In May 2025, OpenAI’s data retention practices moved from a niche legal topic to a board-level risk when U.S. Magistrate Judge Ona Wang ordered the company to preserve every ChatGPT conversation. This includes consumer chats, “Temporary Chat” sessions that once disappeared upon closing, and even API traffic that enterprise clients were previously assured would never be stored.
The order remains in effect “until further order of the Court,” so no one knows when it will expire. For corporate leaders, that single sentence transforms a technical discovery dispute into a sweeping governance and compliance challenge.
Judge's Reasoning
Judge Wang explained that without a judicial “litigation hold,” OpenAI would, in her words, “never stop deleting” evidence relevant to The New York Times’ copyright lawsuit. The Times asserts that some users feed paywalled articles into ChatGPT or ask it to regenerate them verbatim, then delete the chat to hide the evidence.
Because OpenAI’s own design allows users to remove past conversations, and because it could have anonymized or segregated logs but chose not to, the judge concluded that immediate, system-wide preservation was the only sure way to prevent spoliation of evidence.
Reactions
Plaintiffs describe the hold as routine. Courts often freeze potential evidence once litigation begins. OpenAI counters that this order is “rushed, premature, sweeping, unprecedented, and unlawful.” Neutral commentators agree that the breadth is extraordinary. A normal litigation hold targets material that is plausibly relevant, not an entire global service.
Several litigators predict an appeal could narrow or pause the mandate, but such relief is uncertain and slow. Meanwhile, the order is in effect, and compliance is mandatory.
Reality Collision With Promises/Privacy Laws
That reality collides with existing promises and privacy laws. OpenAI’s API contracts reassure customers that conversation data will not be stored and will not be used to train models. The preservation order overrides those terms, creating potential breach of contract exposure on one side and contempt of court exposure on the other.
Across the Atlantic, the General Data Protection Regulation permits retention when “required for ongoing legal claims,” yet European Union regulators also reserve the right to impose fines – up to four percent of global revenue – if a company retains personal data longer than “necessary.”
Historically, U.S. courts give little weight to foreign privacy objections when issuing discovery orders. Multinational customers now face a patchwork of conflicting obligations, with no safe harbor in sight.
Privacy Risks Details
Privacy risk increases with the amount of data collected. ChatGPT is not a benign homework helper. Users submit wedding vows, tax questions, confidential research and development notes, and privileged legal drafts. Enterprises choose OpenAI’s API specifically to keep that content out of persistent logs.
For many, the assumption of ephemerality is embedded in risk assessments, client contracts, and, in healthcare, HIPAA compliance programs.
When the court suddenly mandates indefinite retention, those carefully modeled controls are nullified. Security teams now warn that every prompt may be discoverable, every trade secret vulnerable to subpoena, and every regional privacy promise subject to challenge.
OpenAI's Arguments Against the Order
OpenAI argues that the court’s concerns are speculative. The company asserts it has not destroyed logs in anticipation of litigation and doubts that copyright infringers are more likely than ordinary users to delete chats. It also stresses that API data is already managed under strict retention limits and cannot be purged simply because an end user presses “delete.”
Above all, OpenAI claims the order forces it to abandon public commitments to user autonomy and “go to great lengths” to engineer new, expensive storage pipelines whose only purpose is to satisfy a judicial hunch. The company states these engineering efforts will consume months and millions of dollars, harming user trust while offering plaintiffs only a marginal benefit.
Deeper AI Training Controversies
The dispute touches deeper controversies about
Opponents argue that artificial intelligence companies want to exploit the content commons for free while locking down their own outputs under copyright. Within that ideological standoff, the preservation order appears to some as a blunt but necessary investigative tool. To others, it is a punitive overreach that chills innovation more than it protects creators.
Market Reactions
Several companies paused OpenAI integrations the week the order was issued. Healthcare providers questioned HIPAA implications. Financial institutions reopened vendor risk reviews. Software-as-a-service developers revised privacy policies.
Microsoft’s Azure-hosted OpenAI instances might fall outside the scope of the order – sources disagree – but the uncertainty alone pushes risk-averse clients toward alternative vendors. Competitors such as Mistral and DeepSeek promote either more limited logging or European Union hosting. Even Google Gemini, which almost certainly retains data, can position itself as less exposed to U.S. discovery because Google, rather than an independent startup, absorbs the legal risk.
Executive Actions Needed
For executive teams, the practical issue is not whether the court’s decision is philosophically correct but how to protect corporate interests while the legal situation evolves. Five actions merit immediate attention:
Map exposure. Inventory every workflow, product, and third-party tool that routes data through ChatGPT or the OpenAI API. Flag any that handle personal, regulated, or contractually confidential content.
Review contracts and privacy notices. Where service agreements promise “no retention” or “user-controlled deletion,” prepare addenda or client communications that explain the new legal constraint and outline compensating safeguards.
Segment data flows. If possible, separate U.S. traffic from European Union or other region traffic. Some firms are already building geo-fenced deployments or shifting sensitive workloads to on-premises models.
Implement encryption under neutral control. One compromise is encrypting preserved logs with a key held by the court or a third-party escrow agent. This approach preserves evidence while limiting unnecessary access.
Monitor appellate developments. If higher courts narrow the hold, rapid rollback will depend on how flexibly logging changes were implemented. If the order stands, prepare for it to become the new baseline in U.S. litigation involving artificial intelligence services.
Strategic Implications
Strategically, the episode signals a broader trend. As artificial intelligence systems move from novelty to critical infrastructure, courts and regulators are willing to impose obligations once reserved for telecommunications carriers or health record custodians. The gap between U.S. discovery rules and European Union privacy principles is widening, not narrowing, and global enterprises must design data strategies that comply with both regimes. Encryption, localization, and vendor diversification are no longer optional but essential risk mitigations at the board level.
Leadership should frame the conversation internally as a governance challenge, not just a technology team issue. Legal, security, compliance, and product groups need a unified playbook. Employees should be reminded that content provided to generative artificial intelligence tools may be preserved indefinitely and become part of litigation they never anticipated. Clients deserve transparent explanations of how their data is handled today and what safeguards will protect it in the future.
The preservation order may be narrowed on appeal, but the precedent is set. When artificial intelligence meets discovery, courts can and will demand the full data record. Whether that outcome is deemed sensible or excessive, every business that relies on ChatGPT-class tools must plan for a world where deletion is a promise that a judge can revoke overnight.