The Privacy Crisis of AI Conversations: A Call for Federal Standards

On February 10, 2023, a federal judge in the Southern District of New York ruled that conversations between a defendant and an AI chatbot do not qualify for attorney-client privilege. This decision arose after the defendant shared his chatbot interactions with his lawyers, mistakenly believing they were confidential. The ruling highlighted that the chatbot's privacy policy allows for disclosure to government authorities, raising significant concerns about the privacy of personal conversations with AI systems. OpenAI's research indicates that approximately 75% of ChatGPT conversations are personal, with many users seeking health-related advice outside of clinical hours.

The Hill

The ruling is part of a broader trend where the privacy of AI conversations is increasingly compromised. In November 2022, a San Diego health system faced a class-action lawsuit for allegedly using an AI tool to record over 100,000 patient encounters without consent. Patients claimed they were unaware their conversations were being captured and sent to external servers. This pattern of privacy violations underscores the urgent need for a federal framework that protects individuals' conversations with AI.

The Hill

Critics argue that current regulations are inadequate to protect the privacy of AI interactions. The absence of a federal standard akin to the Health Insurance Portability and Accountability Act (HIPAA) leaves individuals vulnerable. The recent ruling and the San Diego incident exemplify a regulatory vacuum where states create their own rules, leading to inconsistencies and confusion. Bryan Rotella, a lawyer and legal strategist, emphasizes that meaningful informed consent must be established, requiring clear communication about when conversations are no longer private.

The Hill

Legal experts and advocates are calling for immediate action to create comprehensive federal laws that treat AI conversation data as private by default. They argue that the current reliance on lengthy privacy policies is insufficient for ensuring user understanding and consent. The One Big Beautiful Bill Act, which was considered in Congress, presented an opportunity to address these issues but ultimately proposed a 10-year moratorium on state AI regulations without establishing federal protections.

The Hill

• “It’s the latest in a pattern that has been accelerating for months.” — Bryan Rotella, Lawyer and Legal Strategist

The Hill

• “But trust is not built in a term of service agreement that nobody reads.” — Bryan Rotella, Lawyer and Legal Strategist

The Hill

• “America needs today what it needed in 1996: a federal standard that arrives before the catastrophe, not after.” — Bryan Rotella, Lawyer and Legal Strategist

The Hill

While the ruling in New York has drawn attention, there is a lack of comprehensive data on the extent of privacy violations related to AI conversations. The San Diego health system's case highlights the need for further investigation into the use of AI in healthcare settings, as well as the broader implications for privacy across various sectors.

The Hill

As AI technology continues to evolve, the need for robust privacy protections becomes increasingly critical. Advocates are urging Congress to prioritize the establishment of clear, enforceable standards that safeguard the privacy of conversations with AI, ensuring that individuals can engage with these technologies without fear of unwarranted surveillance or data breaches.

The Hill