading it does not create a solicitor–client or attorney–client relationship. Regulatory requirements turn on your specific facts and jurisdiction and change over time. Consult qualified counsel before relying on anything here, and check the publication and last-reviewed dates above. We may revise posts, but we do not undertake to keep any post current as the law changes. ## Reference pages for this post - [Locke for ChatGPTTool guide](https://sonomos.ai/for/chatgpt/) - [Locke for ClaudeTool guide](https://sonomos.ai/for/claude/) - [Locke for GeminiTool guide](https://sonomos.ai/for/gemini/) ## Related Articles September 1, 2026•Sonomos Research ### The Anthropic DPA Explained: Claude Data Processing Agreement Guide (2026) Anthropic offers a DPA on Claude Team, Enterprise, and the API — not on Claude.ai Free or Pro. Here is what the Anthropic DPA covers, how it handles EU-US transfers via SCCs and the DPF, what to verify before signing, and where a DPA stops. Claude DPA GDPR +2 September 1, 2026•Sonomos Research ### Claude EU Data Residency in 2026: What Anthropic Offers, and What European Teams Do Instead Anthropic does not currently offer EU data residency for Claude — every prompt is processed on US infrastructure and constitutes an EEA-to-US transfer. Here is how that compares to OpenAI, Microsoft, and Google, what the EU-US Data Privacy Framework does and does not cover, and the supplementary-measure stack European teams deploy instead. Claude Data Residency Europe +2 September 1, 2026•Sonomos Research ### Can My Employer See My Claude Chats? What's Visible in 2026 (and What Isn't) Whether your employer can see your Claude chats depends on the account (personal Claude.ai vs. work-managed Team/Enterprise), the device, and the network. Here is what is visible in each scenario — including Claude Code — and what deleting a chat actually does. Claude Workplace Privacy AI Privacy +1