SELINA.ai
Sign in
privacy

Default-On Memory: What the Major AI Labs Aren't Saying About Privacy and Retention

Every major AI assistant now remembers you by default. The privacy question isn't whether they remember. It's what they retain, for how long, and what happens when you press delete. Most users assume "delete" means gone. It doesn't. Not across the board. This piece lays out the specifics of what OpenAI, Google, and Meta retain by default, how long they keep it, and where the controls actually are (or aren't). If you're building on top of these platforms or just deciding whether to trust one with your work, this is the information you need to make that call.

Key Takeaways

Why Does "Default-On" Matter More Than the Feature Itself?

Because defaults are where most users stay. The research on this is old and consistent: the vast majority of users never change a default setting. When memory is default-on, the population-level effect is that nearly everyone's data gets retained, and the small percentage who actively disable it are self-selecting for technical sophistication. The feature design choice to make memory opt-out rather than opt-in is, in effect, a retention policy choice. It determines the volume and scope of data the provider accumulates.

For builders, this matters because your users inherit whatever defaults the underlying platform sets. If you're shipping a product on top of a provider's API, your users' data may be flowing into training pipelines or retention systems you didn't design and can't audit. For individual users, it matters because the word "memory" implies something you control, like your own recall. The implementations don't work that way.

What Does OpenAI Actually Retain by Default?

OpenAI retains conversations indefinitely until a user manually deletes them. After deletion, the data persists on their systems for up to 30 days. But the more important detail is architectural: memories and chat history are separate data stores. When the memory feature extracts a fact about you (your name, your preferences, a project you mentioned), that extraction lives independently of the conversation it came from. Delete the conversation, and the memory remains. You have to go to Settings and clear memories individually.

Most users don't know this. The mental model is "I deleted the chat, so the AI forgot." That's wrong.

On consumer accounts, conversations including memory may be used to improve models by default. The opt-out exists under Settings, in Data Controls, under "Improve the model for everyone." It's there. It's not prominent. And the phrasing ("for everyone") frames opting out as a mildly antisocial act, which is a known dark-pattern technique in consent design.

It may not actually be deleted. In May 2025, a federal judge issued a preservation order requiring OpenAI to retain all ChatGPT user logs as part of the New York Times copyright lawsuit. This means that even if you pressed delete, your data may have been preserved for litigation purposes. You were not notified. There is no user-facing indicator that your account's data is subject to a legal hold. The delete button still works in the UI. The backend behavior is different.

This isn't unique to one company. Litigation holds are standard across the industry. But the gap between what the interface promises and what the infrastructure does is worth understanding clearly. "Delete" is a request. Whether it's honored depends on legal circumstances you can't see.

How Does Google Handle Retention Across Free and Paid Tiers?

The split is stark. On Google's free tier, submitted content is used to provide, improve, and develop products and services, and human reviewers may see it. On paid services, Google states it does not use prompts or responses to improve its products. This is a meaningful distinction, but it means the privacy posture of the product is a function of how much you pay.

The retention window on the consumer side offers more configurability than competitors. Users can set retention at 3, 18, or 36 months, which is a genuine user-control feature that most alternatives don't provide. Credit where it's due.

What About Google's Access to Gmail and Personal Data?

This is where it gets uncomfortable. In late 2025, Google enabled its AI assistant's access to Gmail, Chat, and Meet by default for US users, later rebranding the feature as "Personal Intelligence." When enabled, the assistant can read a user's entire email history. In the US, this was opt-out. In Europe, under GDPR, it was opt-in.

Same product. Same feature. Different default. The only variable is regulatory jurisdiction.

A California lawsuit alleges that Google used the existing "Smart Features" toggle as a backdoor to enable deeper AI data access without clear consent. As of early 2026, that case was in discovery. The outcome will matter for how "consent by toggle inheritance" is treated legally.

On the enterprise side, the core memory feature is enabled by default and cannot be fully disabled. Administrators can opt users out of connected data sources or delete saved memories, but the memory feature itself stays on. For compliance teams, this creates an interesting problem: you can't turn off a feature that your retention policies may require you to control.

Google Vault now supports retention rules and litigation holds for its AI app, letting admins set default or custom retention periods by organizational unit. This is a compliance-driven addition that signals growing legal exposure around AI chat logs. When a provider builds litigation-hold tooling for your AI conversations, it tells you something about where the legal landscape is heading.

What Does Meta Retain, and Can You Actually Opt Out?

Short answer: Meta trains its AI on public posts, comments, photos, likes, Messenger conversations, and chatbot interactions, and the only way to fully stop data collection is to delete and stop using Meta services. Formal opt-out or objection rights exist only in select regions (the EU and UK, primarily). US users have no equivalent mechanism.

This is the most aggressive default posture of the three. There is no ambiguity in the policy. If you use the platform, your content feeds the model.

Is There a Temporary or Private Chat Option on Meta's AI?

No. Unlike the other major assistants, Meta's AI has no dedicated temporary-chat toggle. The practical workaround is to use the assistant while logged out, which is barely a workaround at all since it strips the context that makes the assistant useful.

As of December 2025, Meta began using AI chat data to personalize ads across its family of apps. Your conversation with the assistant informs which ads you see on the social feed. The data flows are bidirectional, and they're not optional.

Then there's the scope creep. Starting July 2026, Meta began using off-site browsing activity (via tracking tools like Pixel) to personalize feeds and recommend content. This isn't strictly an AI-memory issue, but it broadens the behavioral data pool that feeds the company's AI-driven personalization engine. The line between "the AI remembers what you said" and "the AI knows what you browsed" is getting thinner.

What Happened When Meta AI Activity Was Made Public?

In June 2025, Meta AI searches and prompts appeared on a public "Discover" feed, with some posts traceable back to users' social accounts via usernames and profile photos. Meta shut it down after backlash, but the incident demonstrated something important: in a default-on, socially-connected system, the boundary between "private query" and "public activity" can fail in ways that expose users who never intended to share.

This is the risk that "default-on" creates at scale. It's not just about what the company does with your data intentionally. It's about what happens when the default assumption (that your AI interactions are private) collides with a product decision (that sharing is social and good) and the result is public exposure.

Why Are "Memory" and "Chat History" Different, and Why Does It Matter?

Because they have different deletion flows, different retention policies, and different downstream uses. This distinction is consistent across providers but almost never explained to users.

Chat history is the raw transcript. Memory is the structured extraction: facts, preferences, biographical details pulled from conversations and stored persistently. When you interact with an AI assistant that "remembers" you, it's querying the memory store, not re-reading old transcripts. The two data stores serve different functions, live in different parts of the architecture, and (critically) respond to different delete commands.

If you've only ever deleted conversations and assumed the AI "forgot," you likely have a persistent memory profile that still exists. Across providers, the pattern is the same: deleting the source doesn't delete the derivative.

This is an architectural problem, not a UI bug. The memory extraction pipeline runs at ingestion time. Once a fact is extracted and stored, its provenance link to the source conversation may not even be preserved. Deleting the conversation is like shredding a form after the data has already been entered into a database. The database doesn't know or care that the form is gone.

What Does Regulatory Geography Tell Us About Real Privacy Defaults?

It tells us that the strictest jurisdiction's defaults are the ones the providers consider technically feasible, and they choose not to apply them globally. If opt-in consent for email access is achievable in Europe, it's achievable in the US. The decision to make it opt-out in the US is a business decision, not a technical constraint.

GDPR gives EU and UK users formal objection rights for AI training data use. US users get a settings toggle, sometimes, if they know where to look. The feature is the same. The data flows are the same. The default is different because the legal requirement is different.

For builders evaluating which platform to trust with user data, this geography dependence is a risk factor. Your users' privacy posture changes based on where they live, and you may not control or even know which default applies. If you're building for a global audience, the weakest regional default is your effective baseline unless you do the work to override it.

How Does Persistent Memory Become an Attack Surface?

This is something we think about constantly at Selina, because memory is core to our product. When an AI assistant remembers facts about you across conversations, those stored memories become inputs to future inference. If an attacker can inject a fact into your memory store (via a crafted message, a shared document, a prompt embedded in content the assistant processes), that injected "memory" persists and influences every subsequent interaction.

This is persistent injection, and it's qualitatively different from the single-session prompt injection that gets most of the attention. A single-session attack ends when the conversation ends. A persistent injection lives in the memory store. It survives across sessions. It can subtly alter the assistant's behavior in ways the user never notices, because the user doesn't review their stored memories regularly (or at all).

The defense isn't simple. You can't just filter inputs, because legitimate memories and injected memories look structurally identical. You need integrity checks on the memory pipeline itself, anomaly detection on memory writes, and (ideally) user-facing audit tools that make the memory store inspectable. We've invested in this because we think persistent memory is genuinely useful, and building it without thinking about injection is negligent. But the major providers don't discuss this attack surface publicly, which is concerning given that their memory features are on by default for hundreds of millions of users.

Selina's memory is encrypted at rest and the account is protected, but we want to be precise: memory is NOT end-to-end encrypted, because a slice of each request reaches a frontier provider at inference. Files and transfers via SelinaSEND are zero-knowledge encrypted. The memory store is a different category with different properties, and conflating the two would be dishonest.

What Should You Actually Do With This Information?

If you're an individual user: go check your memory settings on every AI assistant you use. Not your chat history. Your memory settings, specifically. Look at what's stored. Delete what you don't want persisted. Then decide whether the default posture of the platform matches your expectations. If it doesn't, either change the settings (where possible) or change the platform.

If you're a builder: don't inherit defaults uncritically. If you're building on a provider's API, understand their retention policy for your tier. Paid tiers generally offer better data-handling terms, but "better" still means reading the actual terms, not assuming. Check whether your users' data feeds training pipelines. Check whether litigation holds can override deletion. Check whether memory extractions persist after conversation deletion. These aren't edge cases. They're the baseline architecture.

If you're evaluating memory-enabled assistants: compare the deletion flows, not the feature descriptions. Every provider will tell you that memory makes the assistant more useful (it does). Fewer will tell you exactly what happens when you want it to stop. The specifics of deletion, the separation of memory from chat history, the regional variation in defaults, the litigation-hold exceptions: these are the details that determine whether "private" means anything concrete or just describes a setting you haven't found yet.

The pattern across all three major providers is consistent. Memory is on by default. Deletion is partial by default. Training use is on by default (consumer tier). And the strictest privacy posture is reserved for the jurisdictions that legally require it. If you want something different, you have to build it or choose it deliberately.

If you want to try an assistant where memory is built with these tradeoffs in mind, start a free 7-day trial, no card required.

Frequently Asked Questions

If I delete a conversation, is all related data actually gone?

Not necessarily. At least one major provider stores extracted 'memories' in a separate data store from chat history, so deleting a conversation does not delete the memories derived from it; those must be cleared separately in settings.

Why does it matter that memory features are enabled by default rather than opt-in?

Because most users never change default settings, so a default-on memory feature effectively functions as a retention policy, causing nearly all users' data to be kept while only a technically sophisticated minority opt out.

Can legal proceedings affect whether my deleted data is really deleted?

Yes. A federal preservation order tied to a copyright lawsuit required one provider to retain all user logs, meaning some deleted chats may still exist on its servers even though the delete button in the interface still appears to work, with no notification to affected users.

Does paying for an AI service change how much data is retained or used for training?

According to the article, on one provider's free consumer tier, submitted content can be used to improve products and may be reviewed by humans, while on its paid tier, prompts and responses are not used to improve products, and users can also choose a retention window of 3, 18, or 36 months.

Is there a way to fully opt out of a social platform's AI training on my content?

For the social media company discussed, the only complete way to stop data collection is to delete your account and stop using its services entirely; formal opt-out rights exist only in select regions like the EU and UK, and there is no dedicated private or temporary chat mode for its AI assistant.

Sources & References

Michael C.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

Learn more about Selina.ai