If you saw headlines recently claiming that OpenAI was “secretly sharing ChatGPT chats” with big tech companies, you are not alone, and you are right to be concerned. Millions of professionals now type sensitive information into AI chatbots every day: client details, financial questions, health information, draft contracts, even passwords.
So what actually happened? The full story is more nuanced than the headlines suggest, but it carries real lessons for any business using AI tools. Here is what we know, and what your business should do about it.
The lawsuit: trackers allegedly sent ChatGPT queries to Google and Meta
In May 2026, a class-action lawsuit was filed against OpenAI in federal court in California. The complaint alleges that OpenAI embedded two of the internet’s most common advertising trackers, Meta’s Facebook Pixel and Google Analytics, into the ChatGPT website.
According to the complaint, those trackers allegedly transmitted the content of users’ queries, along with identifiers like cookies, device data, and hashed email addresses, to Meta and Google in real time. The lead plaintiff says she typed sensitive questions about her health and finances into ChatGPT, not knowing that data about those sessions was allegedly being forwarded to third parties. Because many people are simultaneously logged into Facebook or Google in the same browser, the suit argues that this activity could be linked directly to individual identities and used for ad targeting.
The lawsuit claims violations of federal and California wiretap laws and “intrusion upon seclusion,” a privacy tort reserved for particularly offensive invasions.
Two important caveats. First, these are allegations, not proven facts. OpenAI has not been found liable, and the case is in its early stages. Second, despite what some viral posts claimed, Microsoft is not a party to these data-sharing allegations. The complaint names Meta and Google as the recipients.
This is not the first ChatGPT privacy scare
Part of why this lawsuit hit a nerve is that it follows a string of earlier incidents:
- Summer 2025: shared chats showed up in Google Search. ChatGPT’s “share” feature included an option that made shared conversations discoverable by search engines. Tens of thousands of conversations, some containing deeply personal details, ended up publicly indexed on Google before OpenAI removed the feature.
- Late 2025: prompts appeared in Google Search Console. Website owners reported seeing what looked like private ChatGPT prompts leaking into their Google Search Console data, raising fresh questions about how queries travel between platforms.
- The New York Times copyright case. A federal judge ordered OpenAI to hand over 20 million ChatGPT conversation logs to news publishers as evidence in an ongoing copyright lawsuit. It is a reminder that “deleted” or “private” chats can still exist and be produced in litigation.
Different incidents, same underlying truth: what you type into an AI chatbot is not as private as it feels.
Why this matters for your business
For a business in Edison, Piscataway, or anywhere in Central New Jersey, this is not just a big-tech story. Consider what your team may be pasting into free AI tools right now:
- Client names, case details, or patient information
- Financial statements and payroll questions
- Proprietary processes, pricing, and contracts
- Source code and system configurations
If your company is in a regulated industry (legal, accounting, healthcare, pharmaceutical), that kind of exposure is not just embarrassing. It can mean HIPAA violations, breached client confidentiality agreements, and real liability.
And the risk does not require a lawsuit to be proven. Employees using personal AI accounts on company data, often called “shadow AI,” is already one of the fastest-growing security gaps we see in small and mid-sized businesses.
Five steps to use AI safely (without banning it)
The answer is not to prohibit AI. Used well, it is a massive productivity advantage. The answer is to use it deliberately:
- Create an AI usage policy. Define what data can and cannot go into AI tools. If your team does not have written rules, they are improvising with your clients’ data.
- Use business-grade AI accounts. Enterprise and business tiers of major AI platforms typically offer stronger data protections, including commitments not to train on your data. Free consumer accounts offer the least protection.
- Turn off chat history and training where possible. Most AI platforms let you opt out of having your conversations used for model training. Make that the default for your organization.
- Never share conversation links casually. As the 2025 indexing incident showed, a “shared” chat can become a public chat.
- Monitor for shadow AI. You cannot secure what you cannot see. Visibility into which AI tools your employees actually use is now a core part of any cybersecurity program.
The bottom line
The OpenAI lawsuit will take months or years to resolve, and OpenAI may well prevail. But the lesson for business owners is available today: treat every AI chatbot like a public forum until you have verified otherwise. The convenience of AI is real, and so are the privacy trade-offs buried in the fine print.
Do not wait for the next headline
At CMIT Solutions of Edison-Piscataway, we help local businesses embrace AI productivity safely, with AI usage policies, employee security training, data protection, and compliance support tailored to your industry.
Want to know what your team is really sharing with AI tools? Call us at (732) 400-8577 or visit cmitsolutions.com/edison-piscataway to schedule a free, no-obligation AI and cybersecurity risk assessment. Local, friendly IT specialists, backed by nationwide resources.
CMIT Solutions of Edison-Piscataway provides managed IT services, cybersecurity, compliance, and data protection to businesses across Middlesex County and Central New Jersey.
