Default-on memory: why mainstream AI assistants quietly started remembering everything about you, and what it means for your privacy

Sometime in the last eighteen months, the major AI assistants stopped asking whether they could remember you. They just started doing it. Your dietary restrictions, your kid's name, the medication you asked about at 2 a.m., the project you described to a chatbot instead of a therapist. All of it, retained by default, stored on infrastructure you don't control, subject to policies you almost certainly haven't read. This is a privacy shift that happened without a press conference. It deserves a closer look than it's gotten.

Key Takeaways

• The three largest consumer AI assistants now retain personal context from your conversations by default, with opt-out controls that are buried, incomplete, or in one case essentially nonexistent.
• Deletion is often cosmetic: legal holds, abuse-monitoring windows, training pipelines, and embedding layers can preserve data well after you hit "delete," and courts have confirmed AI chat logs carry no special legal privilege.
• "Personalization" reframes what is structurally a profiling operation as a convenience feature, converting casual disclosures into behavioral data without meaningful consent.
• Memory stored on a vendor's servers is a legal-exposure surface: subpoena-able, discoverable, and (in at least one documented case) subject to preservation orders that override user-facing controls entirely.
• An alternative architecture exists: user-owned memory pins, encrypted at rest, with deletion that actually propagates. We built one. It has limits we'll state plainly.

What changed, and when did memory become the default?

Memory went from experimental opt-in to standard behavior across all three major platforms within roughly a twelve-month window. ChatGPT's memory is now on by default for Free, Plus, Pro, and Team accounts, with Enterprise and Edu tiers being the exception (admins must opt in). As of 2026, there are two overlapping memory layers: an explicit, user-editable list of "saved memories" and a subtler "reference chat history" that pulls patterns from past conversations, a feature that launched in April 2025.

Gemini rolled out a "Personal context" setting that learns from previous conversations, including hobbies, past projects, and favorite topics, to shape future suggestions. It is turned on by default for consumer accounts. That memory lives inside the same account infrastructure as email, search history, location data, YouTube watch history, photos, calendar, and documents, which is an architectural choice with consequences we'll get to.

Meta's AI app reportedly offers no true opt-out from saving chats or memories. The closest workaround documented so far is using Meta's AI website without logging in. That is not an opt-out. That is using a different product.

Why did every major assistant turn memory on by default?

Because memory increases session length, return visits, and perceived utility, all of which drive the metrics that matter to ad-supported and subscription businesses. A chatbot that remembers your preferences feels smarter. A chatbot that feels smarter keeps you coming back. A chatbot you keep coming back to is one you're less likely to cancel, or more likely to see ads inside.

None of this is conspiratorial. It is straightforward product incentive. The issue is that the resulting data collection happens through a UI pattern (casual conversation) that people do not associate with surveillance. You don't fill out a form. You don't click "I agree to share my health data." You just mention your back pain in passing, and the system files it.

Is "delete" actually delete?

Usually not, and sometimes provably not. There are several layers to this.

Opting out of training on ChatGPT does not delete past conversations, and a standard 30-day retention window for abuse monitoring persists even after opt-out. That is documented policy, not speculation.

Then there's the litigation layer. A court ruling tied to lawsuits from news organizations ordered the preservation of all output logs, including deleted chats. That preservation order ran through September 26, 2025, during which time user-facing deletion controls were effectively overridden by a legal hold users were never individually notified about. Normal retention practices reportedly resumed afterward, but the precedent is set: a legal hold can silently freeze your data in place regardless of what the UI tells you.

Deeper layers like embeddings used for personalization, training signals, and metadata in logs are often invisible to users. Even where a delete button exists, whether deletion actually propagates across every system layer is rarely verifiable by the person who pressed the button.

We've thought about this a lot while building Selina. When a user deletes a memory pin in our system, the deletion propagates. Delete means gone. Actually gone. But we want to be precise about the scope of that claim: Selina's memory is encrypted at rest, but memory is NOT end-to-end encrypted. A slice of each request reaches a frontier provider at inference time. Files and transfers through SelinaSEND are zero-knowledge encrypted. Memory is not. We say this because it's true, and because the distinction matters more than marketing convenience.

What exactly gets stored when you talk to an AI assistant?

More than the conversation transcript. The explicit "memories" you can view and edit are only the visible layer. Beneath that:

• Conversation logs, which include timestamps, session duration, and the full text of every exchange.
• Behavioral signals: what you asked about, how you phrased it, what you followed up on, what you abandoned.
• Metadata: device type, IP address, approximate location, account identifiers, session patterns.
• In some architectures, embeddings: vector representations of your conversation content that capture semantic meaning even if the original text is deleted.

Training on conversations is on by default for Free, Plus, and Pro plans unless a user has manually switched it off, which most users never do. This means your casual disclosures may feed model improvement pipelines that benefit the vendor's entire user base, with your data dissolved into weights you can never extract or audit.

How does cross-account data merging increase the risk?

It creates a single point of correlation across a person's entire digital life. When AI memory lives in the same account as email, search history, location data, YouTube viewing habits, photos, calendar entries, and documents, the assistant doesn't just know what you told it. It can potentially correlate what you told it with where you were, who you emailed, what you searched for, and what you watched afterward.

This isn't a hypothetical integration. It's the documented architecture. And it converts a chatbot memory feature into something structurally closer to a behavioral profile that spans every service tied to that account.

Are AI conversations legally protected?

No. Court decisions from 2025 and 2026 established that AI chats are electronic evidence available through standard discovery on the same footing as emails or messenger logs. There is no special privilege. Attorney-client privilege does not cover a conversation with an AI assistant. Medical confidentiality does not cover symptoms you described to a chatbot.

Think about what this means practically. If you are involved in litigation (a divorce, an employment dispute, a contract claim), opposing counsel can request your AI chat history through standard discovery. If the vendor has retained it, which they likely have for at least some window, it's producible. If a legal hold is in place, your "deleted" conversations may still exist on the vendor's servers.

This is not a privacy footnote. This is a new category of legal exposure that most users have never considered.

What about children and vulnerable users?

The problem is worse here, and regulators are starting to respond. On January 8, 2026, the Kentucky attorney general filed the state's first lawsuit under its new Consumer Data Protection Act against an AI chatbot company, alleging unfair and deceptive practices and exploitation of children's data.

The proposed federal CHATBOT Act includes restrictions on memory retention and engagement features, responding to allegations that chatbots cultivate long-term emotional dependency and are engineered to maximize session time among minors. Default-on memory is central to this concern: it is the mechanism by which an assistant builds the kind of persistent relationship that keeps a child coming back.

How large is the governance gap?

Large and widening. AI product teams shipping memory features are operating in a regulatory gray zone where default-on data retention may conflict with GDPR, CCPA, and emerging FTC guidance on behavioral profiling. Founders building on AI APIs that expose memory functionality inherit downstream liability if their products store sensitive user data without explicit, auditable consent flows.

The numbers reflect this. A Cisco 2026 study of over 5,200 privacy and security professionals across 12 countries found 90% of organizations expanded privacy programs specifically because of AI. 38% now spend at least $5 million a year on privacy programs, up from 14% a year earlier. Despite this spending, 65% still struggle to access high-quality data efficiently, which tells you how much of the investment is reactive patching rather than structural improvement.

Documented AI incidents climbed from 233 in 2024 to 362 in 2025, per Stanford's AI Index. Capability is outpacing governance. That's the polite framing. The blunt framing: companies shipped memory features first and are now scrambling to figure out what the rules should have been.

What does "always-on sensing" look like as the next step?

Meta is reportedly developing "super sensing" smart glasses that would constantly watch and listen to the environment, unlike current wearables that respond only after activation. The assistant would always know what the wearer sees and hears. This is memory extended beyond text into continuous perceptual data, always on, with no activation trigger.

If default-on text memory raises privacy questions, default-on audiovisual capture raises them by an order of magnitude. And the same architectural question applies: who stores it, who can access it, and what does "delete" actually mean when the data has already been processed into a persistent model of your environment and behavior?

What would a different architecture look like?

We asked ourselves this question when we started building Selina, and the answer we arrived at is: user-owned memory, not vendor-owned memory.

In Selina, memory is organized as pins that the user controls. You decide what gets remembered. You can view, edit, or delete any pin, and deletion propagates. This is a structural choice, not a settings toggle. The difference matters: a toggle can be overridden by a policy change, a legal hold, or an update that resets your preferences. A structural choice about where data lives and who controls it is harder to quietly reverse.

We should be clear about what this does and doesn't solve. Selina's memory is encrypted at rest. It is NOT end-to-end encrypted, because inference requires sending a slice of context to a frontier provider. We use a stack of frontier models, routed per task. Non-content operational metadata is kept for a short retention window. The account itself is protected, not encrypted. These are real limits, and we state them because an honest architecture description is worth more than a marketing claim you can't verify.

What we can say: SelinaSEND, our file and transfer layer, is zero-knowledge encrypted. Your files are your files. We can't read them. By design.

And memory pins are yours. You pin what matters. You delete what doesn't. We don't mine your casual disclosures for training signal. We don't maintain a shadow layer of behavioral embeddings you can't see. Memory in Selina is not a profiling operation dressed up as a convenience feature.

Why does the "consent" framing fail here?

Because the consent is structural fiction. A toggle buried in settings, defaulted to "on," governing a feature most users don't know exists, applied to a mode of interaction (natural conversation) that people associate with ephemeral speech rather than permanent record, does not constitute meaningful consent by any reasonable standard.

The Cisco data tells the enterprise side of this story: organizations are building governance after deployment, not before. The consumer side is worse. There is no governance. There is a toggle.

Consider the practical scenario. You open a chat with an AI assistant. You mention you've been feeling anxious about a medical test. The assistant responds helpfully. Two months later, you're in a custody dispute. Opposing counsel subpoenas your AI chat history. The assistant remembered your anxiety, your medical concern, the late-night timestamp. None of this is privileged. All of it is discoverable. You consented to this, technically, by not finding and toggling off a setting you didn't know existed, in an app whose terms of service you accepted by tapping "Continue."

That is the current state of consent for AI memory.

What should a privacy-conscious user do right now?

Three things, in order of impact:

1. Audit your current settings. On ChatGPT, check both the memory toggle and the "Improve the model" training toggle, which are separate controls. On Gemini, look for the Personal context and Keep Activity settings. On Meta's assistant, understand that a meaningful opt-out may not currently exist.
2. Treat AI conversations as permanent, discoverable records. Because legally, that's what they are. Do not share anything with an AI assistant that you would not want produced in court, visible to your employer, or included in a data breach notification.
3. Consider whether the architecture of your assistant matches your actual privacy requirements. If you want memory that you own, that you can verifiably delete, and that isn't pooled with your email, search, and location history, you need a product built with that as a structural constraint, not a settings option.

Where does this go from here?

Three trajectories are running in parallel. Capability is expanding: more memory, more context, more modalities, always-on sensing. Regulation is accelerating: state-level enforcement actions, proposed federal legislation targeting memory and engagement features, GDPR enforcement that hasn't yet focused squarely on AI memory but will. And user awareness is lagging behind both.

The gap between what your assistant knows about you and what you know about what your assistant knows about you is growing. That gap is the problem. Not memory itself. Memory is useful. We built a product with memory because memory makes an assistant worth using. The question is who owns it, who can see it, and what happens when you say "forget."

We built Selina so the answer to those questions is: you own it, we can't see the content, and forget means gone.

We are honest about the limits of that architecture. Memory is NOT zero-knowledge encrypted. Inference touches external providers. Metadata has a short retention window. We are not claiming perfection. We are claiming that the defaults matter, that architecture is more durable than policy, and that you should know what your assistant remembers before it learns something you wish it hadn't.

If that sounds like a reasonable starting point, start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io