ChatGPT Expands Into Sensitive Data

The story is sharpened around specific ChatGPT product rollouts for finance and health, with clearer claims about data protections and a new human-review safety feature for self-harm cases. The cyber incident is also reframed as a Japanese allegation involving a teenager and rotating IPs, rather than a more general disruptive-code example.

The biggest change is that the story now includes a new safety-intervention dimension: OpenAI is adding human-reviewed alerts for suspected serious self-harm discussions, which raises fresh concerns about sensitive disclosure. The security angle also broadened, with a reported Bandai incident now described more specifically as ChatGPT-assisted code enabling account disruption and IP-blocking evasion.

• Human-reviewed alerts for suspected serious self-harm discussions are being added.
• Stored files may persist after a conversation is deleted.
• ChatGPT-assisted code reportedly automated account disruption and evaded IP-based blocking.
• The cyber risk now extends beyond OpenAI-operated products.
• Safety intervention creates a new disclosure-versus-protection trade-off.

The story has shifted from general concerns about AI chat retention and privacy into a more concrete platform-risk narrative centered on ChatGPT handling financial, health, identity, and payment data. It now also includes real implementation efforts and a live misuse incident, making the stakes around account compromise, liability, and unsafe automation more immediate.

• ChatGPT now connects to financial accounts and health records.
• OpenAI added deletion, disconnection, temporary-chat, and access-period controls.
• ChatGPT Health is not HIPAA-compliant.
• Visa and OpenAI are developing agentic payments.
• Bandai Channel suffered an alleged ChatGPT-assisted automated attack.

The story has broadened from generic AI privacy and retention concerns into a more concrete dispute over long-lived chat data, especially around OpenAI’s memory, file storage, health features, and litigation-driven preservation. It also now emphasizes that courts and compliance demands can override user expectations about deletion and access.

• OpenAI now retains content through memory, file storage, and linked-data features.
• Chats, files, and logs may persist for days or longer after deletion.
• Preserved chat logs are becoming central in litigation and privilege disputes.
• AI products are extending into health records and other sensitive file categories.
• Courts and litigants now shape deletion and access rules.

The story has broadened from general AI chat privacy concerns into a more concrete regulatory and product-risk picture, anchored by Canadian findings against OpenAI and new account-linked financial use cases. It now emphasizes that sensitive everyday data is flowing through AI systems faster than privacy controls and deletion guarantees can keep up.

• Canadian regulators found ChatGPT's practices overbroad in data collection.
• Plaid and Intuit appear in account-linked AI financial use cases.
• Chatbots are now handling financial accounts and personal documents.
• Researchers report chatbots can surface phone numbers and addresses.
• Duck.ai is highlighted as a privacy-oriented alternative.

Recent coverage shows AI chat privacy becoming a practical settings-and-retention issue rather than a purely abstract concern. Most material focuses on ChatGPT and comparable assistants storing conversations, using them for training or safety review, retaining files and logs, and exposing users to limited deletion, account-level controls, and legal retention demands.