What Happened to ChatGPT Data Privacy Lawsuits?

The legal landscape surrounding ChatGPT's data privacy has become increasingly complex since its public launch, evolving into a multifaceted challenge for OpenAI. Initially, concerns revolved around the default use of user conversations for model training and the general lack of transparency regarding data handling. OpenAI has since introduced various privacy controls, including opt-out options for training and enterprise-tier solutions with stricter data retention policies.

One of the most recent and significant developments is a proposed class-action lawsuit filed in California federal court on September 16, 2026. This lawsuit, Vredenburgh v. OpenAI OpCo, LLC, alleges that OpenAI failed to adequately disclose that hundreds of third-party contractors, under an internal program called 'Project Lily,' review real ChatGPT user conversations to evaluate and improve the AI model. Plaintiffs claim that OpenAI presented ChatGPT as a private exchange while allowing human reviewers access to prompts, including sensitive personal information, despite automated filters. OpenAI was served on September 21, 2026, with a response due by October 13, 2026, and the first case management conference set for December 18, 2026.

Another key privacy challenge emerged with the Couture v. OpenAI Global, LLC class action, filed on May 13, 2026, in the U.S. District Court for the Southern District of California. This complaint alleges that OpenAI embedded tracking technologies like Meta Pixel and Google Analytics into the ChatGPT.com website, leading to the interception and leakage of sensitive user queries to Meta and Google for advertising purposes. The lawsuit claims that query text, alongside advertising cookies and personally identifiable information, was transmitted to these third parties, potentially linking private ChatGPT conversations to real-identity profiles. OpenAI sought dismissal of this lawsuit in July 2026, arguing that the plaintiff consented to such disclosures by accepting OpenAI's privacy policy.

Beyond direct user privacy, OpenAI and Microsoft are embroiled in significant copyright infringement lawsuits, notably from The New York Times and other publishers, regarding the extensive scraping of internet content to train AI models. While not a 'data privacy' lawsuit in the traditional sense of user PII, it fundamentally questions the ethical and legal boundaries of data acquisition for AI development. Unsealed court filings on September 17, 2026, in the In re OpenAI Inc. Copyright Infringement Litigation revealed internal Microsoft documents from January 2023 where a director described large-scale news scraping as 'an astonishing theft of unprecedented proportions' and potentially 'the largest theft of labor in human history.' These revelations significantly weaken the companies' fair-use defense and could set precedents for how publishers' material may be used in generative AI training.

OpenAI also faces other distinct but related legal challenges. In March 2026, Nippon Life Insurance Company sued OpenAI in Illinois, alleging ChatGPT engaged in the 'unauthorized practice of law' by advising a former claimant to challenge a settled case and generating legal filings. Furthermore, a consolidated action in California Superior Court, In re: ChatGPT Prod. Liab. Cases, from February 2026, coordinates twelve cases alleging ChatGPT caused psychological harm, reinforced delusional beliefs, or contributed to self-harm, raising questions about AI product liability and safety. These cases, while not strictly data privacy, underscore the broad legal and ethical scrutiny OpenAI faces regarding the impact and responsible deployment of its AI technologies. Regulatory bodies, such as the Office of the Privacy Commissioner of Canada, have also issued findings regarding OpenAI's data handling, emphasizing principles like 'privacy by default.' The EU AI Act, which entered into force in August 2024 and has staggered implementation, also imposes transparency obligations and potential fines for AI systems, further shaping the regulatory environment for OpenAI's data practices.