{
  "name": "Maple AI privacy timeline",
  "description": "A sourced, running record of breaches, policy changes, overreach and regulation in AI and personal data.",
  "url": "https://maple.ai/privacy-timeline",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Source: Maple, AI privacy timeline (maple.ai/privacy-timeline), data through 2026-09-21.",
  "sources": "One primary source per entry: the company’s own policy page or post, a regulator, a court record, an official breach notice, or a government publication.",
  "updatedThrough": "2026-09-21",
  "lastChecked": "2026-10-16",
  "entries": [
    {
      "id": "2026-09-21-bee-cheng-hiang-ai-email-exposure",
      "url": "https://maple.ai/privacy-timeline#2026-09-21-bee-cheng-hiang-ai-email-exposure",
      "date": "2026-09-21",
      "date_precision": "day",
      "company": "Bee Cheng Hiang",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "AI-written email script exposed 95,364 addresses",
      "summary": "Singapore's data regulator said an employee's generative AI email script exposed 95,364 members' email addresses to other recipients in an April 25, 2026 campaign.",
      "control": null,
      "source_url": "https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/voluntary-undertaking-by-bee-cheng-hiang-marketing-pte-ltd",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-09-10-anthropic-korea-identity-sharing",
      "url": "https://maple.ai/privacy-timeline#2026-09-10-anthropic-korea-identity-sharing",
      "date": "2026-09-10",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Korea addendum shares identity-verification data",
      "summary": "For users covered by Korea's privacy law, identity-verification data may be shared with the Korea Credit Bureau.",
      "control": null,
      "source_url": "https://www.anthropic.com/legal/privacy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/b4da160a81f0ee2711fa10f6810089243c7e9e4e/Claude.ai/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-08-24-chatgpt-ads-past-chats",
      "url": "https://maple.ai/privacy-timeline#2026-08-24-chatgpt-ads-past-chats",
      "date": "2026-08-24",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Past chats can personalize ChatGPT ads",
      "summary": "When ad personalization is available and on, past chats are used to make ads more relevant for Free and Go users.",
      "control": null,
      "source_url": "https://openai.com/policies/eu-privacy-policy/",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/831e2ec7833c83fb7212fa8edb1226be1a1bc92b/ChatGPT/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-08-24-grok-spacexai-controller",
      "url": "https://maple.ai/privacy-timeline#2026-08-24-grok-spacexai-controller",
      "date": "2026-08-24",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok policy names SpaceXAI as controller",
      "summary": "The Grok privacy policy names SpaceXAI LLC as the controller for the Grok app and grok.com.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-eu-versions/blob/389aa31fbb649daf5c07db353514cc99711297b3/Grok/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-08-18-copilot-ads-chat-history",
      "url": "https://maple.ai/privacy-timeline#2026-08-18-copilot-ads-chat-history",
      "date": "2026-08-18",
      "date_precision": "day",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Copilot ads may use chat history",
      "summary": "If ads personalization is on, personalized ads may use chat history, saved memories, and other Microsoft data you chose to share.",
      "control": "Settings > Personalization > Allow ads personalization.",
      "source_url": "https://support.microsoft.com/en-us/privacy/microsoft-copilot/privacy-controls",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-08-18-copilot-narrows-training-statement",
      "url": "https://maple.ai/privacy-timeline#2026-08-18-copilot-narrows-training-statement",
      "date": "2026-08-18",
      "date_precision": "day",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Copilot app narrows its training statement",
      "summary": "New wording says prompts, responses and file contents aren’t used to train “foundation models”; the older FAQ said “generative AI models.”",
      "control": null,
      "source_url": "https://support.microsoft.com/en-us/privacy/microsoft-copilot/activity-history",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-08-17-atlassian-ai-training-cloud-data",
      "url": "https://maple.ai/privacy-timeline#2026-08-17-atlassian-ai-training-cloud-data",
      "date": "2026-08-17",
      "date_precision": "day",
      "company": "Atlassian",
      "platform": null,
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Atlassian starts AI training on cloud data",
      "summary": "Cloud customer metadata and in-app content, such as Jira and Confluence text, began to be used to improve Atlassian's AI; metadata opt-out is Enterprise-only.",
      "control": null,
      "source_url": "https://www.atlassian.com/trust/ai/data-contribution/faqs",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-07-24-eu-message-scanning-regulation",
      "url": "https://maple.ai/privacy-timeline#2026-07-24-eu-message-scanning-regulation",
      "date": "2026-07-24",
      "date_precision": "day",
      "company": "European Union",
      "platform": null,
      "category": "overreach",
      "category_label": "Overreach",
      "title": "EU restores voluntary message scanning law",
      "summary": "Regulation 2026/1881 was adopted, again allowing messaging providers to scan communications for child sexual abuse until April 2028, excluding end-to-end encrypted communications.",
      "control": null,
      "source_url": "https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng",
      "source_type": "government",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-07-09-garante-character-ai-fine",
      "url": "https://maple.ai/privacy-timeline#2026-07-09-garante-character-ai-fine",
      "date": "2026-07-09",
      "date_precision": "day",
      "company": "Character.AI",
      "platform": "character-ai",
      "category": "regulation",
      "category_label": "Regulation",
      "title": "Italy fines Character.AI €158,000",
      "summary": "Italy's Garante fined Character Technologies €158,000 over its privacy notice, a late impact assessment, and age verification for minors.",
      "control": null,
      "source_url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10269594",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-07-08-claude-age-checks-connected-apps",
      "url": "https://maple.ai/privacy-timeline#2026-07-08-claude-age-checks-connected-apps",
      "date": "2026-07-08",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Claude policy adds age checks and sharing",
      "summary": "Consumer accounts may be asked for age or identity data, and multi-step tasks can share inputs and outputs with connected apps.",
      "control": null,
      "source_url": "https://www.anthropic.com/legal/privacy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/d9e2b511ebfe9c55cddbef70b2069bd69a43f048/Claude.ai/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-06-01-copilot-edge-page-content",
      "url": "https://maple.ai/privacy-timeline#2026-06-01-copilot-edge-page-content",
      "date": "2026-06-01",
      "date_precision": "month",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Copilot in Edge can read page content",
      "summary": "Copilot in Edge may access page content, tabs, browsing history, and visual snapshots of the page.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/privacy/updates",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-06-01-copilot-health-information",
      "url": "https://maple.ai/privacy-timeline#2026-06-01-copilot-health-information",
      "date": "2026-06-01",
      "date_precision": "month",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Copilot Health uses health information",
      "summary": "Copilot Health uses health information to provide personalized assistance focused on health and wellness.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/privacy/updates",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-05-07-eu-ai-act-high-risk-delay",
      "url": "https://maple.ai/privacy-timeline#2026-05-07-eu-ai-act-high-risk-delay",
      "date": "2026-05-07",
      "date_precision": "day",
      "company": "European Union",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "EU agrees to delay AI Act high-risk rules",
      "summary": "Lawmakers agreed to move AI Act high-risk deadlines to December 2027 and August 2028 and to ban AI nudifier apps.",
      "control": null,
      "source_url": "https://www.europarl.europa.eu/news/en/press-room/20260427IPR42011/ai-act-deal-on-simplification-measures-ban-on-nudifier-apps",
      "source_type": "government",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-04-04-grok-google-apps-training-limit",
      "url": "https://maple.ai/privacy-timeline#2026-04-04-grok-google-apps-training-limit",
      "date": "2026-04-04",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Google app data excluded from training",
      "summary": "Content from Google apps connected through Google OAuth is not used for internal AI or model training.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy/previous-2026-04-04",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/0630bb42c6396f7d6b29e00a14cf8a343180df3b/Grok/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-04-04-grok-targeted-advertising",
      "url": "https://maple.ai/privacy-timeline#2026-04-04-grok-targeted-advertising",
      "date": "2026-04-04",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok policy adds targeted advertising",
      "summary": "The Grok privacy policy adds delivering targeted advertising as a listed use of personal information.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy/previous-2026-04-04",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/0630bb42c6396f7d6b29e00a14cf8a343180df3b/Grok/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-04-01-chatgpt-ad-controls",
      "url": "https://maple.ai/privacy-timeline#2026-04-01-chatgpt-ad-controls",
      "date": "2026-04-01",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "ChatGPT adds controls for personalized ads",
      "summary": "Account settings include controls over what data is used to personalize ads shown on the services.",
      "control": "Advertising controls in your account settings.",
      "source_url": "https://openai.com/policies/eu-privacy-policy/",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/2c94a9c16c2bd563bee063bd0cf31ac1775136e0/ChatGPT/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-04-01-chatgpt-teen-account-linking",
      "url": "https://maple.ai/privacy-timeline#2026-04-01-chatgpt-teen-account-linking",
      "date": "2026-04-01",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Parents can link ChatGPT teen accounts",
      "summary": "Teen users and a parent or guardian can link accounts so the adult can manage settings and receive safety alerts.",
      "control": null,
      "source_url": "https://openai.com/policies/eu-privacy-policy/",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/2c94a9c16c2bd563bee063bd0cf31ac1775136e0/ChatGPT/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-03-25-github-copilot-training-data",
      "url": "https://maple.ai/privacy-timeline#2026-03-25-github-copilot-training-data",
      "date": "2026-03-25",
      "date_precision": "day",
      "company": "GitHub",
      "platform": "github-copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "GitHub to train on Copilot interaction data",
      "summary": "Blog post: Copilot Free, Pro and Pro+ interaction data, including code snippets, would train GitHub's AI models from April 24 unless users opt out.",
      "control": "Opt out in Copilot settings under \"Privacy.\"",
      "source_url": "https://github.blog/news-insights/company-news/updates-to-github-copilot-interaction-data-usage-policy/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-03-01-microsoft-retention-periods-removed",
      "url": "https://maple.ai/privacy-timeline#2026-03-01-microsoft-retention-periods-removed",
      "date": "2026-03-01",
      "date_precision": "month",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Statement drops stated retention periods",
      "summary": "The privacy statement no longer describes specific retention periods in its Bing and Advertising sections.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/privacy/updates",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-02-10-claude-chats-not-privileged",
      "url": "https://maple.ai/privacy-timeline#2026-02-10-claude-chats-not-privileged",
      "date": "2026-02-10",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Court rules Claude chats not privileged",
      "summary": "A federal judge ruled that a criminal defendant's written exchanges with Anthropic's Claude were not protected from government inspection by attorney-client privilege or work product.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.652138/gov.uscourts.nysd.652138.27.0.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-02-03-ico-grok-investigation",
      "url": "https://maple.ai/privacy-timeline#2026-02-03-ico-grok-investigation",
      "date": "2026-02-03",
      "date_precision": "day",
      "company": "X and xAI",
      "platform": "x",
      "category": "regulation",
      "category_label": "Regulation",
      "title": "UK ICO opens investigation into Grok",
      "summary": "The UK ICO opened formal investigations into X and xAI over Grok's processing of personal data and its generation of sexualized images.",
      "control": null,
      "source_url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-01-14-gemini-app-connections-off-default",
      "url": "https://maple.ai/privacy-timeline#2026-01-14-gemini-app-connections-off-default",
      "date": "2026-01-14",
      "date_precision": "day",
      "company": "Google",
      "platform": "gemini",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Gemini app connections start off by default",
      "summary": "Connecting Gmail, Photos, YouTube, and Search is off by default, and Gemini does not train directly on Gmail or Photos.",
      "control": null,
      "source_url": "https://blog.google/innovation-and-ai/products/gemini-app/personal-intelligence/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2026-01-05-openai-20-million-logs-affirmed",
      "url": "https://maple.ai/privacy-timeline#2026-01-05-openai-20-million-logs-affirmed",
      "date": "2026-01-05",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Judge upholds 20 million ChatGPT log order",
      "summary": "A federal district judge denied OpenAI's objections and affirmed orders requiring production of 20 million de-identified ChatGPT conversation logs.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.1021.0.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-11-26-eu-council-chat-control-position",
      "url": "https://maple.ai/privacy-timeline#2025-11-26-eu-council-chat-control-position",
      "date": "2025-11-26",
      "date_precision": "day",
      "company": "Council of the EU",
      "platform": null,
      "category": "overreach",
      "category_label": "Overreach",
      "title": "EU Council agrees position on Chat Control",
      "summary": "Member states agreed the Council position on the child sexual abuse regulation, including making permanent an exemption that lets companies voluntarily scan messages.",
      "control": null,
      "source_url": "https://www.consilium.europa.eu/en/press/press-releases/2025/11/26/child-sexual-abuse-council-reaches-position-on-law-protecting-children-from-online-abuse/",
      "source_type": "government",
      "archive_url": "https://web.archive.org/web/20251126093538/https://www.consilium.europa.eu/en/press/press-releases/2025/11/26/child-sexual-abuse-council-reaches-position-on-law-protecting-children-from-online-abuse/",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-11-26-openai-mixpanel-breach",
      "url": "https://maple.ai/privacy-timeline#2025-11-26-openai-mixpanel-breach",
      "date": "2025-11-26",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Mixpanel breach exposed OpenAI API user details",
      "summary": "An attacker exported data from analytics vendor Mixpanel, including names, emails, and approximate locations of some OpenAI API users; chats were not exposed.",
      "control": null,
      "source_url": "https://openai.com/index/mixpanel-incident/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-11-07-openai-20-million-logs-order",
      "url": "https://maple.ai/privacy-timeline#2025-11-07-openai-20-million-logs-order",
      "date": "2025-11-07",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Court orders 20 million ChatGPT logs produced",
      "summary": "A federal magistrate judge ordered OpenAI to produce 20 million de-identified consumer ChatGPT logs to news plaintiffs in the copyright litigation.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.640396/gov.uscourts.nysd.640396.734.0.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-10-13-california-sb-243",
      "url": "https://maple.ai/privacy-timeline#2025-10-13-california-sb-243",
      "date": "2025-10-13",
      "date_precision": "day",
      "company": "State of California",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "California enacts companion chatbot law SB 243",
      "summary": "The governor signed SB 243, requiring companion chatbots to disclose they are AI and maintain self-harm response protocols, with protections for minors.",
      "control": null,
      "source_url": "https://www.gov.ca.gov/2025/10/13/governor-newsom-signs-bills-to-further-strengthen-californias-leadership-in-protecting-children-online/",
      "source_type": "government",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-10-09-openai-preservation-order-ended",
      "url": "https://maple.ai/privacy-timeline#2025-10-09-openai-preservation-order-ended",
      "date": "2025-10-09",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Court ends OpenAI's ongoing chat preservation duty",
      "summary": "A court-approved stipulation ended OpenAI’s ongoing duty to preserve deleted ChatGPT output logs as of September 26, 2025; earlier logs stay, except EEA, Swiss and UK data, and listed-domain accounts remain preserved.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.922.0.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-10-01-meta-ai-chats-for-ads",
      "url": "https://maple.ai/privacy-timeline#2025-10-01-meta-ai-chats-for-ads",
      "date": "2025-10-01",
      "date_precision": "day",
      "company": "Meta",
      "platform": "meta-ai",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Meta to use AI chats for ads",
      "summary": "Newsroom post: content and ad recommendations would be personalized based on people's interactions with Meta's generative AI features, starting December 16, 2025.",
      "control": null,
      "source_url": "https://about.fb.com/news/2025/10/improving-your-recommendations-apps-ai-meta/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-09-12-chatgpt-records-warrant",
      "url": "https://maple.ai/privacy-timeline#2025-09-12-chatgpt-records-warrant",
      "date": "2025-09-12",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Federal warrant issued for a user’s ChatGPT records",
      "summary": "A federal magistrate judge in Maine issued a warrant for OpenAI records of a user’s ChatGPT searches; the return shows it was executed the next day.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.med.68916/gov.uscourts.med.68916.3.0.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-16"
    },
    {
      "id": "2025-09-11-ftc-ai-chatbot-6b-orders",
      "url": "https://maple.ai/privacy-timeline#2025-09-11-ftc-ai-chatbot-6b-orders",
      "date": "2025-09-11",
      "date_precision": "day",
      "company": "Federal Trade Commission",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "FTC orders seven AI chatbot firms to report",
      "summary": "6(b) orders went to seven companies, including OpenAI, Meta, and Character.AI, on how their companion chatbots affect children and teens.",
      "control": null,
      "source_url": "https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-09-06-salesloft-drift-token-theft",
      "url": "https://maple.ai/privacy-timeline#2025-09-06-salesloft-drift-token-theft",
      "date": "2025-09-06",
      "date_precision": "day",
      "company": "Salesloft",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Drift chatbot OAuth tokens stolen and misused",
      "summary": "Trust center update: an attacker stole OAuth tokens for Drift AI chat integrations and used them to take customer data, including from Salesforce in August 2025.",
      "control": null,
      "source_url": "https://trust.salesloft.com/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-08-28-claude-consumer-chat-training",
      "url": "https://maple.ai/privacy-timeline#2025-08-28-claude-consumer-chat-training",
      "date": "2025-08-28",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Claude consumer chats may train models",
      "summary": "Claude Free, Pro and Max users were asked to choose whether chats train Anthropic's models; retention extends to five years for those who allow it.",
      "control": "Change your choice at any time in Privacy Settings.",
      "source_url": "https://www.anthropic.com/news/updates-to-our-consumer-terms",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-08-26-openai-law-enforcement-referrals",
      "url": "https://maple.ai/privacy-timeline#2025-08-26-openai-law-enforcement-referrals",
      "date": "2025-08-26",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "OpenAI may refer some chats to police",
      "summary": "Company post: human reviewers examine conversations flagged for planned harm to others, and OpenAI may refer imminent threats of serious physical harm to law enforcement.",
      "control": null,
      "source_url": "https://openai.com/index/helping-people-when-they-need-it-most/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-08-13-gemini-keep-activity-uploads",
      "url": "https://maple.ai/privacy-timeline#2025-08-13-gemini-keep-activity-uploads",
      "date": "2025-08-13",
      "date_precision": "day",
      "company": "Google",
      "platform": "gemini",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Gemini to sample user uploads for improvement",
      "summary": "Blog post: Gemini Apps Activity would be renamed Keep Activity and, when on, a sample of future uploads used to improve Google services.",
      "control": "Turn off Keep Activity, or use Temporary Chats.",
      "source_url": "https://blog.google/products-and-platforms/products/gemini/temporary-chats-privacy-controls/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-07-31-change-healthcare-192-million",
      "url": "https://maple.ai/privacy-timeline#2025-07-31-change-healthcare-192-million",
      "date": "2025-07-31",
      "date_precision": "day",
      "company": "Change Healthcare",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Change Healthcare breach reaches 192.7 million people",
      "summary": "HHS's Office for Civil Rights was told that about 192.7 million people were affected by Change Healthcare's 2024 ransomware attack.",
      "control": null,
      "source_url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-07-10-grok-training-objection-settings",
      "url": "https://maple.ai/privacy-timeline#2025-07-10-grok-training-objection-settings",
      "date": "2025-07-10",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok training objection moves into settings",
      "summary": "People in Europe can object in settings to use of their information to train Grok models.",
      "control": "Object to model training in your settings (people in Europe).",
      "source_url": "https://x.ai/legal/privacy-policy/previous-2025-07-10",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/30f91c5645819d35c4138fcd83ff3d55773af3e5/Grok/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-07-09-paradox-hiring-chatbot-exposure",
      "url": "https://maple.ai/privacy-timeline#2025-07-09-paradox-hiring-chatbot-exposure",
      "date": "2025-07-09",
      "date_precision": "day",
      "company": "Paradox.ai",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Hiring chatbot test account exposed applicant chats",
      "summary": "Researchers used a legacy test account password to reach chat records in one client's AI hiring assistant, viewing five U.S. candidates' contact details.",
      "control": null,
      "source_url": "https://www.paradox.ai/blog/responsible-security-update",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-05-19-garante-replika-fine",
      "url": "https://maple.ai/privacy-timeline#2025-05-19-garante-replika-fine",
      "date": "2025-05-19",
      "date_precision": "day",
      "company": "Luka (Replika)",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "Italy fines Replika maker €5 million",
      "summary": "Italy's Garante fined Luka Inc. €5 million over Replika's legal basis for processing, its privacy policy, and lack of age verification.",
      "control": null,
      "source_url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10132048",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-05-13-openai-deleted-chats-preservation",
      "url": "https://maple.ai/privacy-timeline#2025-05-13-openai-deleted-chats-preservation",
      "date": "2025-05-13",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Court orders OpenAI to keep deleted chats",
      "summary": "A federal magistrate judge ordered OpenAI to preserve and segregate all ChatGPT output log data that would otherwise be deleted, including at users' request.",
      "control": null,
      "source_url": "https://storage.courtlistener.com/recap/gov.uscourts.nysd.612697/gov.uscourts.nysd.612697.551.0_1.pdf",
      "source_type": "court",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-04-14-meta-eu-ai-training-resumed",
      "url": "https://maple.ai/privacy-timeline#2025-04-14-meta-eu-ai-training-resumed",
      "date": "2025-04-14",
      "date_precision": "day",
      "company": "Meta",
      "platform": "meta-ai",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Meta resumes AI training on EU content",
      "summary": "Newsroom post: Meta's AI would be trained on public posts and comments from adults in the EU, and on their interactions with Meta AI.",
      "control": "Objection form, linked from the notices EU users receive.",
      "source_url": "https://about.fb.com/news/2025/04/making-ai-work-harder-for-europeans/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-02-24-apple-adp-uk-withdrawn",
      "url": "https://maple.ai/privacy-timeline#2025-02-24-apple-adp-uk-withdrawn",
      "date": "2025-02-24",
      "date_precision": "day",
      "company": "Apple",
      "platform": null,
      "category": "overreach",
      "category_label": "Overreach",
      "title": "Apple pulls Advanced Data Protection in the UK",
      "summary": "Advanced Data Protection, Apple's end-to-end encryption for iCloud, stopped being offered to new users in the United Kingdom.",
      "control": null,
      "source_url": "https://support.apple.com/en-us/122234",
      "source_type": "company",
      "archive_url": "https://web.archive.org/web/20250224093113/https://support.apple.com/en-us/122234",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-02-14-grok-teen-parental-consent",
      "url": "https://maple.ai/privacy-timeline#2025-02-14-grok-teen-parental-consent",
      "date": "2025-02-14",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Parents must agree for teenage Grok use",
      "summary": "Parents of teenagers ages 13 to 17 must agree to the terms before those teenagers use the service.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/5422b36e46c3cd506b250c0c175c8a55e043cf0a/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-02-02-eu-ai-act-prohibitions",
      "url": "https://maple.ai/privacy-timeline#2025-02-02-eu-ai-act-prohibitions",
      "date": "2025-02-02",
      "date_precision": "day",
      "company": "European Union",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "EU AI Act prohibitions take effect",
      "summary": "The AI Act's bans on prohibited practices, such as social scoring and workplace emotion recognition, began to apply.",
      "control": null,
      "source_url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai",
      "source_type": "government",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-01-30-garante-deepseek-processing-ban",
      "url": "https://maple.ai/privacy-timeline#2025-01-30-garante-deepseek-processing-ban",
      "date": "2025-01-30",
      "date_precision": "day",
      "company": "DeepSeek",
      "platform": "deepseek",
      "category": "regulation",
      "category_label": "Regulation",
      "title": "Italy orders DeepSeek to stop processing data",
      "summary": "Italy's Garante ordered DeepSeek's two Chinese operators to stop processing Italian users' data, effective immediately, and opened an investigation.",
      "control": null,
      "source_url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10097450",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2025-01-02-grok-temporary-chats-30-days",
      "url": "https://maple.ai/privacy-timeline#2025-01-02-grok-temporary-chats-30-days",
      "date": "2025-01-02",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Temporary Grok chats kept for 30 days",
      "summary": "Temporary chats do not appear in history and are kept for up to 30 days for safety purposes.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/8d99adee2d655e265165ab5ec9976e02bf5d77c4/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-12-20-garante-openai-fine",
      "url": "https://maple.ai/privacy-timeline#2024-12-20-garante-openai-fine",
      "date": "2024-12-20",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "regulation",
      "category_label": "Regulation",
      "title": "Italy fines OpenAI €15 million",
      "summary": "Italy's Garante fined OpenAI €15 million over ChatGPT's legal basis for training, transparency, and breach notification; a Rome court later upheld OpenAI's appeal.",
      "control": null,
      "source_url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-12-20-grok-minimum-age-13",
      "url": "https://maple.ai/privacy-timeline#2024-12-20-grok-minimum-age-13",
      "date": "2024-12-20",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok minimum age lowered to 13",
      "summary": "The minimum age changed from 18 to 13, and the service is not directed at children under 13.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/cb098720b58ef7d193495133af5289c4db3d3d63/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-11-15-x-third-party-ai-training",
      "url": "https://maple.ai/privacy-timeline#2024-11-15-x-third-party-ai-training",
      "date": "2024-11-15",
      "date_precision": "day",
      "company": "X",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "X lets third parties train AI on data",
      "summary": "Privacy policy update: third parties receiving X data may use it for their own purposes, including training their AI models.",
      "control": null,
      "source_url": "https://x.com/en/privacy/previous/version_21",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-11-11-grok-interaction-data-training",
      "url": "https://maple.ai/privacy-timeline#2024-11-11-grok-interaction-data-training",
      "date": "2024-11-11",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok interaction data added to training",
      "summary": "Interaction data, such as session frequency and features used, is listed among data used to train models.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/2a58bb8296c83af727f7de173abd3b3f61f94790/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-11-04-chatgpt-temporary-chats-30-days",
      "url": "https://maple.ai/privacy-timeline#2024-11-04-chatgpt-temporary-chats-30-days",
      "date": "2024-11-04",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Temporary chats kept up to 30 days",
      "summary": "Temporary chats do not appear in history and are kept for up to 30 days for safety purposes.",
      "control": null,
      "source_url": "https://openai.com/policies/eu-privacy-policy/",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/2acc6bf930ea7af4d512a4ca41cc26cfbddbdb54/ChatGPT/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-09-18-linkedin-generative-ai-training",
      "url": "https://maple.ai/privacy-timeline#2024-09-18-linkedin-generative-ai-training",
      "date": "2024-09-18",
      "date_precision": "day",
      "company": "LinkedIn",
      "platform": null,
      "category": "policy",
      "category_label": "Policy changes",
      "title": "LinkedIn uses member data for generative AI",
      "summary": "Privacy policy update: member data trains LinkedIn's content-generating AI models, with an opt-out setting; the EEA, Switzerland and UK were excluded.",
      "control": "Opt-out setting for generative AI training.",
      "source_url": "https://www.linkedin.com/blog/member/trust-and-safety/updates-to-our-terms-of-service-2024",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-09-05-grok-user-content-training",
      "url": "https://maple.ai/privacy-timeline#2024-09-05-grok-user-content-training",
      "date": "2024-09-05",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "User content may train Grok models",
      "summary": "User content provided to the service may be processed to train and improve the models, with an email opt-out.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/5478b2d34878d319848a9d717397f52e6b76be07/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-08-01-eu-ai-act-in-force",
      "url": "https://maple.ai/privacy-timeline#2024-08-01-eu-ai-act-in-force",
      "date": "2024-08-01",
      "date_precision": "day",
      "company": "European Union",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "EU AI Act enters into force",
      "summary": "The Artificial Intelligence Act entered into force, setting risk-based rules for AI systems that apply in stages over the following years.",
      "control": null,
      "source_url": "https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en",
      "source_type": "government",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-08-01-microsoft-ai-training-statement",
      "url": "https://maple.ai/privacy-timeline#2024-08-01-microsoft-ai-training-statement",
      "date": "2024-08-01",
      "date_precision": "month",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Privacy statement says data may train models",
      "summary": "The privacy statement says Microsoft may use personal data to develop and train its AI models.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/privacy/updates",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-06-10-meta-eu-ai-training-plan",
      "url": "https://maple.ai/privacy-timeline#2024-06-10-meta-eu-ai-training-plan",
      "date": "2024-06-10",
      "date_precision": "day",
      "company": "Meta",
      "platform": "meta-ai",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Meta plans AI training on Europeans' posts",
      "summary": "Newsroom post: Meta's AI models would be trained on public posts, comments and photos from adult users in Europe, with an objection form.",
      "control": null,
      "source_url": "https://about.fb.com/news/2024/06/building-ai-technology-for-europeans-in-a-transparent-and-responsible-way/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-06-05-claude-deleted-chats-30-days",
      "url": "https://maple.ai/privacy-timeline#2024-06-05-claude-deleted-chats-30-days",
      "date": "2024-06-05",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Deleted Claude chats removed within 30 days",
      "summary": "Deleted conversations are removed from history immediately and deleted from back-end systems within 30 days.",
      "control": null,
      "source_url": "https://www.anthropic.com/legal/archive/612ca587-3729-4908-aee5-65fc654dd483",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-05-31-hugging-face-spaces-secrets",
      "url": "https://maple.ai/privacy-timeline#2024-05-31-hugging-face-spaces-secrets",
      "date": "2024-05-31",
      "date_precision": "day",
      "company": "Hugging Face",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Hugging Face detects access to Spaces secrets",
      "summary": "Unauthorized access to secrets stored in the Spaces AI app platform was detected; affected tokens were revoked, and users and data protection authorities notified.",
      "control": null,
      "source_url": "https://huggingface.co/blog/space-secrets-disclosure",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-04-12-kaiser-tracking-pixels",
      "url": "https://maple.ai/privacy-timeline#2024-04-12-kaiser-tracking-pixels",
      "date": "2024-04-12",
      "date_precision": "day",
      "company": "Kaiser Permanente",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "Kaiser tracking pixels sent member data to advertisers",
      "summary": "Members were notified that tracking pixels on Kaiser's sites and apps may have sent names, IP addresses, and health searches to Google, Bing, and X.",
      "control": null,
      "source_url": "https://oag.ca.gov/ecrime/databreach/reports/sb24-583875",
      "source_type": "breach-notice",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-03-15-grok-public-posts-training",
      "url": "https://maple.ai/privacy-timeline#2024-03-15-grok-public-posts-training",
      "date": "2024-03-15",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Grok training covers public posts and chats",
      "summary": "Training may use public X posts, internet search data, and a voluntary subset of conversation and feedback data.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/caafd97eff81cb60fa19e1b9d048d0c6de26afda/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2024-03-04-claude-no-training-by-default",
      "url": "https://maple.ai/privacy-timeline#2024-03-04-claude-no-training-by-default",
      "date": "2024-03-04",
      "date_precision": "day",
      "company": "Anthropic",
      "platform": "claude",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Claude chats excluded from training by default",
      "summary": "Inputs and outputs are not used to train models unless a chat is safety-flagged, reported, or the user opts in.",
      "control": null,
      "source_url": "https://www.anthropic.com/legal/archive/cf9213dc-642f-43ff-bb0b-f07e10eb0d9f",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-11-14-chatgpt-business-admin-access",
      "url": "https://maple.ai/privacy-timeline#2023-11-14-chatgpt-business-admin-access",
      "date": "2023-11-14",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Business admins can access ChatGPT accounts",
      "summary": "Enterprise or business-account administrators may access and control an account, and users can share conversations by link.",
      "control": null,
      "source_url": "https://openai.com/policies/eu-privacy-policy/",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/13a91025d862e8d5fa2ea73618eb3a7b40346d7a/OpenAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-11-04-xai-chosen-data-training",
      "url": "https://maple.ai/privacy-timeline#2023-11-04-xai-chosen-data-training",
      "date": "2023-11-04",
      "date_precision": "day",
      "company": "xAI",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Early policy trains only on chosen data",
      "summary": "Models are trained only on usage data people choose to provide, not on account, payment, or technical data.",
      "control": null,
      "source_url": "https://x.ai/legal/privacy-policy",
      "source_type": "company",
      "archive_url": "https://github.com/OpenTermsArchive/genai-contrib-versions/blob/7514a795310c2e6bb92bbc7d6fd0fadd209d2287/xAI/Privacy%20Policy.md",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-10-06-23andme-credential-stuffing",
      "url": "https://maple.ai/privacy-timeline#2023-10-06-23andme-credential-stuffing",
      "date": "2023-10-06",
      "date_precision": "day",
      "company": "23andMe",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "23andMe accounts accessed via credential stuffing",
      "summary": "Attackers used reused passwords to access about 14,000 accounts, reaching data from about 5.5 million DNA Relatives and 1.4 million Family Tree profiles.",
      "control": null,
      "source_url": "https://www.23andme.org/blog/articles/addressing-data-security-concerns",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-09-29-x-privacy-policy-ai-training",
      "url": "https://maple.ai/privacy-timeline#2023-09-29-x-privacy-policy-ai-training",
      "date": "2023-09-29",
      "date_precision": "day",
      "company": "X",
      "platform": "x",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "X privacy policy adds AI model training",
      "summary": "Privacy policy update: the information X collects and publicly available information may be used to help train its machine learning or AI models.",
      "control": null,
      "source_url": "https://x.com/en/privacy/previous/version_20",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-09-18-microsoft-sas-token-exposure",
      "url": "https://maple.ai/privacy-timeline#2023-09-18-microsoft-sas-token-exposure",
      "date": "2023-09-18",
      "date_precision": "day",
      "company": "Microsoft",
      "platform": null,
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "AI research token exposed internal Microsoft data",
      "summary": "An employee published a storage link with a broad-access SAS token on GitHub, exposing two former employees' workstation backups and internal Teams messages.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/msrc/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-08-01-bing-chat-activity-controls",
      "url": "https://maple.ai/privacy-timeline#2023-08-01-bing-chat-activity-controls",
      "date": "2023-08-01",
      "date_precision": "month",
      "company": "Microsoft",
      "platform": "copilot",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Bing Chat activity can be viewed and managed",
      "summary": "The Bing section explains how to view and manage recent activity with Bing Chat.",
      "control": null,
      "source_url": "https://www.microsoft.com/en-us/privacy/updates",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-07-01-google-policy-ai-training",
      "url": "https://maple.ai/privacy-timeline#2023-07-01-google-policy-ai-training",
      "date": "2023-07-01",
      "date_precision": "day",
      "company": "Google",
      "platform": "gemini",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Google policy covers public data for AI training",
      "summary": "Privacy policy update: wording changed from training \"language models\" on publicly available information to training \"Google's AI models,\" naming Bard and Cloud AI.",
      "control": null,
      "source_url": "https://policies.google.com/privacy/archive/20230701?hl=en-US",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-05-31-ftc-doj-amazon-alexa",
      "url": "https://maple.ai/privacy-timeline#2023-05-31-ftc-doj-amazon-alexa",
      "date": "2023-05-31",
      "date_precision": "day",
      "company": "Amazon",
      "platform": null,
      "category": "regulation",
      "category_label": "Regulation",
      "title": "FTC and DOJ charge Amazon over Alexa recordings",
      "summary": "The FTC and DOJ alleged Amazon kept children's Alexa voice recordings indefinitely; a proposed order required a $25 million civil penalty and data deletion.",
      "control": null,
      "source_url": "https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-04-25-chatgpt-history-off-no-training",
      "url": "https://maple.ai/privacy-timeline#2023-04-25-chatgpt-history-off-no-training",
      "date": "2023-04-25",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "policy",
      "category_label": "Policy changes",
      "title": "Turning off chat history stops model training",
      "summary": "Conversations started with chat history off are not used to train models and are kept 30 days for abuse review.",
      "control": "Turn off chat history in ChatGPT settings.",
      "source_url": "https://openai.com/blog/new-ways-to-manage-your-data-in-chatgpt",
      "source_type": "company",
      "archive_url": "https://web.archive.org/web/20230426001153/https://openai.com/blog/new-ways-to-manage-your-data-in-chatgpt",
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-03-31-garante-chatgpt-limitation",
      "url": "https://maple.ai/privacy-timeline#2023-03-31-garante-chatgpt-limitation",
      "date": "2023-03-31",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "regulation",
      "category_label": "Regulation",
      "title": "Italy temporarily limits ChatGPT data processing",
      "summary": "Italy's Garante ordered an immediate temporary limitation on OpenAI's processing of Italian users' data and opened an inquiry into ChatGPT.",
      "control": null,
      "source_url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870847",
      "source_type": "regulator",
      "archive_url": null,
      "verified_on": "2026-10-15"
    },
    {
      "id": "2023-03-24-chatgpt-redis-bug",
      "url": "https://maple.ai/privacy-timeline#2023-03-24-chatgpt-redis-bug",
      "date": "2023-03-24",
      "date_precision": "day",
      "company": "OpenAI",
      "platform": "chatgpt",
      "category": "breach",
      "category_label": "Breaches and leaks",
      "title": "ChatGPT bug showed other users' chat titles",
      "summary": "A Redis library bug let some ChatGPT users see other users' chat titles and exposed payment details of 1.2% of active Plus subscribers.",
      "control": null,
      "source_url": "https://openai.com/index/march-20-chatgpt-outage/",
      "source_type": "company",
      "archive_url": null,
      "verified_on": "2026-10-15"
    }
  ]
}