What the OpenAI/NYT Preservation Order Saga Actually Changed About Privacy When You "Delete" Your AI Chats

You clicked delete. The chat disappeared from your sidebar. You assumed it was gone. It wasn't. For months in 2025, a federal court order meant that every conversation on one of the world's largest AI platforms was being preserved, including the ones users thought they had erased. This saga exposed something most people still don't understand about AI privacy: "delete" is a UI action, not a data-destruction event. The distance between those two things is where the interesting problems live.

Key Takeaways

• A May 2025 federal preservation order required OpenAI to retain all ChatGPT conversation logs, including deleted ones, across Free, Plus, Pro, and Team tiers. "Delete" stopped meaning delete.
• Enterprise customers with Zero Data Retention agreements were carved out. Privacy became a feature of the pricing tier, not a default right.
• The preservation order was lifted in October 2025, but logs already captured remain accessible to the court, and accounts flagged by the NYT must still be retained indefinitely.
• As of July 2026, publishers have filed a sanctions motion alleging OpenAI continued deleting billions of conversations even under the preservation order, and separately built internal search tools over user logs while telling the court it couldn't search them.
• The fundamental lesson is architectural: if a vendor holds readable copies of your data, any promise to delete is subordinate to any court that says otherwise. The only durable protection is minimizing what's readable in the first place.

What actually happened in the OpenAI/NYT case?

The New York Times sued OpenAI over copyright infringement. That part got the headlines. What mattered more for everyday users happened in discovery.

On May 13, 2025, Magistrate Judge Ona T. Wang issued an order directing OpenAI to preserve every conversation log until further notice. Not just active conversations. Deleted ones. Temporary ones. The order covered Free, Plus, Pro, and Team tiers, plus API users who hadn't signed a Zero Data Retention agreement. It was both retroactive (reaching back to roughly mid-April 2025) and forward-looking.

OpenAI publicly objected. COO Brad Lightcap called it "a sweeping and unnecessary demand." Sam Altman posted that the company would "fight any demand that compromises our users' privacy."

Here's the part that should bother you. OpenAI confirmed it had actually been preserving deleted and temporary chats since mid-May 2025, but did not disclose this to users until June 5. For roughly three weeks, the delete button in the UI was doing nothing meaningful, and users had no way to know.

How does a preservation order override a delete button?

A litigation hold is a legal freeze on your storage layer. It's not a hack. It's not a breach. It's a court saying: you have data, you may not destroy it. The mechanism is straightforward if you understand how most cloud platforms handle deletion.

When you click "delete chat" on most AI platforms, what typically happens is a soft delete. The record is flagged as inactive, removed from your UI, and scheduled for eventual purging. The underlying data may persist in backups, in logging pipelines, in analytics warehouses, sometimes for days, sometimes for months. The gap between "removed from your view" and "overwritten on disk" is real, and it's exactly the gap a preservation order exploits.

A court doesn't need to install anything or compromise any system. It issues an order. The vendor's legal team passes it to engineering. Engineering disables the purge jobs. The data stays. That's it. No one breached anything. The architecture simply did what it was always capable of doing: retaining data that the UI told you was gone.

This is not unique bad behavior by one vendor. As one legal analysis put it, from a pure contract perspective, OpenAI was doing exactly what almost every privacy policy in the industry says: delete, except when the law says it can't.

Who was carved out, and why does that matter?

Enterprise customers and API users with Zero Data Retention agreements were explicitly excluded from the preservation order. Their conversations were not swept in. Everyone else was.

Think about what that means. Two users could type the identical prompt on the same day. One, on a paid enterprise plan, has their data excluded. The other, on a free or consumer-paid plan, has their data preserved indefinitely and potentially produced in discovery. The differentiator isn't the sensitivity of the content. It's the price of the subscription.

This is the industry's two-tier privacy system laid bare. Privacy as a paid upgrade, not a baseline. If you're paying enterprise rates, you get contractual protections that hold up to a court order. If you're on the consumer tier, you get a delete button that a single magistrate judge can neutralize.

What happened when the order was lifted?

On October 9, 2025, Judge Wang terminated the blanket preservation obligation, effective on a going-forward basis as of September 26, 2025. OpenAI was free to resume normal deletion.

But "lifted" doesn't mean "undone." Any logs already saved under the order remain accessible to the court. And OpenAI must still retain logs linked to accounts specifically flagged by the New York Times. The NYT is allowed to keep expanding that flagged list.

So the blast radius narrowed, but the data already captured during those months is still in play. If your account was active between mid-April and late September 2025, and you used ChatGPT on a consumer tier, your deleted conversations may still exist in a legal hold somewhere.

What did the 20-million-log ruling decide?

In January 2026, District Judge Sidney Stein affirmed a ruling forcing OpenAI to hand over a full 20-million-log sample rather than a curated subset. OpenAI had argued that logs not matching NYT content were irrelevant and that producing them would unnecessarily invade user privacy. The court disagreed on both counts.

This is worth sitting with. Twenty million conversation logs. Produced to opposing counsel in a copyright case. Many of those logs from users who thought they were having private conversations with a chatbot. Users who were never parties to the lawsuit, never notified individually, never given a chance to object.

The court's reasoning was procedurally sound. Discovery is broad. Relevance is determined after production, not before. But the practical result is that millions of users' conversations became legal exhibits in a case they had nothing to do with.

What do the July 2026 sanctions allegations claim?

On July 9, 2026, the New York Times, the Daily News, and 15 other publishers filed a sanctions motion making two core allegations.

First: that OpenAI had been "deleting billions of ChatGPT conversations despite a preservation order." If true, this would mean the delete button wasn't just cosmetically misleading in one direction (telling users data was gone when it wasn't), but also in the other direction (actually destroying data the company was legally obligated to keep).

Second: that OpenAI had "for two years been making misrepresentations to the court regarding its ability to search for Daily News content in its training data sets and output logs" despite having reportedly already built that search capability. The publishers are asking for monetary penalties and other sanctions, including a jury instruction that evidence was destroyed.

OpenAI's spokesperson responded that "As the Times' case weakens and they've been forced to drop claims against us, they're persisting with their efforts to invade the privacy of people who have nothing to do with this case."

These are unproven allegations. The court has not ruled on the motion as of mid-July 2026. But the allegations themselves reveal something important about the architecture of these systems regardless of how the judge rules.

Why does the "search tool" allegation matter architecturally?

The core tension is this: the publishers allege that OpenAI built internal tooling to search and de-identify its conversation logs (presumably for safety, product improvement, or compliance purposes) while simultaneously telling the court it couldn't meaningfully search those logs for discovery.

Whether or not the allegation holds up legally, it illustrates a design principle that any builder should internalize. The capability to search your users' data at all is itself a liability. Any tool built for "safety" or "product improvement" doubles as a future discovery instrument. If you can search it, a court can compel you to search it. If you can read it, a court can compel you to produce it.

This is not a hypothetical concern. It is exactly what played out. And it will play out again in every jurisdiction where litigation holds apply (which is most of them).

There's a related episode worth noting. During the discovery process, NYT/Daily News lawyers alleged that OpenAI engineers accidentally deleted discovery search-result data from a sandbox environment, forcing them to redo 150 hours of paid expert and lawyer work after the original file structure was broken. Even accidental deletion during active litigation carries real cost.

What about "AI privilege"? Could that fix this?

No, at least not as currently proposed. Sam Altman has repeatedly floated the concept of "AI privilege", arguing that talking to an AI should be like talking to a lawyer or a doctor, with conversations shielded from compelled disclosure.

It's an appealing idea in the abstract. In practice, it doesn't map. Attorney-client privilege protects a specific human fiduciary relationship where one party has professional obligations, ethical duties, and potential malpractice liability. Doctor-patient privilege works similarly. These privileges exist because the relationship requires candor to function, and the professional has enforceable duties to the individual.

An AI chatbot has no fiduciary duty to you. It has no professional license to revoke. It is operated by a company whose interests may diverge from yours (as this case amply demonstrates). Legal commentators have noted that "AI privilege" is a public-relations term, not a viable legal doctrine. Creating it would require new legislation, and the political appetite for giving AI companies a new evidentiary shield is, to put it mildly, limited.

The more honest framing: if your data is readable by the platform, no amount of privilege doctrine will protect it as reliably as not having it be readable in the first place.

What does "delete means delete" actually require architecturally?

If you want deletion to be real (not just a UI state change), you need a few things to be true at the infrastructure level.

First, the vendor needs to not hold a readable copy. If the plaintext of your conversation exists on the vendor's servers, in their backups, in their logging pipeline, then deletion is a policy choice that can be overridden by a court, a subpoena, a national security letter, or an engineering mistake. Encryption at rest helps, but if the vendor holds the keys, they can still be compelled to decrypt.

Second, the system needs to minimize what's logged operationally. Every AI platform generates some amount of operational metadata: timestamps, token counts, error codes. The question is how much and how long. A short retention window for non-content metadata is defensible. Retaining full conversation transcripts indefinitely in a "deleted" state is not deletion by any reasonable definition.

Third, you need to distinguish between what's architecturally impossible to produce and what's merely promised not to be produced. "We promise not to look" is a policy. "We are unable to look because we never held the readable data" is an architecture. Courts can override policies. They cannot override physics.

This is the real gap the NYT case exposed. Not that one company made bad choices, but that the entire default architecture of cloud AI makes this outcome inevitable. If you hold readable user data, you will eventually be compelled to produce it. The question is when, not if.

How should you think about this as a user?

You should assume that anything you type into a cloud AI service could be preserved, produced, and read by strangers. Not because the company is malicious, but because the legal system treats stored data as stored data, regardless of what the UI calls it.

Some concrete implications:

• If you're using AI for therapy-adjacent conversations, journaling, legal brainstorming, or anything else you'd consider sensitive, understand that no consumer AI platform currently offers the legal protections that actual therapists, lawyers, or doctors provide.
• If the platform offers a "temporary chat" or "don't save" mode, that mode is subject to the same preservation-order dynamics. Temporary chats were explicitly within scope of the May 2025 order.
• If you want stronger guarantees, look for platforms where the architecture, not just the policy, limits what the vendor can access. Zero-knowledge encryption for files and transfers, content encrypted at rest with key management that doesn't leave the client, minimal operational metadata with short retention windows.

None of this is a complete solution. There are always tradeoffs. A platform that can't read your data can't moderate it either. A system with aggressive deletion can't help you recover a conversation you actually wanted back. These are engineering choices with real consequences in both directions.

What happens next in this case?

As of mid-July 2026, the sanctions motion is still pending. The court hasn't ruled. If the judge finds that data was destroyed in violation of the preservation order, the consequences could include adverse inference instructions (telling the jury to assume the destroyed evidence was unfavorable to OpenAI), monetary sanctions, or other penalties.

Regardless of the ruling, the precedent is already set in practice. Courts can and will order AI companies to preserve user data. The delete button is subordinate to a judge's signature. And the two-tier system, where enterprise customers get contractual protections and consumer users get a UI element, is now a documented fact of the legal record.

This case is not over. It's developing. And whatever comes next will further define what "privacy" means when the thing you're talking to is a product, not a person.

What we took from this

We built Selina as a privacy-focused AI assistant that remembers you across conversations. Memory is adaptive and encrypted at rest. Files and transfers through SelinaSEND are zero-knowledge encrypted. We run on a stack of frontier models, routed per task, via API. We are not a local model, and we are not immune to law. But we designed the system so that the amount of readable data we hold is as small as we can make it while still delivering a useful product. Non-content operational metadata is kept for a short retention window. Content is encrypted.

We can't promise that no court will ever issue an order that affects our infrastructure. Nobody can promise that honestly. What we can do is minimize what would be producible if one did. That's an architecture decision, not a marketing claim. Delete means gone. Actually gone.

If that sounds like the kind of thing you want to try: start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io