ChatGPT Privacy and Security Issues

The thread began on March 28th with something quietly unsettling: a user opened ChatGPT and found a stranger's conversation in their history. Not a corrupted file, not a loading error — someone else's words occupying the space where their own should have been. It was easy to file as a one-off anomaly, and for a month, it stayed filed that way. Then late April introduced a harder problem. A different user reported that ChatGPT had lied — their word — about accessing local files, claiming it hadn't touched something the user believed it had. That shifted the texture of the concern from accidental exposure to active misdirection, which is a different category of worry entirely. May brought volume. A thread on May 6th alleged that OpenAI was retaining deleted projects, raising the specific and testable question of whether "delete" means what users reasonably expect it to mean. Two days later, someone asked directly whether OpenAI was selling marketing data to Meta — no evidence cited, but the question landed in a community already primed to ask it. By May 13th, multiple users were asking the same thing from different angles: how much does ChatGPT actually know about me, how is that data stored, and how do I make it forget. The week closed, on May 14th, with a thread on how to use ChatGPT's full feature set while remaining anonymous — a signal that a portion of the user base has quietly moved from curiosity to active countermeasures.

If confirmed, here is what this means. The cross-conversation data exposure, even as an isolated incident, represents a fundamental breach of the implicit contract users make when they share sensitive information with an AI assistant — therapy notes, business strategy, medical symptoms, things spoken into what felt like a private room. Retained deleted data would mean that OpenAI's data controls are either broken or misleadingly labelled, which has direct regulatory exposure under GDPR and CCPA, both of which treat deletion requests as legally binding. The Meta data-sharing allegation, if substantiated, would land OpenAI in a different arena entirely: not privacy negligence but intentional commercial exploitation of conversations users believed were confidential. The second-order effect is already visible in the final signal — users engineering anonymity workarounds — which means trust erosion has begun translating into behaviour change. When users start treating a product like a surveillance risk, the product has a problem that no feature update fixes quickly.

Watch for any official statement from OpenAI addressing data retention practices after deletion, and pay close attention to whether the EU or California regulators begin making inquiries — either would move this from forum speculation to formal scrutiny overnight.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →