Privacy timeline
A sourced, running record of breaches, policy changes, overreach and regulation in AI and personal data.
72 entriesLatest Checked
Bee Cheng Hiang Singapore's data regulator said an employee's generative AI email script exposed 95,364 members' email addresses to other recipients in an April 25, 2026 campaign.
pdpc.gov.sg (primary source, opens in a new tab)
Anthropic For users covered by Korea's privacy law, identity-verification data may be shared with the Korea Credit Bureau.
anthropic.com (primary source, opens in a new tab)
OpenAI When ad personalization is available and on, past chats are used to make ads more relevant for Free and Go users.
openai.com (primary source, opens in a new tab)
xAI The Grok privacy policy names SpaceXAI LLC as the controller for the Grok app and grok.com.
x.ai (primary source, opens in a new tab)
Microsoft If ads personalization is on, personalized ads may use chat history, saved memories, and other Microsoft data you chose to share.
support.microsoft.com (primary source, opens in a new tab)
Microsoft New wording says prompts, responses and file contents aren’t used to train “foundation models”; the older FAQ said “generative AI models.”
support.microsoft.com (primary source, opens in a new tab)
Atlassian Cloud customer metadata and in-app content, such as Jira and Confluence text, began to be used to improve Atlassian's AI; metadata opt-out is Enterprise-only.
atlassian.com (primary source, opens in a new tab)
European Union Regulation 2026/1881 was adopted, again allowing messaging providers to scan communications for child sexual abuse until April 2028, excluding end-to-end encrypted communications.
eur-lex.europa.eu (primary source, opens in a new tab)
Character.AI Italy's Garante fined Character Technologies €158,000 over its privacy notice, a late impact assessment, and age verification for minors.
garanteprivacy.it (primary source, opens in a new tab)
Anthropic Consumer accounts may be asked for age or identity data, and multi-step tasks can share inputs and outputs with connected apps.
anthropic.com (primary source, opens in a new tab)
Microsoft Copilot in Edge may access page content, tabs, browsing history, and visual snapshots of the page.
microsoft.com (primary source, opens in a new tab)
Microsoft Copilot Health uses health information to provide personalized assistance focused on health and wellness.
microsoft.com (primary source, opens in a new tab)
European Union Lawmakers agreed to move AI Act high-risk deadlines to December 2027 and August 2028 and to ban AI nudifier apps.
europarl.europa.eu (primary source, opens in a new tab)
xAI Content from Google apps connected through Google OAuth is not used for internal AI or model training.
x.ai (primary source, opens in a new tab)
xAI The Grok privacy policy adds delivering targeted advertising as a listed use of personal information.
x.ai (primary source, opens in a new tab)
OpenAI Account settings include controls over what data is used to personalize ads shown on the services.
openai.com (primary source, opens in a new tab)
OpenAI Teen users and a parent or guardian can link accounts so the adult can manage settings and receive safety alerts.
openai.com (primary source, opens in a new tab)
GitHub Blog post: Copilot Free, Pro and Pro+ interaction data, including code snippets, would train GitHub's AI models from April 24 unless users opt out.
github.blog (primary source, opens in a new tab)
Microsoft The privacy statement no longer describes specific retention periods in its Bing and Advertising sections.
microsoft.com (primary source, opens in a new tab)
Anthropic A federal judge ruled that a criminal defendant's written exchanges with Anthropic's Claude were not protected from government inspection by attorney-client privilege or work product.
storage.courtlistener.com (primary source, opens in a new tab)
X and xAI The UK ICO opened formal investigations into X and xAI over Grok's processing of personal data and its generation of sexualized images.
ico.org.uk (primary source, opens in a new tab)
Google Connecting Gmail, Photos, YouTube, and Search is off by default, and Gemini does not train directly on Gmail or Photos.
blog.google (primary source, opens in a new tab)
OpenAI A federal district judge denied OpenAI's objections and affirmed orders requiring production of 20 million de-identified ChatGPT conversation logs.
storage.courtlistener.com (primary source, opens in a new tab)
Council of the EU Member states agreed the Council position on the child sexual abuse regulation, including making permanent an exemption that lets companies voluntarily scan messages.
consilium.europa.eu (primary source, opens in a new tab)
OpenAI An attacker exported data from analytics vendor Mixpanel, including names, emails, and approximate locations of some OpenAI API users; chats were not exposed.
openai.com (primary source, opens in a new tab)
OpenAI A federal magistrate judge ordered OpenAI to produce 20 million de-identified consumer ChatGPT logs to news plaintiffs in the copyright litigation.
storage.courtlistener.com (primary source, opens in a new tab)
State of California The governor signed SB 243, requiring companion chatbots to disclose they are AI and maintain self-harm response protocols, with protections for minors.
gov.ca.gov (primary source, opens in a new tab)
OpenAI A court-approved stipulation ended OpenAI’s ongoing duty to preserve deleted ChatGPT output logs as of September 26, 2025; earlier logs stay, except EEA, Swiss and UK data, and listed-domain accounts remain preserved.
storage.courtlistener.com (primary source, opens in a new tab)
Meta Newsroom post: content and ad recommendations would be personalized based on people's interactions with Meta's generative AI features, starting December 16, 2025.
about.fb.com (primary source, opens in a new tab)
OpenAI A federal magistrate judge in Maine issued a warrant for OpenAI records of a user’s ChatGPT searches; the return shows it was executed the next day.
storage.courtlistener.com (primary source, opens in a new tab)
Federal Trade Commission 6(b) orders went to seven companies, including OpenAI, Meta, and Character.AI, on how their companion chatbots affect children and teens.
ftc.gov (primary source, opens in a new tab)
Salesloft Trust center update: an attacker stole OAuth tokens for Drift AI chat integrations and used them to take customer data, including from Salesforce in August 2025.
trust.salesloft.com (primary source, opens in a new tab)
Anthropic Claude Free, Pro and Max users were asked to choose whether chats train Anthropic's models; retention extends to five years for those who allow it.
anthropic.com (primary source, opens in a new tab)
OpenAI Company post: human reviewers examine conversations flagged for planned harm to others, and OpenAI may refer imminent threats of serious physical harm to law enforcement.
openai.com (primary source, opens in a new tab)
Google Blog post: Gemini Apps Activity would be renamed Keep Activity and, when on, a sample of future uploads used to improve Google services.
blog.google (primary source, opens in a new tab)
Change Healthcare HHS's Office for Civil Rights was told that about 192.7 million people were affected by Change Healthcare's 2024 ransomware attack.
hhs.gov (primary source, opens in a new tab)
xAI People in Europe can object in settings to use of their information to train Grok models.
x.ai (primary source, opens in a new tab)
Paradox.ai Researchers used a legacy test account password to reach chat records in one client's AI hiring assistant, viewing five U.S. candidates' contact details.
paradox.ai (primary source, opens in a new tab)
Luka (Replika) Italy's Garante fined Luka Inc. €5 million over Replika's legal basis for processing, its privacy policy, and lack of age verification.
garanteprivacy.it (primary source, opens in a new tab)
OpenAI A federal magistrate judge ordered OpenAI to preserve and segregate all ChatGPT output log data that would otherwise be deleted, including at users' request.
storage.courtlistener.com (primary source, opens in a new tab)
Meta Newsroom post: Meta's AI would be trained on public posts and comments from adults in the EU, and on their interactions with Meta AI.
about.fb.com (primary source, opens in a new tab)
Apple Advanced Data Protection, Apple's end-to-end encryption for iCloud, stopped being offered to new users in the United Kingdom.
support.apple.com (primary source, opens in a new tab)
xAI Parents of teenagers ages 13 to 17 must agree to the terms before those teenagers use the service.
x.ai (primary source, opens in a new tab)
European Union The AI Act's bans on prohibited practices, such as social scoring and workplace emotion recognition, began to apply.
digital-strategy.ec.europa.eu (primary source, opens in a new tab)
DeepSeek Italy's Garante ordered DeepSeek's two Chinese operators to stop processing Italian users' data, effective immediately, and opened an investigation.
garanteprivacy.it (primary source, opens in a new tab)
xAI Temporary chats do not appear in history and are kept for up to 30 days for safety purposes.
x.ai (primary source, opens in a new tab)
OpenAI Italy's Garante fined OpenAI €15 million over ChatGPT's legal basis for training, transparency, and breach notification; a Rome court later upheld OpenAI's appeal.
garanteprivacy.it (primary source, opens in a new tab)
xAI The minimum age changed from 18 to 13, and the service is not directed at children under 13.
x.ai (primary source, opens in a new tab)
X Privacy policy update: third parties receiving X data may use it for their own purposes, including training their AI models.
x.com (primary source, opens in a new tab)
xAI Interaction data, such as session frequency and features used, is listed among data used to train models.
x.ai (primary source, opens in a new tab)
OpenAI Temporary chats do not appear in history and are kept for up to 30 days for safety purposes.
openai.com (primary source, opens in a new tab)
LinkedIn Privacy policy update: member data trains LinkedIn's content-generating AI models, with an opt-out setting; the EEA, Switzerland and UK were excluded.
linkedin.com (primary source, opens in a new tab)
xAI User content provided to the service may be processed to train and improve the models, with an email opt-out.
x.ai (primary source, opens in a new tab)
European Union The Artificial Intelligence Act entered into force, setting risk-based rules for AI systems that apply in stages over the following years.
commission.europa.eu (primary source, opens in a new tab)
Microsoft The privacy statement says Microsoft may use personal data to develop and train its AI models.
microsoft.com (primary source, opens in a new tab)
Meta Newsroom post: Meta's AI models would be trained on public posts, comments and photos from adult users in Europe, with an objection form.
about.fb.com (primary source, opens in a new tab)
Anthropic Deleted conversations are removed from history immediately and deleted from back-end systems within 30 days.
anthropic.com (primary source, opens in a new tab)
Hugging Face Unauthorized access to secrets stored in the Spaces AI app platform was detected; affected tokens were revoked, and users and data protection authorities notified.
huggingface.co (primary source, opens in a new tab)
Kaiser Permanente Members were notified that tracking pixels on Kaiser's sites and apps may have sent names, IP addresses, and health searches to Google, Bing, and X.
oag.ca.gov (primary source, opens in a new tab)
xAI Training may use public X posts, internet search data, and a voluntary subset of conversation and feedback data.
x.ai (primary source, opens in a new tab)
Anthropic Inputs and outputs are not used to train models unless a chat is safety-flagged, reported, or the user opts in.
anthropic.com (primary source, opens in a new tab)
OpenAI Enterprise or business-account administrators may access and control an account, and users can share conversations by link.
openai.com (primary source, opens in a new tab)
xAI Models are trained only on usage data people choose to provide, not on account, payment, or technical data.
x.ai (primary source, opens in a new tab)
23andMe Attackers used reused passwords to access about 14,000 accounts, reaching data from about 5.5 million DNA Relatives and 1.4 million Family Tree profiles.
23andme.org (primary source, opens in a new tab)
X Privacy policy update: the information X collects and publicly available information may be used to help train its machine learning or AI models.
x.com (primary source, opens in a new tab)
Microsoft An employee published a storage link with a broad-access SAS token on GitHub, exposing two former employees' workstation backups and internal Teams messages.
microsoft.com (primary source, opens in a new tab)
Microsoft The Bing section explains how to view and manage recent activity with Bing Chat.
microsoft.com (primary source, opens in a new tab)
Google Privacy policy update: wording changed from training "language models" on publicly available information to training "Google's AI models," naming Bard and Cloud AI.
policies.google.com (primary source, opens in a new tab)
Amazon The FTC and DOJ alleged Amazon kept children's Alexa voice recordings indefinitely; a proposed order required a $25 million civil penalty and data deletion.
ftc.gov (primary source, opens in a new tab)
OpenAI Conversations started with chat history off are not used to train models and are kept 30 days for abuse review.
openai.com (primary source, opens in a new tab)
OpenAI Italy's Garante ordered an immediate temporary limitation on OpenAI's processing of Italian users' data and opened an inquiry into ChatGPT.
garanteprivacy.it (primary source, opens in a new tab)
OpenAI A Redis library bug let some ChatGPT users see other users' chat titles and exposed payment details of 1.2% of active Plus subscribers.
openai.com (primary source, opens in a new tab)
All entries: 72 shown
Free to use
Free to quote, chart and republish under CC BY 4.0. All we ask is a credit with a link back. Sources keep their own terms. CC BY 4.0
Source: Maple, AI privacy timeline (maple.ai/privacy-timeline), data through 2026-09-21.Latest entry · Checked
Download the data: data.json · data.csv · How entries are chosen
Maple cannot see your chats. That is enforced by code, not by a policy that can change. How it works
Every entry cites one primary source and is reviewed by a person before it publishes.
Suggest an entry or a correction · Methodology