What Happens to What You Tell an AI Chatbot?

People tell AI chatbots things they would never type into a search box. Health worries, relationship problems, money trouble, the name of the person they are angry at. The conversational format invites it, and that is precisely what has state legislatures alarmed. Nearly 100 chatbot-specific bills were introduced across 34 states this year. California banned companion chatbots in children's toys on 10 September and strengthened its chatbot safety law the same day. Connecticut's AI act takes effect on 1 October. Here is what those laws are reacting to, what happens to what you say, and how to use these tools without leaving a transcript of your life behind.

Where does a conversation go?

It depends on the service and your settings, but the default in many consumer products is some combination of the following. The conversation is stored on the provider's servers, often indefinitely unless you delete it. It may be reviewed by humans for quality or safety purposes. It may be used to train future models, meaning fragments of what you said can shape what the system says to others. And in some configurations it is shared with third parties for analytics or, in the case of companion apps, monetization.

The privacy policy governs all of this, and almost nobody reads it. The practical assumption to hold is that what you type is retained until proven otherwise.

Why are states suddenly legislating this?

Because the harms started arriving before the rules did. The legislative wave has three main concerns:

• Minors and emotional dependence. California's SB 243, in force since January, imposed safety requirements on companion chatbots that simulate human relationships, with a private right of action. SB 1119, known as Adam's Law and signed 10 September, strengthened those protections for minors. A separate law signed the same day bans toys containing companion chatbots outright. Colorado's Chatbot Safety Act adds age assurance, persistent AI disclosure, protections against simulated emotional dependence, and suicide and self-harm response protocols.
• Disclosure. A growing number of laws require that you be told, clearly and repeatedly, that you are talking to a machine. Connecticut's Artificial Intelligence Responsibility and Transparency Act, with provisions taking effect from 1 October 2026, is among them.
• Data. What is collected during conversations, how long it is kept, and who it goes to, which is where chatbot laws start to overlap with general privacy law.

The picture is a patchwork rather than a national rule. Depending on your state, a chatbot company may face strict obligations or almost none, which is the same fragmentation covered in does the US have a federal data privacy law.

What makes chatbot data different from search data?

Volume and candour. A search query is a few words. A chat is paragraphs, over multiple sessions, in a register people reserve for friends. Users describe symptoms, paste emails, share names of colleagues and family members, and ask for advice on situations involving other people who never consented to being discussed. A conversation log is therefore a far richer profile than a search history, and it frequently contains information about third parties.

That last point matters. When you paste a message thread or describe a dispute, you are handing over data about someone else. The chatbot company now holds it, and that person has no idea.

Can a chatbot be compelled to hand over your chats?

Yes. Stored conversations are records held by a company, and like any records they can be subject to legal process, breach, or internal misuse. Providers have also faced litigation and regulatory inquiries that involved preserving user conversations. The question we explored in can ChatGPT report you to the FBI has the same underlying answer: the data exists, and existing data can be reached.

How do I use these tools without oversharing?

1. Turn off training on your data where the setting exists. Most major services now offer it, and it is usually off by default in the wrong direction.
2. Use temporary or incognito chat modes for anything sensitive, and delete history you do not need.
3. Never paste identifiers. Social Security numbers, account numbers, passwords, addresses and full names of other people do not belong in a prompt.
4. Anonymize before you ask. You can get useful advice about a situation without naming the people in it.
5. Treat companion apps with extra care, since their business model often depends on the intimacy of what you share.

Where does removal fit?

Being direct: removing your people-search listings does nothing about a chat log sitting on an AI company's servers. That is a different system, controlled by your settings and the company's policies, and the honest fix is the list above.

The connection is narrower and real. A chat log becomes far more consequential when it can be joined to a verified identity: a name, an address, a household. That join is what public listings provide, to anyone, and it is the reason a fragment of conversation can be tied to a specific person rather than an anonymous user. Reducing that public layer does not delete a transcript. It makes the transcript harder to attach to you, and it addresses the exposures that exist whether or not you ever use a chatbot. Those listings rebuild from public records, so it needs maintaining. Consumer Reports found that opt-outs done by hand or by automation cleared roughly 27 percent of exposed listings, while removals handled by real people who monitor and refile reached about 70 percent.

Frequently asked questions

Are my ChatGPT conversations private?

They are stored by the provider and may be used for training unless you turn that off, and they can be subject to legal process like any company records. Private in the sense of not being public, yes. Private in the sense of existing only for you, no.

Does deleting a chat actually delete it?

It removes it from your visible history, and most providers commit to deleting it from their systems after a retention window. Anything already incorporated into model training cannot be extracted, and copies preserved for legal reasons may persist.

Is it safe for my child to use an AI companion app?

Several states have concluded the risks are serious enough to legislate, particularly around emotional dependence and self-harm. Check whether the app complies with your state's chatbot rules, review its data practices, and treat it as something to supervise rather than hand over.

Does a chatbot know who I am?

If you are logged in, the account identifies you. Beyond that, what you type is what it knows. The larger risk is what can be inferred by combining your conversations with the public data about you that exists elsewhere.