Consumer ChatGPT vs API Access
Why the Same Model Has Two Privacy Regimes

Published July 31, 2026 · Facts last verified July 31, 2026

This article is general information, not legal advice. Data protection law and vendor terms move quickly, and the correct answer for a regulated organisation depends on facts this page cannot know. For your own situation, consult a qualified lawyer or your compliance officer. Your use of Secret Chat is governed by our Terms of Service and Disclaimers.

Two people ask an AI model the same question, in the same minute, and get answers from the identical set of weights running in the identical data centre.

One of them typed it into the ChatGPT app. The other sent it to the API from a script. Their conversation with the model was the same. What happened to the words afterwards was not: one of those requests may be used to train future models, is stored under a named account, is remembered in the next conversation, and was swept into a federal preservation order in 2025. The other was none of those things.

This surprises people because we instinctively locate privacy in the model — as though GPT or Claude were a thing with a policy. It isn't. The model is a file of numbers that computes an answer and forgets. Everything that happens to your words before and after that computation is decided by the account, the contract and the product surface wrapped around it. Privacy is a property of the wrapper, not the weights.

This article is about where the two wrappers actually diverge, why the split exists at all, and — the part usually skipped — where the popular advice "just use the API" quietly overstates what you get.

What Is Genuinely Identical

Start with the part that does not change, because it disciplines everything else.

The model is the same. The weights are the same, the safety training is the same, the refusals are the same. There is no "private edition" of a frontier model that redacts your sentences before reading them — the model has to read the prompt to answer it, in every tier, on every plan.

And in both regimes, your text leaves your machine. It travels to the provider's infrastructure and is loaded into memory on hardware you don't control, in a building whose country has courts. Nothing on this page changes that. Everything on this page is about what may be kept, linked, learned from and compelled afterwards.

The Two Regimes, Side by Side

Here is the shape of the divergence for OpenAI's products. The pattern repeats at other providers with different names — see below.

Read the last row twice. It is the one that breaks the comfortable version of this story, and we come back to it.

Why the Split Exists (It Is Not Generosity)

The two regimes are not a privacy policy applied inconsistently. They are two different businesses that happen to share a model.

The consumer app is a product, and products are supposed to know you. History, memory, personalisation, cross-device sync, "continue where you left off" — every one of those features is accumulation by definition. A chatbot that remembered nothing would be a worse consumer product, and the same data that makes it feel personal is also the most valuable training corpus in existence: real people asking real questions in their own words, with the follow-ups that show whether the answer worked. Consumer defaults point at collection because collection is what makes the product good and what improves the next model.

The API is a component sold to businesses, and businesses have to make promises of their own. A company embedding a model in its own product cannot resell a service that trains on its customers' data — its own contracts forbid it. So the API's defaults are inverted at the point of sale: no training, a bounded retention window, a data processing agreement, and a zero-retention path for customers who need one. That is not the provider being kinder to developers. It is the provider meeting the minimum terms on which a business will buy at all.

The practical consequence is worth stating plainly: the consumer tier is the tier with no negotiating counterparty. An enterprise buyer redlines the contract. An individual clicks "I agree".

Training: The Sharpest Line

This is the divergence that most people already half-know, and it is the one that genuinely is close to binary.

On the API, OpenAI's developer documentation is unambiguous: "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." Note the shape of that sentence — training is off, and turning it on is the affirmative act.

On consumer ChatGPT the polarity is reversed. Conversations may be used to improve the models unless you go to Settings → Data Controls and switch off "Improve the model for everyone." The switch works, and it is worth flipping. What it does not do is undo anything: opting out is future-only, it does not delete your history, and it does not stop retention or safety review. Our master guide to opting out of AI training walks every major platform's version of this switch and the limits they all share.

So on training, the honest summary is: the API's default is what the consumer tier's opt-out is trying to reach — and the API gets there by contract rather than by a toggle you have to remember to keep flipped on every account you own.

Identity: The Difference Nobody Reads the Docs For

Training is the famous difference. Identity is the bigger one.

A consumer account is an identity. It has your email, usually a phone number, a payment method, a device fingerprint, an IP history, and — increasingly — a memory file summarising what the model has learned about you across every conversation you have ever had with it. That is not a side effect of the chats; it is the product's spine. Everything you type lands in a record that already knows who you are, and the record grows. We wrote about the compounding version of that problem in AI memory as a privacy time bomb, and about the second record that forms beside your prompts in what your prompts reveal about you.

An API request carries no such thing. There is no account page, no history tab, no memory. The request arrives with an API key belonging to an organisation, and the conversation is only as long as whatever the caller chose to send in that one request. Statelessness is the default; state is something a developer opts into, and on OpenAI's Responses API it is literally a parameter (store) with a bounded retention period attached.

Which is why the popular advice needs a correction:

The API does not anonymise you. It re-addresses the record. The billing entity behind that key is a real, named, payment-verified party. If you are an individual using your own key, the organisation is you — you have swapped a chat history under your name for an API log under your company's name, gained the training and retention benefits, and gained no anonymity whatsoever. And if you are a business piping your users' messages through your key, you have not made those users anonymous either; you have made yourself the party responsible for them.

That is the whole reason a gateway in the middle is a different proposition from a key in your own hand, and we come back to it at the end.

Retention: A Gradient, Not a Switch

"The API doesn't keep anything" is the most common overstatement in this area. What the API actually offers is a ladder, and the rungs matter.

• Default API use. Abuse-monitoring logs are generated and kept for up to 30 days, longer where the law requires it or where it is reasonably necessary to prevent harm. Separately, "application state" is retained per endpoint: the Responses API stores for 30 days by default, while stateful constructs such as assistants, threads and vector stores persist until you delete them. A developer who never thought about this is storing more than they assume.
• Zero Data Retention (ZDR). Available to approved customers on eligible endpoints only. Content is excluded from abuse-monitoring logs, and the store parameter is forced to false even if a request asks for storage. Endpoints that exist to hold state — assistants, threads, vector stores — cannot participate at all, which is a nice illustration of the underlying rule: you cannot have zero retention and a memory feature. They are the same feature with opposite signs.
• The exception inside the exception. Even under ZDR, OpenAI reserves the right to retain and human-review customer content where reasonably necessary to investigate or prevent severe-risk activity. This is not a loophole so much as an honest admission: no commercial tier is an absolute promise, and any vendor claiming otherwise is describing marketing rather than terms.

On the consumer side the ladder has fewer rungs. Deleted conversations are purged within about 30 days; Temporary Chat is deleted within about 30 days and stays out of history, memory and training — with the same safety-and-legal carve-out attached. There is no consumer equivalent of ZDR, because there is no consumer product that would still work with it. We took Temporary Chat's fine print apart separately in the fine print of temporary chats, and the wider question of what ChatGPT keeps in does ChatGPT store your conversations?

The Legal Regime Changes Too — and This Is Underrated

Move between the tiers and you do not just change settings. You change who the law thinks is in charge.

Under the GDPR, the controller decides why and how personal data is processed; the processor acts on the controller's documented instructions. Roles follow actual conduct, not labels — a terms page cannot assign them by declaration. On consumer AI products the provider is normally the controller: it sets the purposes, including improving its own models. On business and API tiers it is usually a processor acting for the customer, under an Article 28 contract that must cover documented instructions, confidentiality, security, sub-processors, assistance with data-subject rights, and deletion or return at the end of the service.

Three consequences fall out of that, and they are the ones people miss:

• Your erasure request goes somewhere different. Consumer tier: you ask the provider. API tier: the requests of the people whose data flows through a key go to the customer, not to the model provider — the provider deletes on instruction. (What erasure can and cannot reach inside a trained model is its own problem, covered in the right to erasure and AI chatbots.)
• Consumer tiers generally cannot execute a DPA at all. That is the real shape of "shadow AI" risk inside companies: not a dramatic leak, but a processing relationship that legally does not exist, discovered during an audit. The alphabet of contracts and attestations — and what each one actually covers — is in SOC 2, BAAs and DPAs explained.
• A processor that starts deciding purposes becomes a controller for that processing (Article 28(10)) — which is exactly what training general models on customer content would be. That is the legal reason the API's no-training default and the processor role travel together. They are the same commitment stated twice.

The Court Order That Proved the Point

All of the above is contract and configuration, which is easy to dismiss as paperwork. In 2025 the distinction stopped being paperwork.

In The New York Times v. OpenAI in the Southern District of New York, Magistrate Judge Ona T. Wang ordered OpenAI on 13 May 2025 to preserve and segregate output log data that would otherwise have been deleted — including data subject to user deletion requests and statutory erasure rights. In plain terms: for the accounts in scope, the delete button stopped meaning deletion, and no user was asked.

What was in scope is the part that matters here. By OpenAI's own account, the order reached ChatGPT Free, Plus, Pro and Team, and standard API traffic. It did not reach ChatGPT Enterprise or Edu, and it did not reach API customers operating under a zero-data-retention amendment — for the simple reason that content which was never stored cannot be preserved.

The order's later history matters too. Under a stipulated modification approved on 9 October 2025, OpenAI's ongoing preservation duty ended as of 26 September 2025: already-segregated logs stay preserved, requests originating in the EEA, Switzerland and the UK were excluded, and narrower account-specific preservation continued. Separately, on 5 January 2026 Judge Sidney Stein affirmed the order compelling production of a de-identified sample of 20 million conversation logs to the plaintiffs' legal team; the first tranche was handed over that month. The people in that sample were not notified and had no opportunity to object.

Three lessons, in order of how often they are missed:

1. The tier you were on decided what happened to your deleted chats. Not the model, not the prompt, not the sensitivity of the subject. A contractual distinction became a factual one about whether your data still exists.
2. The standard API was swept in too. This is the row to read twice. The API's advantage over the consumer app was about training and identity — it was never immunity from legal process. Only the zero-retention configuration was structurally out of reach, and it was out of reach because of physics rather than privilege: there was nothing on disk to hold.
3. You can be affected without being a party. Nobody in that 20-million-log sample was suing anyone. A legal hold placed on a company reaches through to everyone whose data that company holds — which is the general lesson of how AI chats get subpoenaed.

It Is Not Just OpenAI

The two-regime pattern is an industry structure, not one company's choice, because the two customer bases want opposite things everywhere.

Anthropic. Consumer Claude has a model-improvement setting that governs both whether chats train future models and how long they are kept, with Incognito chats excluded from improvement and safety-flagged conversations analysed regardless. On the commercial side the terms state flatly that Anthropic "may not train models on Customer Content from Services." Details in does Claude store your conversations?

Google. The consumer Gemini app keeps activity and can route a subset of conversations to human review by default; the paid API, Vertex AI and Workspace sit under different terms that do not train on your content. See does Gemini read your data?

xAI and Perplexity. Same shape — a consumer surface with training on by default and a settings toggle, alongside API terms that do not train on developer traffic. See does Grok save your chats? and does Perplexity track you?

If you take one structural fact away from this section: the free consumer tier is the training tier at essentially every major provider, and it is not a coincidence that it is also the tier without a contract.

So Should You Just Use the API?

For sensitive material, API-tier terms are better terms. But the advice is usually given as though switching endpoints were a privacy fix in itself, and there are four reasons it isn't.

• You still have a named account. The key belongs to a billing entity. You have changed whose name is on the record, not whether there is a name on it.
• You have to configure it. No-training is a default; low retention is not automatically. Stateful endpoints keep data until deleted, and ZDR requires approval and eligible endpoints. An unconfigured API integration is not a private one.
• You lose the product. No apps, no history, no file handling, no memory, no interface — unless you build them. Most people who "switch to the API" end up using a third-party client, which means their data now passes through a fourth party whose terms they haven't read.
• It was never immunity. The preservation order reached standard API traffic exactly as it reached consumer chats.

The useful reframing is that there are two independent questions, and the tier answers only one of them cleanly:

1. Will this be learned from and kept? — a contract question. The API answers it well.
2. Whose name is on it? — an identity question. The API does not answer it at all.

Where Secret Chat Sits

Secret Chat AI reaches the leading models through their business APIs, on your behalf. That means you get the API regime by default — the tier whose terms say your traffic is not used to train models, without you administering a key, negotiating anything, or maintaining a training toggle on a dozen consumer accounts.

But the tier is only the first question. The second one — whose name is on the record — is the one this product is actually built for. Requests leave our servers under our credentials. Whatever a model provider holds under its own terms and configuration, the record on that side carries our gateway's address and account, not your name, your account or your IP. You use the model as a stranger.

• No profile of you. Registration takes an email, used only for account access and payment — never to store or associate your prompts with you. No name, no phone number, no behavioural profile assembled across your chats.
• No chat associated with you. Your prompt reaches the model without an identity attached, so even where retention applies at the provider, it is not linked to you.
• Nothing kept under your name here. Chats live in your own browser, and a prompt exists on our side only for as long as it takes to fetch your answer — there is no stored chat archive on our servers. Each deletion request comes back with a per-message Session Privacy Report.
• No training on your queries. Not as a setting you have to find. As the arrangement.

Two honest boundaries, because this article has spent 2,000 words insisting on precision.

First, "anonymously" describes the link, not the words. Secret Chat AI is an anonymizer, not a content filter — it removes you from your queries, it does not remove the data from your messages. Your prompt reaches the provider verbatim, because the model has to read it to answer it. Write your own name or a case number into a message and it is all still sitting there in the message. Redacting identifying details before sending remains your job.

Second, anonymity is not privilege, not a legal exemption, and not a way to put anything beyond a court's reach. If you are under a duty to preserve material, the tool you used does not alter it. What unlinkability changes is the ordinary case — the profile that would otherwise be built, and the association that would otherwise be made — not the extraordinary one.

Frequently Asked Questions

1. Is the model itself different on the API?

   No. The same model versions are served in both regimes. What differs is everything around the model call: whether your content may train future models, what is retained and for how long, whether the record is attached to a personal account, and which contract governs it.

2. Does using the API make me anonymous to OpenAI?

   No. An API request carries an API key belonging to a real, payment-verified organisation. If you use your own key, that organisation is you. The API removes chat history and training from the picture; it does not remove your name from the account behind the request.

3. Did the New York Times court order affect API users?

   Yes — standard API traffic was in scope alongside ChatGPT Free, Plus, Pro and Team. ChatGPT Enterprise and Edu, and API customers under a zero-data-retention amendment, were not affected. The ongoing preservation duty ended as of 26 September 2025 under a stipulated order approved on 9 October 2025, but logs already segregated remain preserved.

4. Is the API's zero-data-retention option an absolute guarantee?

   No. It is a strong configuration — content is excluded from abuse-monitoring logs and server-side storage is forced off — but it is available only to approved customers on eligible endpoints, stateful endpoints cannot use it, and the provider reserves the right to retain and human-review content when investigating severe-risk activity.

5. What is the simplest way to get API-tier terms without running an API key?

   Use a service that reaches the models through their business APIs on your behalf. Secret Chat AI does exactly that, and adds the part the API tier does not provide by itself: no identity travels with the request, so nothing is profiled or associated with you. It is an anonymizer, not a content filter, so keep identifying details out of the prompt.

Conclusion

The same model, reached two ways, sits inside two different legal and commercial machines. One is a consumer product built to know you, whose defaults point at collection because that is what makes it a good product. The other is a component sold to buyers who can refuse the terms, whose defaults are inverted because refusal is a real option. Neither of those facts is about the technology.

So when you next read that some AI tool is "private", the useful question is not which model it runs. It is: which regime am I in, what does my content do after the answer arrives, and whose name is on the record when someone comes asking? The first two are answered by a contract. The third is answered by architecture — and it is the one that keeps mattering long after the toggles have been flipped.

Sources

• OpenAI — Data controls in the OpenAI platform (API training, retention, ZDR)
• OpenAI — API data usage policies
• OpenAI — Data Controls FAQ (consumer)
• OpenAI — How we're responding to The New York Times' data demands
• Duane Morris — New York federal court's OpenAI discovery orders
• Engadget — OpenAI no longer has to preserve all of its ChatGPT data
• Anthropic — Commercial Terms of Service
• Anthropic — Is my data used for model training? (consumer)
• GDPR — Regulation (EU) 2016/679 (Articles 4, 17, 28)