Discovery Exposure: What the Courts Have Established
1The Heppner privilege ruling answers one question: do consumer AI interactions carry attorney-client privilege? The answer is no. A separate and parallel line of cases in the same courthouse answers a different question: are consumer AI conversation logs discoverable? Courts have established that they are.
2The two lines of cases converge on a single point. Consumer AI platform interactions are not private in any legally cognizable sense. They exist. They are retained. Courts have demonstrated willingness to order their production. Whether any specific individual's interactions are reachable in any specific proceeding depends on conditions that vary by case.
The OpenAI Data Retention Orders
Case: In re OpenAI Copyright Infringement Litigation
3The New York Times filed a copyright infringement lawsuit against OpenAI and Microsoft on December 27, 2023, alleging that OpenAI used millions of Times articles without authorization to train its language models. The case was consolidated with 15 other copyright lawsuits into a multidistrict litigation in the Southern District of New York.
4In the course of discovery, the Times sought access to ChatGPT conversation logs to support its infringement claims. What followed established new ground for AI data governance.
5U.S. Magistrate Judge Ona T. Wang issued a preservation order requiring OpenAI to preserve and segregate all output log data that would otherwise be deleted, including conversations users had already deleted and conversations OpenAI was required to delete under GDPR and other privacy laws.
6OpenAI had been deleting user conversations within 30 days of deletion requests under its standard privacy policies. The preservation order overrode those commitments. ChatGPT Free, Plus, Pro, and Team users were covered. ChatGPT Enterprise and users with Zero Data Retention agreements were excluded.
7OpenAI estimated it held tens of billions of conversation logs. The company challenged the order, arguing it violated user privacy commitments and conflicted with international data protection law.
8District Judge Sidney H. Stein heard oral argument and denied OpenAI's objections. His reasoning on user privacy is significant for the Heppner analysis. Judge Stein distinguished ChatGPT users from subjects of surreptitious wiretaps, who had stronger privacy interests because they were recorded without knowledge.
9ChatGPT users, Judge Stein held, "voluntarily submitted their communications" to OpenAI. That voluntary submission, combined with OpenAI's terms of service permitting legal process disclosure, defeated the privacy objection. The users' reasonable expectation of privacy was diminished by their own choice to use the platform under those terms.
10OpenAI announced that its obligations under the earlier broad preservation order ended on September 26, 2025. The company returned to standard 30-day deletion practices for new data. However, historical data from April through September 2025 remained segregated under litigation hold for the Times case specifically.
11Judge Stein affirmed an order compelling OpenAI to produce the entire 20 million anonymized ChatGPT log sample to the news organization plaintiffs. The logs span December 2022 through November 2024. OpenAI had sought to produce only conversations implicating the plaintiffs' specific copyrighted works. Judge Stein rejected that approach. The full sample was ordered produced.
12For AI companies facing discovery, one legal analysis noted, this decision confirms that user-privacy arguments will not automatically shield internal data from production. Courts will weigh privacy interests against relevance and expect de-identification safeguards rather than wholesale withholding.
What the Two Cases Establish Together
13Heppner establishes that consumer AI interactions carry no attorney-client privilege. The OpenAI data retention orders establish that consumer AI conversation logs are discoverable electronically stored information and that courts will order their production when a party demonstrates relevance.
14The data exists. Courts have the tools to reach it. The question in any future proceeding is whether the conditions for compelled production are met.
15No court has established that any individual's consumer AI conversations are automatically available to any party in any proceeding. Discovery is not automatic. It requires a proceeding, a party with standing to seek discovery, a demonstration of relevance, and a court order. Each of those conditions depends on facts specific to the case.
16What Heppner and the OpenAI orders establish is that when those conditions are met, the data is reachable. The privilege that might otherwise block production does not exist. The platform has reserved the right to disclose. Courts have demonstrated willingness to order production.
17Whether those conditions will be met in any specific situation is a question that cannot be answered in the abstract. It depends.
Factors That Affect Exposure
- Which platform and which tier ChatGPT Enterprise and API users with Zero Data Retention agreements were excluded from the preservation order. Consumer tiers (Free, Plus, Pro, Team) were covered. The distinction between consumer and enterprise tiers is meaningful, but Bloomberg Law noted that several products marketed as enterprise may offer no more legal protection than consumer services under Heppner's reasoning.
- Whether counsel directed the AI use Judge Rakoff's dicta in Heppner left open the possibility that AI used at counsel's direction, inside a system with contractual confidentiality terms, might qualify for privilege protection under the Kovel doctrine. That question has not been decided.
- Nature of the proceeding Criminal investigations, civil litigation, regulatory inquiries, and administrative proceedings have different discovery rules and different standards for compelling production from third parties. The analysis differs by proceeding type.
- What was submitted The OpenAI preservation order covered output log data: the conversations themselves. It did not automatically make every conversation available to every party. Production in any specific proceeding requires a showing of relevance to that proceeding.
- Timing of the interaction The 20 million logs ordered produced span December 2022 through November 2024. OpenAI returned to standard 30-day deletion practices on September 26, 2025 for new data. Interactions outside retention windows may no longer exist unless subject to a separate hold.
- Anonymization and protective orders The logs produced in the Times litigation were de-identified and produced under a protective order. That de-identification process was designed to remove PII. Researchers studying leaked AI conversations have found that truly anonymizing conversational data is technically difficult. Courts have acknowledged this complexity without resolving it.
The Scope of the Question
18The Heppner ruling and the OpenAI orders concern attorneys and criminal defendants most directly. The underlying conditions they establish are not limited to those categories.
19Any professional who has used a consumer AI platform for work that touched confidential matters (tax analysis, healthcare administration, financial planning, regulatory compliance, business strategy, employment matters) submitted that information to a platform that has reserved the right to disclose it to legal process. The platform retained it, possibly beyond the standard deletion window. Courts have established that it is discoverable when a party with standing demonstrates relevance.
20Whether any specific professional's specific interactions will ever be the subject of a discovery request is a question no one can answer in advance. What is no longer an open question is whether the platform's privacy commitments would block that production if it were sought.