OpenAI Contractors Read Real ChatGPT Conversations
404 Media reports that contractors working on an OpenAI project reviewed full, real ChatGPT conversations to rate model behaviour. OpenAI's published consumer policy already says a limited number of authorized personnel and trusted service providers may access content for model improvement unless the user opts out. Turning off model training affects future chats, while Temporary Chat is excluded from training.
On this page
What the Project Lily report says
Contractors reviewed full conversations from consumer ChatGPT users as part of an internal effort known as Project Lily, according to documents and prompts obtained by 404 Media. The reviewers rated responses and examined behaviours such as sycophancy and the model presenting itself too much like a person.
The report says hundreds of contractors participated and that usernames were not shown beside the conversations. It also says OpenAI attempted to remove personal information before review, while acknowledging that sensitive details could still pass through those filters. These are findings from 404 Media's reporting, not a newly announced OpenAI product or a claim that every ChatGPT conversation is read by a person.
The distinction matters. Human review is often discussed as an abstract part of model training. Full conversational context can include health questions, workplace material, relationship details, or fragments of identifying information that remain understandable even after a username is removed.
OpenAI's policy already allows limited human access
OpenAI's consumer data FAQ says a limited number of authorized employees and trusted service providers may access user content when needed to investigate abuse or security incidents, provide support, handle legal matters, or improve model performance when the user has not opted out. The company says access is controlled, logged, and limited to people who need it.
Its model-improvement policy separately states that content from consumer services such as ChatGPT may be used to train models unless the user changes the relevant setting. Business products and the API are different: OpenAI says data from those services is not used for training by default.
Project Lily therefore adds detail about the apparent scale and workflow of human evaluation. It does not reveal a completely absent policy. The privacy lesson is that de-identification reduces one risk but does not create the same boundary as encryption that the provider cannot unlock or inference performed entirely on your own device.
How to stop future chats being used for training
In ChatGPT, open Settings, choose Data Controls, and turn off “Improve the model for everyone.” OpenAI says the setting applies across the account and prevents new conversations from being used to train its models. It does not retroactively change conversations already submitted under the earlier setting.
Temporary Chat adds a stronger default for one-off sensitive questions. Those conversations do not appear in history and are not used for model training. OpenAI says it may retain a copy for up to 30 days for safety purposes, and Temporary Chats may be reviewed only to monitor abuse. Custom GPT actions can still send data to third parties under their own policies.
Neither option is permission to paste secrets. Avoid entering passwords, private keys, unreleased customer records, confidential legal material, or anything you would not want retained during an abuse investigation. For organizational use, confirm the workspace or API contract rather than assuming consumer controls apply.
What local AI changes
A local model removes the model provider and its review contractors from the ordinary inference path. When the model, conversation database, and retrieval index all stay on your hardware, the provider has no server-side chat log to sample for training. That is a structural privacy difference, not merely another settings toggle.
Local apps can still leak data through analytics, crash reporting, cloud backups, web search, remote tools, or optional cloud-model fallbacks. The practical check is end to end: identify where the prompt goes, where history is stored, which integrations receive text, and whether a person at any provider is allowed to access it.
For ChatGPT users, the immediate action is simple: inspect Data Controls today, use Temporary Chat when appropriate, and treat de-identification as risk reduction rather than confidentiality. For genuinely sensitive work, use an approved business environment or a local stack whose network behaviour you have verified.