Does ChatGPT Still Retain Data? What Changed After the NYT Preservation Order and Why It Still Matters

If you've been following the question of does ChatGPT still retain data, the answer got complicated in 2025, then got slightly less complicated, then got complicated again. A federal court order forced indefinite retention of ChatGPT output logs for months. That order was partially lifted in October 2025. But "partially" is doing a lot of work in that sentence. Carve-outs remain. A historical window of preserved conversations still exists. And a newer sanctions motion, filed in July 2026, suggests the vendor's internal data capabilities extend well beyond what users understood. If you're an enterprise buyer or a privacy-conscious individual, the 30-day deletion default is back on paper. What it means in practice depends on your tier, your geography, and whether you trust policy promises that litigation can override overnight.

Key Takeaways

• The broad preservation mandate ended in fall 2025, but logs saved during the April, September 2025 window remain retained and are still accessible to a restricted internal team. "Reverted to 30-day deletion" is not the same as "your old data is gone."
• Enterprise, Education, and zero-data-retention (ZDR) API customers were excluded from the court order entirely. Free, Plus, Pro, and Team tier users were not. Your tier determines your actual exposure.
• A July 2026 sanctions motion alleges the vendor concealed internal search capabilities over training data and output logs, including a tool reportedly called "Project Giraffe." This reframes the privacy question: retention duration matters less if the vendor can analyze data before deleting it.
• "Zero data retention" in any LLM product is almost always an overstatement. Data exists in GPU memory during inference, and operational metadata (timestamps, token counts, user IDs) may persist even under ZDR agreements.
• Architectural privacy (data never existing in a searchable form on the vendor's servers) is fundamentally different from policy privacy (data existing but the vendor promising to delete it on schedule).

What Was the Original Court Order?

On May 13, 2025, a federal court order in the New York Times copyright litigation directed the vendor to retain all output log data that would otherwise be deleted, regardless of user deletion requests or privacy regulation requirements. Every conversation. Every prompt. Every output. For users on the free, Plus, Pro, and Team tiers, the "delete" button stopped meaning what it said.

The vendor appealed. District Judge Sidney Stein affirmed the order on June 26, finding that user privacy interests did not override the preservation needs of the litigation. The implication was plain: a stated privacy commitment, one users relied on, was overridden by a single court order in a case those users had nothing to do with.

Which Tiers Were Affected?

Not all of them. The order explicitly excluded Enterprise, Education, and API customers operating under zero-data-retention agreements. If your organization was on an Enterprise plan, the preservation mandate did not apply to you.

If you were on Team, Plus, Pro, or free, it did.

This is the part most coverage glosses over. "ChatGPT data retention" is not one policy. It's a set of policies that vary by tier, by geography (EEA, Switzerland, and UK users had different treatment), and by the contractual specifics of your agreement. An enterprise buyer evaluating this vendor should map their exact product tier against these carve-outs. The headline "30-day deletion is back" does not tell you what you need to know unless you also know which bucket you're in.

What Changed in October 2025?

A new order filed October 9 released the vendor from its obligation to preserve and segregate all output log data on a going-forward basis. With a few exceptions, the company was no longer required to maintain logs past September 26, 2025. The 30-day default came back.

But "with a few exceptions" is the operative phrase.

What Data Is Still Being Retained?

Two categories survive the reversal.

First: all logs already saved during the preservation window (roughly April through September 2025) remain retained and accessible. The vendor's own blog confirmed it will securely store that limited historical window. If you used ChatGPT on a consumer or Team plan during those months, conversations you may have believed were deleted were preserved and continue to exist on the vendor's servers.

Second: the vendor is still required to retain logs linked to accounts specifically flagged by the New York Times. The Times continues to demand retention of a specific set of user data from that April, September period.

The vendor states this retained data is access-restricted: limited to a small, audited legal and security team, not usable beyond meeting legal obligations, and not being turned over to the Times, the court, or external parties at this time. "At this time" is doing some work there too.

Does 30-Day Deletion Mean My Data Is Actually Gone After 30 Days?

For new conversations created after September 26, 2025, on consumer tiers, the stated policy is 30-day deletion. But there are several things this does not cover.

It does not retroactively delete data preserved under the court order. It does not prevent a future court order from reimposing the same mandate. It does not address data that exists in backups, which the vendor's documentation does not fully specify. And it does not address the vendor's internal analytical capabilities over data before deletion.

That last point matters more than most people think.

Why Does the July 2026 Sanctions Motion Change the Picture?

On July 9, 2026, the Times and other news outlets filed a motion for sanctions, alleging the vendor concealed for over two years its ability to search training datasets and output logs. The allegation reportedly surfaced after a February deposition of the vendor's privacy engineering lead.

According to reporting from TechCrunch, the deposition revealed the vendor had already searched its training corpus for copyrighted journalism and had amassed roughly 78 million de-identified ChatGPT conversations for internal infringement analysis. A tool reportedly called "Project Giraffe" used a Bloom filter to detect regurgitation in outputs.

The vendor pushed back, stating the Times was "persisting with their efforts to invade the privacy of people who have nothing to do with this case" and that the company would "continue defending our users' privacy and the long-established principles of fair use."

Set aside the merits of the copyright dispute. The privacy question this raises is distinct: if a vendor can run internal search and analysis tooling over 78 million conversations, the question is no longer just "how long is data kept." It's "what analytical capabilities exist over data before it's deleted, and what derivative datasets are created in the process."

A de-identified dataset is still a dataset. Deletion of the original logs does not necessarily mean deletion of aggregated or derived data products built from those logs.

How Did the Discovery Scope Expand?

Court records show Judge Wang ordered the vendor in November/December 2025 to produce a 20-million-conversation de-identified log sample, finding that even logs unrelated to News Plaintiffs' works could be relevant to the fair use defense. Users' privacy interests were treated as one factor in the proportionality analysis, not a dispositive one.

This means the "reversal" to 30-day deletion coexists with an active, court-compelled production process involving 20 million conversations. The chapter is not closed. The deletion default came back, but the litigation pipeline continues to pull data out of the vendor's systems and into the discovery process.

What Does "Zero Data Retention" Actually Mean for API and Enterprise Customers?

Under the ZDR API configuration, the vendor states it does not retain the prompts sent or the answers returned after the request completes. Enterprise, Business, Education, Healthcare, Teachers, and API data is not used for model training by default.

But "zero data retention" deserves scrutiny. As Teleskope has noted, excluding data from model training is a separate setting from data retention. One governs whether data trains the model. The other governs whether it's stored. They are independent controls, and conflating them is a common buyer mistake.

Further, as technical commentary has pointed out, "zero data retention" means prompts and completions aren't stored after the request completes, but data still exists in GPU memory during processing, and metadata like timestamps, token counts, and user IDs may still be retained.

This is the part that matters if you're building a product on top of a frontier model API. "Zero retention" is a marketing term that describes a policy about persistent storage. It is not a description of whether the data ever touched the vendor's infrastructure (it did), whether it existed in memory during processing (it did), or whether operational metadata was logged (it probably was).

Why Is "Zero Retention" Almost Always False for LLM Products?

We build on frontier model APIs. We see how data flows. Here is what we know from running a production system.

When your prompt hits a frontier provider's inference endpoint, the text exists in GPU memory on the provider's hardware for the duration of the request. The provider may log metadata: timestamps, token counts, request IDs, error codes. Even under ZDR agreements, the question of what constitutes "content" versus "metadata" is a contractual one, not a physical one. The bits traveled over a network, were processed on someone else's silicon, and generated a response. None of that happened in a vacuum.

For any LLM product, including ours, telling users "we retain nothing" would be false. Operational metadata exists for a short retention window. The difference is whether the product is designed so that content data minimization is architectural (the vendor never has your content in a searchable, persistent store) or merely policy-based (the vendor has it but promises to delete it later).

Policy-based privacy is breakable. A court order broke it in May 2025 for millions of ChatGPT users. Architectural privacy is harder to break because there's less to compel production of.

What Should Enterprise Buyers Actually Check?

If you're evaluating any LLM vendor, including the one at the center of this litigation, here's a concrete checklist derived from what this case exposed.

1. Confirm your exact tier and its retention terms. Don't assume the headline policy applies to your plan. The preservation order drew a bright line between Enterprise/ZDR API customers and everyone else. Your procurement team should have a copy of the data processing agreement for your specific tier.

2. Ask whether "not used for training" and "not retained" are separate toggles. They usually are. A vendor can promise not to train on your data while still storing it for 30 days (or longer, under litigation holds). These are independent controls.

3. Ask what metadata is retained under ZDR. Timestamps, token counts, user IDs, and request metadata may persist even when content does not. If your threat model includes metadata analysis (and for regulated industries, it should), "zero data retention" may not cover what you think it covers.

4. Ask what happens under a litigation hold. The NYT case showed that consumer-tier deletion promises can be suspended by a court order in a case the user isn't party to. Enterprise agreements may offer more protection, but "may" is not "will." Get it in writing, and understand that even written terms can be overridden by a court with jurisdiction.

5. Ask about internal analytical tooling over user data. The Project Giraffe allegations, if accurate, indicate the vendor built search and detection capabilities over user conversations. Whether those capabilities still exist, and what data they've been applied to, is a question your vendor should be willing to answer.

How Does This Apply to Products Built on Top of Frontier APIs?

If you use a product that calls a frontier model API on your behalf, the data-retention question has two layers: what the product retains, and what the underlying provider retains.

At Selina, for instance, your memory is encrypted at rest and content is encrypted. But memory is not end-to-end encrypted: a slice of each request reaches a frontier provider at inference. Files and transfers via SelinaSEND are zero-knowledge encrypted. The distinction matters and we state it plainly because the NYT case is a case study in what happens when vendors let users assume more protection than the architecture actually provides.

Any product that calls a frontier model API should be transparent about both layers. The product layer can encrypt, can minimize, can restrict access. But the inference layer involves sending data to a third-party endpoint, and whatever that provider's retention and analytical capabilities are, they apply to your data during the window it's in their system.

What's the Difference Between Policy Privacy and Architectural Privacy?

Policy privacy means the vendor has your data and promises to handle it responsibly: delete it on schedule, not train on it, restrict internal access. These are contractual commitments. They are real. They are also, as May 2025 demonstrated, overridable by a court, breakable by an internal decision to build analytical tooling, and dependent on the vendor's ongoing compliance.

Architectural privacy means the data never exists in the vendor's systems in a form they can search, analyze, or produce. You can't compel production of data that doesn't exist. You can't build a Bloom filter over conversations you never stored.

Most LLM products, including ours, fall somewhere between these poles. The honest position is to tell you where on that spectrum we sit and let you decide if it's sufficient for your use case. The dishonest position is to say "zero retention" and hope nobody reads the DPA closely enough to notice the metadata carve-outs.

Is the NYT Case Over?

No. The broad preservation mandate ended, but the litigation is active and expanding. The sanctions motion filed July 9, 2026 seeks monetary penalties, attorney fees, and a court finding regarding misuse of copyrighted works. The 20-million-conversation production order is ongoing. The allegations about concealed search capabilities are unresolved.

For users whose data falls within the April, September 2025 window, this litigation may continue to affect their data for years. And for the broader market, the case has established a precedent: consumer-tier LLM data retention promises are subordinate to litigation holds, and the existence of internal analytical tooling over user data is a discoverable fact that can surface years after the data was supposed to be deleted.

What Should You Do Now?

If you used ChatGPT on a free, Plus, Pro, or Team plan between April and September 2025, your conversations from that period may still be retained under the court-ordered preservation. There is no user-facing mechanism to delete them. The vendor says access is restricted to a small legal team. Whether that remains the case will depend on how the litigation proceeds.

If you're an enterprise buyer, verify your tier. Verify your DPA. Verify whether your agreement covers litigation holds. And ask the hard questions about internal tooling and metadata retention.

If you're evaluating AI assistants and data privacy is a requirement rather than a preference, look at the architecture, not just the policy. A policy is a promise. Architecture is a constraint. Promises can be broken by courts, by internal decisions, by feature changes. Constraints are harder to undo.

If you want to see what architectural privacy looks like in an AI assistant that remembers you across conversations, start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io