Custody, not hacking, is what puts these prompts at risk. A prompt typed into a consumer account sits on the vendor's servers under the vendor's retention schedule, and the vendor is the party that receives the subpoena or the preservation order. In two of the cases Malwarebytes summarized from the Washington Post reporting, the user opened the door himself: a student who had asked ChatGPT whether anyone would work out that he damaged 17 cars in a campus lot then consented to a police search of his phone [6], and a teenager suing large technology firms over social media addiction saw his own ChatGPT history pulled into discovery [7]. No adversary had to breach anything. And unlike a conversation with counsel or a physician, none of it carries privilege [5].
Retention promises are the weaker link. In the New York Times copyright case against OpenAI, a judge ordered the company to preserve chat logs, including logs users had asked it to erase [8]. OpenAI said users were "forced to forgo the privacy protections OpenAI has painstakingly put in place" [9], and it kept the data despite having agreed to delete it under GDPR and California privacy law [10]. That is an operational fact: a deletion right you rely on can be suspended by a hold in litigation you are not party to.
Now the scale. Twelve cited cases across 24 months is roughly one surfacing every two months [17], which is small, and worth saying plainly. The disclosure line is the one that moves. More than 80 accounts' content disclosed in the last six months of 2025 [3] is about 13 accounts a month, against roughly 3 a month in the second half of 2024 [18], since the reported figure was more than four times the earlier period [4] and implies something near 20 accounts then [16]. Both numbers reach us through the Post's reporting rather than an audited transparency report [2], so treat them as a trend line, not a census.
The trend has precedent in older data types. Google, Meta and Apple handed over details of 3.16 million US accounts between 2014 and 2024, rising year over year [13]. Police subpoenaed Amazon Echo audio in a 2019 Florida murder case [14]. Facebook gave prosecutors a mother and daughter's private messages in a 2022 abortion investigation [15]. Each new store gets discovered once litigants learn it exists.
There is also a path that skips legal process. OpenAI's policy lets reviewers refer conversations to law enforcement when they see an "imminent and credible risk of harm to others" [11], and the company contacted police over a Palm Beach County user who repeatedly described plans to harm an ex-girlfriend [12]. That trigger is the vendor's judgment, on the vendor's timetable, with no notice to an employer.
The cheap controls are contractual and clerical. Put chatbot use on an enterprise tenancy with stated retention and hold handling, name prompts in the records schedule, and train responders to keep incident detail out of personal accounts. That costs a procurement cycle, and it is far cheaper than the alternative: reconstructing who typed what into a chatbot after a hold has already landed, which costs a discovery fight.
