Is ChatGPT Confidential?

View on LinkedIn

I. Heppner's Notes in Claude

Bradley Heppner had a problem. He was under investigation for securities fraud, and he needed to organize his thoughts. He did what millions of people do every day: he opened Claude, Anthropic's chatbot, and started typing. He published nothing. He sent it to no one. He simply thought out loud, using a tool that hundreds of millions of people treat like a private notebook.

He produced 31 documents. He then passed them on to his attorney. And that is where the real problem began.

On February 10, 2026, Judge Jed Rakoff — one of the most respected judges in the Southern District of New York — ruled that those 31 documents were not protected. Not by the attorney-client privilege, and not by the work product doctrine.

It is worth pausing here, because these two concepts are what determine whether something you said or wrote can be used against you in legal proceedings — or whether it is shielded.

The attorney-client privilege is straightforward: what you tell your attorney, in their capacity as your attorney, is confidential. They cannot be compelled to disclose it. It is one of the oldest protections in common law, and it exists for a practical reason: if people could not speak with complete honesty to their attorneys, the legal system would not function. No one would tell the whole truth.

The work product doctrine is its close cousin. It protects the process of case preparation: an attorney's notes, drafts, strategy, the questions they plan to ask. The idea is that an attorney should not have to show their work to the opposing party. It would be like forcing a football team to hand its game plan to the rival before kickoff.

Judge Rakoff ruled that neither protection applied. His reasoning was direct: Heppner had disclosed information to a "third party" whose terms of service stated, somewhere no one reads, that nothing was confidential. And the documents were not prepared by his attorney or at his attorney's direction. Case closed.

It is an oral ruling. There is no written opinion. The facts are extreme — Heppner did nearly everything wrong. And yet Judge Rakoff's logic carries an implication that reaches far beyond Bradley Heppner: if you use ChatGPT, Claude, or Gemini to think through anything sensitive, what you wrote may not be confidential.

II. The Wrong Question

The problem with the Heppner case is not the answer. It is the question.

The defense framed the dispute in terms of attorney-client privilege. That was the wrong premise from the outset. The privilege protects communications between a client and their attorney. Claude is not an attorney. It holds no license, bears no fiduciary duties, and carries no professional obligation of confidentiality. Attempting to fit a conversation with a chatbot into that category was like trying to fit a soccer ball into a shoebox: no matter how hard you push, the shape does not work.

Rakoff resolved it predictably. But the right decision for the wrong reasons is still dangerous, because it establishes a conceptual precedent: if AI is not an attorney, then that communication does not enjoy the privilege.

That is an enormous logical leap. The fact that the attorney-client privilege does not apply does not mean the conversation is not private. Your diary is not protected by the attorney-client privilege; it is still private. Your notes in a notebook are not either; they are still private. The right question was never "is this a communication between attorney and client." The right question is: "is this a private communication that the user had a legitimate intent to keep confidential?"

No one asked it.

III. Your Law License Is a Shield

For those who practice law, the fear after Heppner is immediate: "Can I no longer use AI in my practice?"

The short answer is: yes, you can. And the reason is interesting, because it reveals something fundamental about how the law protects information.

An attorney has something Bradley Heppner did not: a professional license. That license imposes confidentiality obligations and, in return, grants a shield. When an attorney uses Claude to develop their strategy, the tool operates within the umbrella of those obligations. The attorney's mental process is protected as work product regardless of the medium used to develop it — whether a yellow legal pad, a word processor, or an AI chatbot. The medium is irrelevant. What matters is who is doing the thinking.

Heppner had no license. He was a client acting on his own, without direction from his attorney. No license, no umbrella.

But this is where Rakoff's logic breaks down: the absence of a professional license does not equal the absence of privacy. The fact that a client lacks the heightened protection of the professional privilege does not mean their conversation with a work tool is public. What changes is the level of protection, not its private character. It is the difference between a bank vault and the lock on your front door: both protect things, but to different standards. The fact that your lock is easier to pick does not mean anyone has the right to walk in.

IV. The Map

If all of this sounds complicated, it is because it is. The protection of your information when using AI depends on the combination of three variables: who you are, what tool you use, and the context in which you act. The following table summarizes the current state of the debate, with the case or legal basis for each scenario:

The last two rows represent the territory where the law needs to evolve. Protection today depends on terms of service that no one reads and on the existence of a professional license. User intent — which in every scenario is privacy — should be the central factor.

V. The Safe

Judge Rakoff's central argument was that Anthropic's terms of service establish that the information is not confidential. That sounds reasonable. But you have to read the full clause to understand the problem.

The "non-confidentiality" clause in Anthropic's terms of service exists to permit the retraining of the AI model. That is its purpose. It was not designed to authorize a prosecutor to access your conversations, or for an opposing party to discover them, or for a judge to declare them public. Retraining is not disclosure. They are two entirely different things.

Rakoff took a clause designed for one purpose — technical improvement of the model — and used it to justify a completely different one: procedural access to the content. It would be as if a judge determined that, because Gmail processes your emails to show you targeted advertising, your emails are not confidential and prosecutors can access them without a warrant. The technical processing of data to improve a service does not equal a waiver of the privacy expectation over its content.

But the problem runs deeper, because there is a commercial contradiction that no one raised in the case.

Anthropic — like OpenAI, Google, and every other generative AI provider — markets Claude as a professional work tool. Its marketing, its paid plans, its use cases: everything points to professionals inputting sensitive information. Legal analysis. Document drafting. Business strategy. It is a commercial offering designed, from the first pixel of its website, for people to entrust their most important thoughts to it.

And then, on page 43 of the contract, it says nothing is confidential.

It would be like a safe manufacturer selling its products under the slogan "protect your most valuable documents," but including in the fine print of the manual a clause stating: "nothing stored in this safe is considered confidential, and the manufacturer reserves the right to access the contents." The product promises security. The contract denies it. In law, this has a name: venire contra factum proprium — acting in contradiction with one's own prior conduct. You cannot benefit from the user's trust while simultaneously denying it by contract.

VI. What Happened in California

This is where the story gets interesting. Because while Heppner circulates on social media as if it were universal doctrine, two decisions from federal courts in California reached exactly the opposite result. And almost no one is citing them.

In Tremblay v. OpenAI, Inc., decided in August 2024 by the Northern District of California, Judge Araceli Martínez-Olguín determined that the prompts used by OpenAI's attorneys constituted opinion work product — the most protected category within the doctrine. Not basic, not standard: the highest. Why? Because those prompts reflected the attorneys' mental impressions, their strategy, their way of thinking through the case. Compelling their production would be the equivalent of handing the game plan to the opponent.

In Concord Music Group, Inc. v. Anthropic PBC, decided in May 2025 by the same district, Magistrate Judge Susan van Keulen reached the same conclusion: the undisclosed prompts and outputs of Anthropic's attorneys constituted attorney work product. She rejected as disproportionate the request to produce all prompts.

Two courts. Two cases. Two AI tools. Twice the same answer: the conversations are protected.

The difference from Heppner is not the tool. The tool is the same. The difference is who is using it. In California, licensed professionals used AI as an extension of their mental work. In New York, a layperson client used a consumer version on his own.

That Heppner is being presented as "the rule" while Tremblay and Concord are ignored is, in itself, a distortion of the actual state of the law. What we have is not a consolidated precedent pointing in one direction. What we have is an open debate among federal courts — and in that debate, the protective position has, if anything, stronger doctrinal foundations.

VII. The Right Analogy

If we set aside the attorney-client privilege — which was never the right framework — and move into the realm of privacy, the analogies are clear. And revealing.

Your home is private. The government cannot enter without a warrant supported by probable cause. The fact that your landlord has keys does not destroy your privacy. Your phone calls travel through a third-party infrastructure that has the technical capacity to hear absolutely everything. Yet no one suggests that this makes them non-private; wiretapping is an exception that requires a court order. Your emails in Gmail pass through Google's servers, which processes, indexes, and uses them to show you advertising. They remain private.

In all of these cases, the structure is the same: privacy is the general rule and access is the exception. It is the government that must justify the intrusion, not the citizen who must justify their expectation of privacy.

What Rakoff did was invert this logic. Instead of presuming privacy and requiring justification for access, he presumed the information was public because the terms of service — designed for retraining, not for disclosure — stated that it was "not confidential."

Now: if a person plans a terrorist attack using a chatbot, society has a legitimate interest in accessing that information. No reasonable person disputes that. But the answer cannot be to declare that all AI conversations lack protection. That is like saying that because telephone lines can be tapped in organized crime cases, no phone call is private. The gradient already exists for every other form of communication. There is no reason for AI to be the exception.

VIII. The Answer

So — is ChatGPT confidential?

It depends.

If you are an attorney and you use it to develop your strategy, yes — California has already confirmed it.

If you are any other licensed professional using an enterprise version with contractual guarantees, probably yes as well.

If you are a client acting under your attorney's direction, the doctrine suggests yes.

And if you are Bradley Heppner — a defendant who used a consumer version on his own, without direction from his attorney, to organize his thoughts about a securities fraud — a judge in New York says no.

But the real answer is that we are asking the wrong question.

We should not be asking whether AI is a "third party" that destroys confidentiality. We should be asking what intent the user had when they opened the tool and started typing. And the "non-confidentiality" clause in the terms of service — the clause Rakoff used as his basis — exists so that Anthropic can retrain its model, not so that a prosecutor can access the content. Confusing those two purposes is, perhaps, the most serious conceptual error in the entire case.

Is what you write in your AI confidential? It should be. Your thought process does not cease to be private because you use a technological tool to organize it. Privacy must be the rule, access the exception. And user intent — not the terms of service that no one reads, designed for a purpose that has nothing to do with disclosure — must define the legal character of the communication.