Model Provider Data Handling Commitments Compared
Enterprise contracts bar model training, while consumer plans allow it by default.
Model provider data handling commitments are best compared by plan type. Enterprise services generally have training-off defaults and protections in their contracts, while consumer plans, including paid individual subscriptions, generally allow training by default. That split is the starting point. A useful comparison then asks what each provider stores, who can read it, where it goes, and whether agents change the answer.
Why the consumer/enterprise split is the right lens for comparing AI data commitments
A subscription price is not a privacy boundary. Moving from a free account to a paid individual plan typically buys more features and model access under the same agreement about data use. The stronger dividing line is between consumer terms of service and enterprise contracts backed by data processing addenda. Those agreements set different rules even when the products look much the same to the person typing a prompt.
A provider can offer broad consumer data use and restrictive business terms without contradicting itself. The commitments attach to the service being used. Comparing providers without separating those services obscures enterprise permission requirements and consumer opt-out defaults for training.
What "training off" actually means — and what it does not
Training exclusion governs how data may improve models. It does not mean that data never reaches the provider, is never stored, or cannot be read. OpenAI's policy treats using data for training separately from keeping it for API abuse-monitoring, historically up to 30 days. Zero Data Retention, or ZDR, is a further arrangement available to eligible API customers. It sets rules for storing content as well as keeping it out of training.
An opt-out also cannot undo completed training. Data that has already shaped model weights cannot be extracted like a record deleted from a database, so opting out excludes future conversations only. A contract makes that exclusion a stronger promise than a marketing page does, but neither provides technical proof. Running open-weight models locally, where the provider never receives plaintext, means there is no need to rely on the provider's rules for handling data. Storage, access, training, and architecture are separate dimensions of the comparison.
OpenAI's split — consumer default-on, business default-off, with a feedback loophole
Free, Plus, and Pro content may be used for training by default. Users can opt out through the Privacy Portal or the “Improve the model for everyone” setting under Settings, then Data Controls. Paying for an individual plan does not change that starting position. OpenAI's Data Controls FAQ also describes Temporary Chat, where conversations do not appear in history, create memories, or enter training.
OpenAI's help documentation identifies an important exception to the consumer opt-out. Submitting thumbs-up or thumbs-down feedback means the entire associated conversation may be used for training, even when the user has disabled training. The rating can reopen training use for the conversation attached to it, making feedback behavior part of the consumer data agreement.
OpenAI's enterprise help page states that ChatGPT Business, Enterprise, Edu, and the API Platform exclude inputs and outputs from training by default. Its data use policy lets organizations that use the API opt into sharing, including through Playground feedback. A rating does not authorize training on the associated conversation unless the organization has separately agreed.
The FAQ adds another boundary for coding work. Codex has a separate “Include environments” setting governing training on full coding environments. That setting stays the same when users change the main ChatGPT toggle or use the Privacy Portal opt-out. The practical distinction is between an account-wide assumption and a product-specific control. Even within one provider, a single opt-out does not necessarily govern every kind of data submitted.
Anthropic's split — the same structure, with a newer consumer training default and a recent enterprise custody controversy
Anthropic announced consumer training in August 2025, with the policy taking effect on September 28, 2025. Existing users had until September 28 to opt out. Before that change, training on consumer conversations was not the default. The newer policy applies to Free, Pro, and Max, placing paid individual use on the consumer side of the divide.
Anthropic's consumer policy ties retention to that choice. With training enabled, de-identified conversations can be retained for up to five years, while switching training off returns retention to 30 days. Content that is safety-flagged or reported can still be used after an opt-out. The exclusion is therefore not absolute. By contrast, Anthropic's commercial terms state that it “may not train models on Customer Content from Services,” making training exclusion contractual for commercial API, Team, and Enterprise use.
The Enterprise Frontier Safeguards episode exposed a separate problem. Anthropic launched models requiring 30-day retention, effectively removing ZDR for those models. Enterprises in financial services, healthcare, and legal reported that the requirement prevented adoption because it conflicted with their privacy frameworks and GDPR requirements. The obstacle was keeping the data at all under the required arrangement.
Anthropic's September 1, 2026 Enterprise Frontier Safeguards announcement followed engagement with more than 100 enterprise customers. Under EFS, data is stored in cloud infrastructure controlled by the customer. That changed custody while leaving the commercial training prohibition intact. Anthropic retains read access for misuse detection, so customer-controlled storage does not make the data inaccessible to the provider.
Geography remains a separate constraint for European buyers. Anthropic does not currently offer EU data residency for Claude, with prompt data stored on US infrastructure and inference routed globally, potentially including the US. There is no guaranteed EU-only processing.
Google Gemini's split — three rulebooks, not two, and why paying for AI Pro or Ultra doesn't change your default
Personal Gemini accounts, Workspace, and the free Gemini API do not share one data rulebook. For personal accounts, “Keep Activity” is on by default for adults, allowing conversations to train Google's models. Human reviewers, including service providers, read a subset, and reviewed chats can remain for up to three years after the user deletes them.
Google AI Pro and Ultra retain that consumer default. Their price changes model access. Switching “Keep Activity” off ends training use and prevents interactions from being saved to Gemini's chat history. Storage does not end at the same time. Google still keeps each conversation for 72 hours to run the service.
Google's Generative AI in Workspace Privacy Hub, updated October 6, 2026, places Workspace prompts under the Cloud Data Processing Addendum. It states that content is “not human reviewed or otherwise used for Generative AI model training outside your domain without permission.” Workspace is therefore the enterprise commitment in this comparison. It is a different product from Google AI Pro or Ultra.
Google's Gemini API Additional Terms of Service, effective March 23, 2026, set a different set of rules for unpaid API services. They allow submitted content to be used “to provide, improve, and develop Google products” and permit human reviewers to read, annotate, and process inputs and outputs. An API endpoint is not automatically an enterprise boundary. A developer using the free Gemini API gets data terms like those for consumers, while OpenAI's API has a training-off default.
xAI (Grok) and Mistral — the API-clean, consumer-trained pattern and a notable EU exception
xAI's API commitment states that it “never trains on your API inputs or outputs without your explicit permission,” with a 30-day encrypted audit window. Consumer Grok on X follows the opposite default, using both X posts and Grok conversations for training. The scope extends beyond the chat itself.
Mistral follows the consumer and enterprise split but adds a geographic distinction. Its EU-native, EU-hosted API service does not train on customer data. For EU-to-EU data flows, no cross-border transfer mechanism is needed. That is a structural difference from processing EU data on US infrastructure. It does not, however, make every Mistral service a zero-retention service, because storage commitments depend on the endpoint.
Meta AI's data posture and why it sits outside the structural pattern
Meta AI is the significant consumer exception because US users cannot opt out of training on their conversations. Other major providers offer an opt-out path, even where training is enabled initially. US users lack the choice that makes the other consumer defaults reversible for future use.
Since late 2025, text and voice chats with Meta AI have also fed Meta's advertising system, primarily across Facebook and Instagram. WhatsApp and Messenger are included only where accounts are linked in Meta's Accounts Center.
How agentic data flows are straining commitments designed for chat
Agents make the separation between training and custody more consequential. A system acting across a customer database, a Git repository, or a calendar can encounter more sensitive material than a standalone conversation contains. Retaining that material for abuse monitoring raises different risks from retaining ordinary chat text. A training-off promise does not define the limits of collection. Nor does it establish which third-party systems an agent may access.
The xAI Grok Build incident in July 2026 made that gap concrete. A consumer coding agent over-collected data the user had explicitly excluded. The fix was a server-side flag change. By then, the data had already moved. The failure concerned enforcement at collection time, which a statement about later training use could not prevent.
Anthropic's EFS change illustrates the enterprise side of that strain. The two cases concern different controls, but both extend beyond whether conversations enter training. Agentic use makes collection, custody, and access part of the same evaluation. Calling a plan consumer or enterprise does too little to answer those questions under policies written for chat.
What enterprise buyers actually need to verify — beyond the training-off default
Enterprise buyers should require training exclusion and then check what else the service does with data. Buyers should check where data is physically stored and processed, because contractual protections do not erase cross-border transfers. A regulated European deployment needs to verify data geography alongside training exclusion.
Retention claims need the same level of precision. Buyers should verify ZDR against the endpoints their applications actually use. Mistral's ZDR documentation limits coverage to stateless API endpoints and explicitly excludes Agents, batch processing files, and several other services. A broad label can conceal a narrow scope. A workload using an excluded service does not gain coverage merely because another endpoint qualifies.
Access rights require a separate review of stored data. EFS shows why customer-controlled infrastructure and provider-inaccessible data are different commitments. Buyers should establish who can read retained content and for what purpose, rather than infer confidentiality from storage ownership. That review becomes more demanding when agents cross systems. Each new point of contact adds a place where the organization needs to enforce its limits.
The operational consequence is to build governance into the infrastructure. Access controls, real-time visibility into what agents do, and agent identity registries help organizations check whether data flows in ways that match their commitments. A registry of active MCP servers is part of that visibility. An organization that cannot see what its agents access cannot verify its own side of the data boundary.
