It starts innocently.

You paste in an email from your ex so the chatbot can help you reply without sounding unhinged.

Then your bloodwork results, because you want to know what “slightly elevated” means.

Then a screenshot of your bank statement, because you finally want a budget.

Then the performance review your boss marked confidential.

And somewhere around the fourth paste, a small voice asks: where is all of this actually going?

Good question. Chatbots are designed to feel like a private conversation — a patient, non-judgmental listener at 11 p.m. But a chat window is not a diary with a lock. It’s a service run by a company, with its own rules about what it keeps, who can see it and what it’s used for.

None of this means you shouldn’t use AI. (We’re fans of the practical stuff — see What AI Is Actually Useful for in Real Life Right Now.) It means you should use it the way you’d use any other service that handles your information: on purpose.

What the regulators are saying

This isn’t just a tech-bro debate. Privacy regulators on both sides of the border are paying close attention.

In Canada

In December 2023, Canada’s federal, provincial and territorial privacy commissioners jointly published principles for “responsible, trustworthy and privacy-protective” generative AI. Among them: organizations offering these tools should be open with users, and public-facing tools should let people know about things like “not entering personal information into a prompt, unless necessary.” The commissioners also flagged children as “particularly at high risk of significant negative impact by AI technologies, including generative AI.”

Then, in May 2026, the Office of the Privacy Commissioner of Canada and its counterparts in Quebec, British Columbia and Alberta released the results of a joint investigation into OpenAI’s ChatGPT. The regulators found that the way ChatGPT was initially trained did not comply with their privacy laws. Their concerns included over-collection of personal information, weak consent and transparency, inaccurate information about individuals, and difficulty accessing, correcting or deleting personal data.

One finding is especially relevant to everyday users: according to the regulators’ summary, “many users were unaware that their data was collected and used to train ChatGPT.” Among the commitments OpenAI made: telling users of the signed-out web version of ChatGPT, before their first prompt, that chats may be reviewed and used to train models — and advising them not to share sensitive information.

The federal commissioner considered the matter conditionally resolved after the company made changes, and his office says it will keep monitoring. The provincial outcomes differed: B.C.’s and Alberta’s commissioners found the complaint well-founded and unresolved, and Quebec’s regulator reached mixed conclusions under its own law. But the bigger takeaway applies to every AI product, not just one: your conversations may be used in ways you didn’t assume.

In the U.S.

In January 2024, the Federal Trade Commission warned AI companies that customers “may reveal sensitive or confidential information when using a company’s models,” and that quietly changing terms of service or privacy policies to use data in new ways — without clear notice and “affirmative express consent” — could break the law. Its summary line: “There is no AI exemption from the laws on the books.”

In September 2025, the FTC went further, ordering seven companies that offer consumer chatbots — including some of the biggest names in tech — to explain how they handle companion-style chatbots. Among other things, the agency asked how they “use or share personal information obtained through users’ conversations with the chatbots,” and what they do to protect children and teens.

Translation: the people whose job is consumer protection are asking exactly the questions you should be asking.

The settings concepts worth understanding

Every AI product handles this differently, and settings change often. So instead of telling you which toggle to flip in which app this week, here are the concepts to look for. Check your own tools’ privacy settings and policies for each one.

1. Training use

Does the company use your conversations to improve or train its models? Some products do this by default for consumer accounts. Some let you opt out. Some offer different rules for paid, business or education accounts. Look for wording like “improve the model,” “help improve our services” or “use my content for training.”

2. Data retention

How long are your chats kept — and does deleting them in the app actually delete them from the company’s systems? Retention periods vary, and deleted conversations may be held for some period for safety, legal or abuse-monitoring reasons. The privacy policy should say. If it’s vague, that’s information too.

3. Human review

Some companies allow staff or contractors to review samples of conversations, often for safety or quality. Assume any chat could be read by a person unless the policy clearly says otherwise.

4. Temporary or “incognito” chats

Many tools now offer a mode that doesn’t save conversations to your history. Useful — but read the fine print. “Not in your history” doesn’t automatically mean “never stored anywhere.”

5. Memory and personalization

Some assistants can remember details across conversations to tailor future answers. Convenient for remembering you’re vegetarian. Less charming when it remembers your divorce. Check whether memory is on, what it has stored, and how to delete it.

6. Connected apps and permissions

AI tools increasingly ask to connect to your email, calendar, cloud storage or files. Every connection widens what the tool can see. Only grant access you actually need, and review it periodically.

7. Sharing links

Many chatbots let you share a conversation via link. Treat a shared link as public: anyone who has it may be able to see the conversation.

What not to paste into a chatbot

A practical rule of thumb: if you wouldn’t put it in an email to a stranger, don’t put it in a prompt.

• Government ID numbers — Social Insurance Number, Social Security number, passport, driver’s licence, health card.
• Financial account details — card numbers, account numbers, passwords, full statements.
• Passwords and security answers. Ever. For anything.
• Identifiable health information — especially with your name or other identifiers attached.
• Other people’s private information — your friend’s crisis, your sister’s diagnosis, your colleague’s salary. It’s not only your privacy on the line.
• Confidential work material — client files, unreleased plans, anything under NDA. Your employer may have its own AI policy; find out before you paste.
• Your children’s details — names, schools, photos, health or behaviour information.

A note on health information

This one catches people off guard.

In the U.S., the health privacy law most people have heard of — HIPAA — applies to specific entities like healthcare providers, health plans and their business associates. The U.S. Department of Health and Human Services has explained that once health information is sent at a person’s direction to an app that isn’t covered by HIPAA, “the information is no longer subject to the protections of the HIPAA Rules.”

In Canada, privacy protection depends on who holds the information and which federal or provincial law applies — which is part of why multiple commissioners were involved in the ChatGPT investigation.

Either way, don’t assume the protections you get in a doctor’s office follow your information into a chat window.

If you want help understanding a test result, a safer approach is to remove identifying details and describe the question in general terms — then take what you learn back to your healthcare provider.

How to share less and still get help

You can still get useful answers without handing over your life story.

• Anonymize. Swap real names for “my manager,” “my sister,” “Client A.”
• Generalize. “A woman in her 40s with a mortgage and two kids” instead of your actual figures and address.
• Redact before you paste. Black out or delete account numbers, addresses and names from documents and screenshots first.
• Ask the general question first. “How does a fixed vs. variable mortgage work?” often gets you 90% of the way without your own numbers.
• Review your history. Every so often, delete conversations you no longer need.

If you have kids or teens using AI

Canadian privacy commissioners have specifically flagged children as a high-risk group, and the FTC’s 2025 inquiry focused heavily on how companion-style chatbots affect kids and teens.

Practical starting points: check the tool’s minimum age requirement, talk with your kids about what not to share (the same list above), and keep the conversation going rather than relying on a single rule. For the broader evidence on young people and devices, see our piece on teenagers and phones: what the research actually says.

If something goes wrong

If you believe a company has mishandled your personal information, you can usually start by contacting the company’s privacy office and requesting access to, correction of or deletion of your data.

If that doesn’t resolve it, Canadians can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca (the OPC itself encourages trying to resolve things with the organization first). In Alberta, British Columbia and Quebec, a provincial privacy law and commissioner may apply instead, depending on the situation. In the U.S., the Federal Trade Commission accepts consumer reports about fraud and bad business practices at ReportFraud.ftc.gov.

The Curious One’s take

The weird thing about chatbots is how intimate they feel. They’re polite, endlessly patient and awake at 2 a.m. It’s very easy to tell them things you haven’t told anyone.

That’s exactly why it’s worth pausing.

You don’t have to go off-grid. You don’t have to read every privacy policy ever written (no one has). You just need a few habits: know your settings, strip out the identifying details, and keep the truly sensitive stuff for humans who are bound by professional confidentiality.

Curiosity is good. So is a little healthy suspicion about where your words end up.

Find more on AI, culture and the digital life we’re all living on our Growth & Culture desk.

ASK MUDDY

Be honest: what’s the most personal thing you’ve ever pasted into a chatbot — and would you do it again after reading this?

JOIN THE MUDDY COMMUNITY

Life gets messy. We talk about it. Join the free Muddy community at muddystilettos.ca for new stories each week on the tech, culture and ideas shaping women’s lives.

ABOUT THE MUDDY GROWTH & CULTURE DESK

The Muddy Growth & Culture Desk covers books, shows, AI, culture and the internet rabbit holes worth falling into — and connects them to the bigger questions in women’s lives. We separate reporting from opinion and go back to the original sources.

Featuring The Curious One: books, Netflix, AI, culture and internet rabbit holes. Curious, reflective, sharp.

This article is educational and informational and is not legal advice. Privacy laws and product settings vary by jurisdiction and change over time; check current policies and consult a qualified professional for advice about your situation.

Sources

• Principles for responsible, trustworthy and privacy-protective generative AI technologies — Office of the Privacy Commissioner of Canada
• Joint investigation by Canadian privacy regulators into OpenAI’s ChatGPT leads to better protections — Office of the Privacy Commissioner of Canada
• Backgrounder: Summary of joint investigation into OpenAI’s ChatGPT — Office of the Privacy Commissioner of Canada
• AI Companies: Uphold Your Privacy and Confidentiality Commitments — U.S. Federal Trade Commission
• FTC Launches Inquiry into AI Chatbots Acting as Companions — U.S. Federal Trade Commission
• File a privacy complaint about a business — Office of the Privacy Commissioner of Canada
• ReportFraud.ftc.gov — U.S. Federal Trade Commission
• The Access Right, Health Apps, & APIs — U.S. Department of Health and Human Services