Learning how do I check if an ai tool respects my privacy is the essential defensive skill of the AI era. Every week brings a new AI app promising miracles, and every one of them wants your data — your documents, your photos, your conversations, your contacts. Most people click “accept” without reading a thing, then act surprised when their data turns up in training sets or breach reports. I audit every AI tool before I trust it with anything meaningful, and the process takes about ten minutes once you know what to look for.

Think of it like checking a restaurant’s hygiene rating: you’re not reading the full inspection report, just looking for the score and the red flags.

How do I check if an AI tool respects my privacy?

The 7-point privacy audit

  1. Does it train on your inputs? This is question one. Look for settings like “improve the model for everyone” (ChatGPT), data-sharing toggles, or statements in the privacy policy about using your content for training. The gold standard: a clear opt-out or, better, a guarantee that your data is never used for training (common in paid business tiers).
  2. What data does it collect, and why? Skim the privacy policy’s data-collection section. An AI writing tool needs your text; it doesn’t need your contacts, location, and browsing history. Over-collection is a red flag.
  3. Where is data stored, and for how long? Look for retention periods. “We retain your conversations indefinitely” is worse than “deleted after 30 days”. Temporary/anonymous chat modes (offered by several major AI assistants) are the best option for sensitive queries.
  4. Who owns the company, and what’s their business model? If the product is free and the company sells advertising, your data is the product. If it’s a paid product from a company with enterprise customers, privacy is usually better — enterprise contracts demand it.
  5. Is there independent scrutiny? SOC 2 certification, ISO 27001, published security whitepapers, bug-bounty programmes — these signal a company that takes data seriously. Their absence doesn’t prove badness, but their presence proves investment.
  6. What do regulators say? In the UK, check whether the ICO has taken action against the company or issued relevant guidance. Regulatory attention is public record.
  7. Can you delete your data? Look for clear data-deletion options and export tools. Under UK GDPR you have the right to erasure — a company that makes this easy respects the spirit, not just the letter, of the law.

Quick-reference: the major AI assistants

  • ChatGPT: opt out of training in Settings → Data Controls. Temporary chats available. Business/Team tiers don’t train on your data.
  • Claude: states it doesn’t train on free conversations by default in the same way; check current policy, and business tiers offer data guarantees.
  • Gemini: Google’s data practices are extensive — review your Google account’s activity controls. Workspace business data has stronger protections.
  • Microsoft Copilot: commercial data protection promises for business users; consumer version — check settings.

Policies change, so verify rather than trusting this list blindly — but the audit process above works regardless.

Matching caution to data sensitivity

Not everything needs maximum paranoia. Use the traffic-light approach from our AI chatbot safety guide: public/green information in any reputable tool; amber information only in tools that pass the audit with training disabled; red information (passwords, ID documents, health records, trade secrets) never in AI tools without enterprise-grade guarantees. For photos specifically, see our guide to stopping AI training on your photos.

Teaching others: the 5-minute privacy audit you can share

Once you’ve learned the 7-point audit, the highest-value thing you can do is teach it — because the people most vulnerable to AI privacy harms are often the least equipped to assess them: elderly relatives pasting documents into chatbots, kids signing up for AI apps, colleagues using whatever tool is trending. You don’t need to lecture; just share the three questions that catch 90% of problems: Does it train on my inputs? Can I delete my data? What’s the business model? Anyone can remember three questions.

Make it concrete with a live demo. Sit with your parent and go through their chatbot’s settings together — turn off training-data sharing, enable temporary chats, show them where the delete button is. Ten minutes, and they’re safer forever. With kids, frame it as empowerment rather than restriction: “here’s how to tell which apps respect you” lands better than “don’t use that app”. And at work, suggest the audit as a team exercise when evaluating new tools — it takes one meeting and prevents the “oops, we fed client data to a chatbot” incident that nobody wants.

The broader point: privacy isn’t a solo sport. Your data practices affect others (the photos you post include other people; the documents you share include colleagues), and collective expectations shape company behaviour. Every user who turns off training-data sharing, every business that demands data guarantees, every complaint to the regulator moves the market toward better defaults. The audit in this guide protects you; sharing it protects everyone around you.

One more frontier to watch: AI agents and the privacy stakes. The next wave of AI doesn’t just answer questions — it acts: booking, buying, emailing, managing your calendar on your behalf. That requires far deeper access to your data and accounts than today’s chatbots, which means the privacy audit in this guide becomes even more critical. Before granting an AI agent access to your email, calendar, or bank: verify the company’s data practices ruthlessly, start with read-only permissions, and understand exactly what the agent can do autonomously. The convenience will be extraordinary; the exposure will be too. Get the privacy foundations right now, and you’ll be ready to adopt agents safely when they mature.

Your practical takeaway

This weekend: run the 7-point audit on the three AI tools you use most, turn off training-data sharing everywhere it’s offered, and learn where the temporary-chat mode lives in each. It takes 30 minutes total and it’s the highest-value privacy action most people can take. The goal isn’t paranoia — it’s informed consent. Use AI freely for the green stuff, carefully for the amber stuff, and never for the red stuff without proper protections.