No: OpenAI states that it does not sell user data. That is the honest short answer. The more useful question is what else can happen to what you type. On consumer ChatGPT plans, conversations may be used to train OpenAI's models unless you opt out, conversations are stored, and OpenAI has said it cannot rule out that de-identified data from usage helped improve its models. "Not sold" is not the same as "never reused".
An everyday example
A solicitor, "James", pastes a client's draft settlement into the free version of ChatGPT and asks for a tighter summary. What happens next?
- OpenAI does not sell that conversation to anyone. On that point its policy is clear.
- Unless James has turned off "Improve the model for everyone" in Data Controls, the conversation may be used to train future models.
- The conversation is stored in his history, and stored conversations can be subject to legal processes, such as the preservation order in the NYT v. OpenAI litigation.
If James had used a business or API plan instead, the default would be different: those tiers are not used for training by default.
The details, simply
What OpenAI says
- Selling: OpenAI states it does not sell user data.
- Training on consumer plans: consumer ChatGPT (Free, Plus, Pro) may use conversations for model training unless the user opts out.
- Business and API: ChatGPT Business, Enterprise, Edu and the API are not used for training by default.
Policies change, so always check OpenAI's current terms for your plan.
Selling vs reusing
"Selling" has a narrow meaning: handing data to a third party for money. Most of the real questions about AI and confidential data are about other things:
- Training: your words help shape a model that millions of others use.
- Retention: how long your conversation exists, and who could demand it.
- De-identification: whether data with your identity removed is used in other ways.
On that last point, OpenAI wrote in September 2026, in a statement about two researchers who had used its products: "While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models."
That is a candid statement, and it points to a gap that applies across the industry, not to one company.
What "we don't sell your data" does not cover
Data protection law protects the identifiable part of your data. Under GDPR Recital 26, anonymous information is outside data protection law altogether. So:
- A provider can truthfully say it does not sell your data and still be allowed to use de-identified versions of it, for training, research or improving products.
- Once data counts as anonymous, it is no longer protected by GDPR. Legally it can be pooled, licensed and even sold by whoever holds it.
- The clinical detail, the contract clause or the deal figure usually survives de-identification. Only the name goes.
- De-identification is often weaker than it sounds. A few attributes can point back to a person, as we explain in pseudonymisation vs anonymisation.
The wider market for de-identified data is described in what is a data broker. We show how one record can travel on the data trail, and why each step is lawful on legal to sell.
Not sold, but shared: trackers in AI chat apps
There is a second route out that has nothing to do with selling. In 2026, researchers at IMDEA Networks tested nine AI assistants, ChatGPT among them, on the web and on Android. In six of the nine web versions, conversation links, auto-generated chat titles, prompts or screenshots reached third-party advertising and analytics services, often next to a persistent user ID (the study, covered in Germany by heise online). A chat title like "Mum's dementia diagnosis, what next?" says a lot on its own. How this works is explained in what is a tracking pixel.
So a complete answer needs three questions, not one: is my data sold, is it reused in de-identified form, and which third parties does the app itself talk to?
None of this means OpenAI does anything unlawful. It means "not sold" answers a narrower question than most professionals are asking.
What this means when you use AI tools
For casual questions, consumer ChatGPT with training switched off may be enough. For client, patient or company data, check any AI tool against these points:
- Training: is your content ever used to train models, and is "off" the default or a setting you have to find?
- Licence: do the terms let the provider use, aggregate or de-identify your content?
- Retention: how long is content kept, by the tool and by each model provider behind it?
- Trackers: does the app load advertising or tracking services that could see chat titles or links?
- Role: is the provider your processor under a data processing agreement?
- Location: where is your data processed?
Wysor gives you OpenAI's GPT models, alongside Claude, Gemini and more, in one workspace with different terms. We act only as your processor under Art. 28 GDPR and take no licence to reuse your content. We never train on it and never sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention: processed, then deleted. And Wysor runs no advertising trackers or ad pixels: your chat content and chat titles are not sent to any advertising network.
FAQ
Does ChatGPT sell your data? OpenAI states that it does not sell user data. The more relevant questions are whether your conversations are used for training, how long they are stored, and whether de-identified data derived from them is used.
Does ChatGPT use my conversations for training? On consumer plans (Free, Plus, Pro), conversations may be used for training unless you turn off "Improve the model for everyone" in Data Controls. Business, Enterprise, Edu and API tiers are not used for training by default.
Is ChatGPT safe for confidential client or patient data? Consumer ChatGPT is not designed for that. For confidential data you want a processor-only agreement, no training, zero retention and EU processing. Our guide is ChatGPT safe? goes through each point.
Does OpenAI keep my deleted chats? Deleted chats are normally removed after a retention period, but stored data can be subject to legal preservation, as happened in the NYT v. OpenAI litigation. Check OpenAI's current policy for details.
What is de-identified data? Data with names and direct identifiers removed. Depending on how well it is done, it may be pseudonymised, and still personal data, or anonymised, and outside GDPR entirely.
Further reading
- Is ChatGPT safe? What it does with your data
- ChatGPT vs Claude vs Gemini privacy compared
- What is a data broker?
- The right to be forgotten (GDPR Article 17), explained simply
- The data trail
- How does ChatGPT work? Explained simply
Questions about using AI with sensitive data? Reach us at [email protected] or through the in-app contact form.
