AI News · Edition 87 ·
Your staff's AI chats may not be as private as you think
Paid personal AI accounts may still feed training data. Also: AI finds 948 Linux security flaws, and why updating your systems matters more now.
The one that matters
Paying for a personal Gemini plan may not keep your business chats out of AI training
A post with more than 600 upvotes on Hacker News makes a simple claim. Hacker News is the forum where much of the software industry argues about these things. The post says Google's Gemini uses people's chat history to train its AI, and that paying for a subscription on a personal account doesn't change this. The claim is specifically about personal accounts. It is not about company accounts run through an organisation. Right now this is one user's report, not a statement from Google, so treat the details with care. The main point won't surprise anyone who reads AI terms of service closely. Consumer AI products and business AI products usually come with different privacy promises, and the price you pay doesn't decide which one you get. The type of account does.
What this means for your business
Think about who in your organisation actually types into AI tools. In a 600-student school, it is often the office administrator drafting fee reminders that include parents' names and phone numbers. Or it's a teacher pasting in a student's marks to write report-card comments. In a 30-bed clinic, it might be a receptionist asking an assistant to tidy up a discharge summary. In a 40-person workshop, it is the sales manager pasting a customer's specifications and your quoted price to get a cleaner email.
If those people use their own personal accounts, even paid ones, that information may be leaving your control. It could end up in a training system you have no agreement with. For student and patient records, that's more than awkward. India's Digital Personal Data Protection Act and Canada's privacy laws, including provincial health-information rules, hold the organisation that collected the data responsible. Which app a staff member happened to pick is not an excuse.
What it does NOT mean
It does not mean your chats are being published. The realistic risk is not that a stranger types a question and gets your patient's file back word for word. The real issue is control. Once your data is in someone else's training pipeline, you can't say where it went or how long it will be kept. It also does not mean every AI tool is unsafe, or that you should ban AI at work. Staff who are told no usually keep using it quietly on their phones, which is worse. Be sceptical of the loudest online reactions that call this proof all AI is a privacy trap. Be just as wary of anyone who uses stories like this to sell you a “private AI server” costing several lakh rupees. For most small organisations, the fix is a settings change and the right kind of account, not new hardware.
What to do this month
- Ask, don't assume. Spend 15 minutes asking staff which AI tools they use for work, and on which account. Many owners are surprised by the answer.
- Check the settings yourself. The major consumer AI tools have history or “improve the model” settings. Look at them on every tool your staff use. Don't rely on a forum post or a salesperson.
- Move sensitive work to business accounts. Business plans from the major AI vendors generally come with written commitments about how your data is used. Read the actual terms before you buy. Expect to pay roughly ₹500 to ₹2,500, or about C$10 to C$40, per person per month. You only need seats for the people who handle sensitive records. A school might need four seats, not sixty.
- Write a one-page rule. No student names, patient details, Aadhaar numbers, SINs or health card numbers in any personal AI account. Pin it where people will see it.
None of this needs a consultant. It takes one afternoon and one clear rule, which is more than most businesses have today.
Also worth knowing
How this briefing is put together
Every morning we read the day’s AI announcements and reporting from the companies themselves and from the technology press, then pick the handful that actually change something for a working business. The analysis is ours and it is written for owners and managers, not engineers. Every story links to its original source — read them, and disagree with us where we’ve got it wrong.