How to stop AI from training on your prompts and chats

This is the single most common practical question people ask me about AI: "Is it true that everything I type into a chatbot ends up training the model?" The short and slightly uncomfortable answer: in the free consumer tiers of many assistants, yes, your conversations are used to improve models by default until you turn that off by hand. In business tiers and through the API, as a rule, no. Almost all of the practical advice fits inside that one distinction.

The nuance is where people get lost. Some assume a single toggle will also wipe the past. Others believe that paying for a subscription protects them automatically. A third group issues a "do not use AI" memo to staff and considers the matter closed. All three positions are wrong.

I will go through this in layers: what happens by default, how to switch off training in specific services, what opt-out fundamentally does not do, and what a sane setup looks like for a company. One caveat up front - settings screens and their wording change often, so at the end of each step I recommend checking the current state in your own account rather than trusting a screenshot from an article.

Your tier is the main lever

Default behavior differs sharply by service tier, and this is the key to everything else.

• Free and consumer chat tiers. Here the provider generally reserves the right to use your conversations to improve its models. It is written into the terms of service, and it is on by default. You can opt out, but opting out is a deliberate action on your part.
• Business, Team, and Enterprise tiers. Under the commercial contract, your content is as a rule excluded from training by default. The provider handles data as a processor, not as an owner free to train its models on it.
• The API. Programmatic access is normally excluded from training by default as well, and runs under commercial terms. If you build a model into your product, your inputs generally do not go into the common pot.

From this comes a simple rule: if the work is sensitive, you move it to a business tier or the API rather than heroically trying to defend a free chat with toggles. Toggles help, but the tier is the layer that owns the question.

How to switch off training in specific services

Below are generic paths. The names of these settings change, so I describe the meaning of each control rather than the exact button text. Open your account's privacy settings and look for this logic.

ChatGPT (OpenAI)

• Under data controls there is a toggle along the lines of "Improve the model for everyone". Switch it off and new conversations stop being used for training.
• For one-off sensitive sessions there is "Temporary Chat": such a conversation does not enter your history and is not used for training.
• ChatGPT Team and Enterprise, along with API access, are not used for training under their terms. If you have sensitive work in the company, this is the right tier to be on.

Claude (Anthropic)

• Consumer settings include a control over whether your chats are used to improve models. Check the state of that toggle in your own account.
• Claude for Work (team and enterprise plans) and API access operate under commercial terms that exclude training on your content by default.

Google Gemini

• The key setting is "Gemini Apps Activity". It governs how long history is retained and whether humans can review your conversations to improve the service.
• Turning it off limits how your data is used for improvement. Note that retention and human review have their own logic, so read the explanation directly in the setting.

Image tools (Midjourney, Stability, and similar)

• The options here are narrower. Some services offer a paid "stealth" mode or a separate opt-out, but coverage is thinner than with text assistants.
• Assume that public generations may be visible to others and reused. If an image contains anything sensitive - unreleased brand work, a specific person's face, an internal mockup - treat a public tier as publishing.

What opt-out does NOT do

This is where most expectations break, so I will say it plainly: turning off training is not retroactive.

A "do not train on my data" toggle stops future training on new data. It does not remove what the model has already learned. Weights already trained on conversations collected earlier are not changed by the opt-out you flip today. A model is not a database you can delete a row from; it is the result of training in which your past data is already dissolved across billions of parameters.

Two practical takeaways follow:

• Switch training off as early as possible, not after you have already fed it six months of work chats. The value of opting out is in the future, not the past.
• If the real question is removing what already made it into the model, that is a separate and much heavier topic. I cover it in the piece on whether you can delete your data from a trained AI model - in short, opt-out and deletion are different things, and the second is almost never instant.

A related question is whether a model can later "spit out" something it memorized from your text. That is a real, if uncommon, effect, and it too is about the past rather than the future. I break it down in the piece on whether AI can leak personal data through memorization.

For a company, the main risk is shadow AI

For a single person things are relatively simple: switch off the toggles, and for anything sensitive use a temporary chat or a paid tier. In a company the picture is different, and the real problem has a name: shadow AI.

The mechanics are these. To move faster, employees paste whatever is at hand into free consumer chatbots. Client data. Chunks of code. Contract text. CRM exports. They do it without malice - they need to finish a task, and the free chat is right there and convenient. But from a security standpoint it is a leak: sensitive content has gone to an external service that has training on by default.

A "do not use AI" order does not solve this; it pushes it into the shadows. People keep using the tools and simply stop mentioning it, and you lose even visibility into what is happening. What works is a different combination:

• A policy. A clear rule about what may be given to a model and what may not, and on which tool.
• A sanctioned business-tier tool. One approved assistant on a Business or Enterprise plan, with a signed data processing agreement (DPA) and training and retention switched off.

In other words, you are not banning AI; you are giving people a legitimate, convenient door so they stop reaching for the free one.

Where GDPR comes in

Worth stating separately. When an employee sends a client's personal data into an external model, that is not "just a chat" - it is processing of personal data and, as a rule, a transfer to a third party, the provider running that service.

That pulls in the usual requirements: processing needs a lawful basis and a defined purpose, and any consent you rely on has to cover that purpose (purpose limitation). "We sent your data to a foreign chatbot so it could draft us an email" is very likely outside what the person agreed to. The vendor's own terms matter too: which tier you are on, whether training is excluded, where the data is physically processed, and whether a proper processor agreement is in place. A free consumer tier with training enabled is the worst possible option for client personal data, and it is the risk I would close first. If you want to look at the whole AI footprint through a data-protection lens systematically, that is the kind of work I do - happy to get in touch and start from an inventory.

How I would handle it in a company

The practical order I usually propose:

1. Inventory. Find out where prompts flow today. Which tools staff actually use, what they paste in, on which tiers. Often this first exercise alone is an eye-opener.
2. Move the sensitive work. Anything involving clients, code, contracts, or finance goes to a business or enterprise tier, or to a self-hosted solution. If the data should never leave the perimeter at all, look toward local AI; I wrote about that in the piece on running local AI so data never leaves.
3. Contract and settings. Sign the DPA, switch off training, and where possible reduce or disable history retention on the vendor's side.
4. Minimize the prompt. Give the model exactly what the task needs. Anonymize where you can. Do not paste a whole document when an excerpt is enough.
5. One approved tool. Give people a convenient sanctioned assistant so they have no reason to reach for the free one. Convenience here is part of security.

Honest caveats

• Settings change. Providers regularly rename controls, change defaults, and move toggles around. Everything I described is the logic, not an eternal instruction. Before you rely on anything, verify the current state in your account and in the current version of the terms.
• "Excluded from training" is not "not retained". Even when content does not go into training, it may be stored for a while for abuse monitoring or debugging, and humans may review it in narrow cases. Those are different guarantees; read the terms carefully.
• Opt-out is about the future. I will repeat it because it is where people stumble: opting out does not roll back weights that are already trained.
• A free tier is a public zone. The most reliable policy for genuinely secret material is to not hand it to an external model on a consumer tier at all, rather than trust that a toggle will save you.
• I am not a lawyer. The GDPR section is an engineering frame for how I see the risk. Check the specific classification of processing and the wording of consents with a lawyer.

In short

• On free consumer chat tiers, your conversations feed model improvement by default until you switch it off.
• Business, Team, Enterprise tiers and the API generally exclude training on your content by contract. That is the main lever.
• Opt-out stops future training but does not erase what a model already learned.
• For a company the key risk is shadow AI: staff in free chats. It is fixed with a policy plus one sanctioned business tool with a DPA, not with a "do not use AI" order.
• Sending a client's personal data into an external model is processing and transfer, where purpose, consent, and vendor terms all matter.

If you want to go past flipping a couple of toggles and actually understand where prompts leak in your company and how to bring that footprint into line with your data-protection obligations, this is the kind of thing I help untangle - feel free to get in touch, and we start from an inventory of what is already leaving the building.