Are Your A.I. Chats Confidential? Three Federal Rulings, a Fresh Supreme Court Decision, and the E.U.’s August 18 Deadline
r. pr. Robert Nogacki | 10 lipca 2026 r.
The collision has arrived: three federal judges disagree on whether a conversation with a machine is anybody else’s business, and the clock is now running.
A.I. chat confidentiality has stopped being a seminar topic and become running news. In February, two federal courts issued opposite rulings, on the same day, about the protection of conversations with Claude and ChatGPT; in March, a third court split the difference; on June 29th, the Supreme Court raised the constitutional floor for data held by providers; and on August 18th, the European Union’s e-Evidence regime hands prosecutors a direct route to chatbot logs. Anyone who treats a chat window as a private notebook should read what follows.
Bradley Heppner, a finance executive facing securities-fraud charges, received a grand-jury subpoena and did the sensible thing: he hired defense lawyers. Then he did the modern thing. He opened a chat window. Into Claude, the language model built by Anthropic, he typed the outlines of possible defense strategies and legal arguments, and he passed the generated material along to his attorneys. The F.B.I. seized it under a search warrant, and Judge Jed Rakoff, of the Southern District of New York, found himself facing a question that American evidence law had never had to answer squarely: is a conversation with an A.I. confidential at all, and, if it is, does the attorney-client privilege reach it?
On February 10th, Rakoff answered: it does not. That same day, a federal magistrate judge in Michigan, facing what was essentially the identical question, answered precisely the opposite. Seven weeks later, a third court, in Colorado, split the difference. Last July, I wrote that a collision between legal doctrine and technological reality was inevitable, and that criminal defendants would be the first to test it, claiming protection for trial strategies discussed with A.I. In November, I added that chatbot conversations were already, as a practical matter, fully available to law enforcement. There was no prophecy in any of this; a careful reading of the digital-evidence case law sufficed. The collision has now arrived, and the New York City Bar Association, a lawyers’ organization with a pedigree running back to 1870, has published the first serious attempt to bring order to it. The report deserves close reading, because it will set the vocabulary of this debate for years.
Is Talking to A.I. Privileged? Heppner, and a Witness for the Prosecution
Begin with the strongest version of the position that denies protection, because Rakoff built it carefully, on three pillars, in United States v. Heppner: a bench ruling on February 10th, followed by a written opinion a week later, holding thirty-one Claude-generated documents unprotected.
First, the attorney-client privilege protects communications between a client and a lawyer, and Claude is not a lawyer; a discussion of legal questions between two non-lawyers enjoys no protection. The prosecution supplied a piece of evidence of admirable construction: it asked Claude itself whether it gives legal advice, and the model replied that it is not a lawyer and recommended consulting a qualified one. It is a rare case in which the key exhibit volunteers a statement for the government.
Second, confidentiality. The privacy policy of Claude’s consumer edition discloses that Anthropic collects prompts and outputs, may use them to train its models, and may share them with third parties, public authorities included. If so, the court reasoned, Heppner had neither a substantial privacy interest nor a reasonable expectation of confidentiality: he had entrusted his information to an entity that openly announces what it may do with it.
Third, work product, the doctrine that shields materials prepared for litigation. Heppner acted on his own initiative, not at his lawyers’ direction, and therefore outside its scope. Honesty requires noting the door the court left wide open: had counsel instructed the client to use the tool, Claude might have functioned much like a highly credentialled professional serving as a lawyer’s agent, in the spirit of United States v. Kovel, the Second Circuit’s 1961 decision that has for decades covered translators, accountants, and other intermediaries necessary to the giving of advice. This is precisely the thesis I advanced a year ago: privilege follows function, not form. The court did not reject it; it held only that, on these facts, it did not apply.
Tools, Not Persons: When Work Product Protects Your ChatGPT Drafts
On the same February 10th, Magistrate Judge Anthony Patti, in the Eastern District of Michigan, was deciding an employment dispute, Warner v. Gilbarco, in which the defendant company demanded from the plaintiff, who was representing herself, every scrap of material connected to her use of ChatGPT. He refused, and on principle: A.I. programs are “tools, not persons,” even if they have administrators somewhere in the background, and the contrary view would annihilate work-product protection in nearly every modern document-drafting environment. The doctrine, unlike the attorney-client privilege, covers by its terms materials prepared by or for a party, lawyer or no lawyer, which is why a self-represented plaintiff could invoke it at all. Since waiver requires disclosure to a litigation adversary, or in a manner likely to reach one, and an A.I. platform is no one’s adversary, the protection holds.
Seven weeks later, in Morgan v. V2X, Magistrate Judge Maritza Dominguez Braswell, in Colorado, went a step further. To the argument that handing data to a commercial platform destroys confidentiality, she responded with a question destined for the casebooks: Google hosts millions of accounts, and therefore has access to millions of messages, documents, and recordings; does it follow that every Gmail user has surrendered all claims to confidentiality and privacy? She reached for the Fourth Amendment case law, of which more shortly, and concluded that routing data through a third party’s system does not, by itself, extinguish the expectation of privacy. And she added an observation that may weigh more in this debate than a shelf of monographs: the privacy argument is, if anything, stronger for A.I. than for a search engine, because these tools are built and trained to interact with the user rather than to passively return results.
Morgan is not a naïve decision. The court ordered the plaintiff to disclose the name of the platform into which he had fed information marked confidential, and it amended the protective order: confidential material may no longer go into mainstream A.I. tools that lack contractual guarantees, such as a ban on training, a ban on disclosure, and a right to demand deletion. A tool is a tool, but configuration matters.
Inside the 2026 City Bar Report: First the Engineering, Then the Doctrine
Into this dispute steps “The Intersection of Artificial Intelligence, Privacy, and Privilege,” the June report of a working group of the City Bar’s Presidential Task Force on Artificial Intelligence and Digital Technologies. The scale is impressive: some two hundred and sixty people across more than fifty committees, the working group itself including the former federal judges Katherine Forrest and Paul Grimm and the sitting judge Xavier Rodriguez. The method is more impressive still. The report opens not with doctrine but with engineering, and it argues that the outcome of these cases is decided by the conceptual frame a court adopts at the outset. A court that sees the model as a substitute person will rule like Rakoff; a court that sees a tool will rule like Patti and Braswell. And the frame ought to follow from how these systems actually work, not from the intuition suggested by a chat interface.
The technical heart of the report follows an analysis by Robert Mahari with the eloquent title “Misunderstanding Memorization.” Training a model and answering a query (inference, in the jargon) are two separate processes; a single user prompt does not alter the model’s weights. Memorization, meanwhile, grows superlinearly with duplication: a sequence that appears in the training corpus ten times is roughly a thousand times more likely to be reproduced than one that appears once. A unique prompt from a single user has a negligible chance of being memorized in recoverable form, and even a memorized fragment carries no information about who typed it, when, or in what context.
The conclusion is counterintuitive and practically momentous: the real artifact in a confidentiality fight is not the model but the conversation log the provider keeps. Whether such a log exists, and for how long, is a matter of retention policy and product tier, not of neural-network mechanics. The report is scrupulous about the details: a standard seven-day retention window in Anthropic’s A.P.I., with a zero-retention option for commercial customers; business and A.P.I. data excluded from training by default at both major providers; but also, after Anthropic changed its consumer terms in August, 2025, the possibility that the chats of users who did not opt out of training will be kept for as long as five years. And it recalls that a preservation order issued in May, 2025, in the copyright litigation against OpenAI froze even the logs that had been scheduled for deletion. A promise to erase yields to a litigant’s duty to preserve.
An A.I. Privacy Policy Is Notice, Not Consent
The report’s most useful pages take aim at the reasoning on which Heppner rests: since the privacy policy warns that data may be disclosed, the user has supposedly agreed to the absence of confidentiality. The working group compared the giants’ policies and found that Google, Microsoft, Dropbox, and Box all carry a disclosure-on-legal-demand clause in nearly identical words. If such a clause destroys confidentiality, then there is no confidential e-mail, no confidential cloud drive, no confidential document in an online editor. The case law says otherwise: in United States v. Warshak, in 2010, the Sixth Circuit held that an e-mail provider’s contractual right to inspect messages did not defeat the constitutionally protected expectation of privacy.
The report adds a distinction that data-protection specialists will find obvious and that privilege litigation keeps losing: terms of service are a contract; a privacy policy is a unilateral notice. Treating the notice as consent confuses being told about a practice with agreeing to it. What is more, the providers’ own terms cut against any theory of abandonment: Anthropic and OpenAI both confirm that users retain rights in what they type, and in the commercial tiers the customer’s content is treated as the customer’s confidential information, excluded from training. As evidence of a voluntary surrender of secrecy, this is poor material. One more point: the classic waiver doctrine makes sense where the recipient of the information can testify about it, disclose it of its own accord, or be compelled to produce it. Of that triad, only compelled production applies to an A.I. platform, and compelled production is a feature of the entire digital infrastructure that lawyers have used for two decades without forfeiting their secrets.
The profession owes a separate argument to Bridget McCormack, the former chief justice of the Michigan Supreme Court, and Shlomo Klapper. Their diagnosis: Heppner anthropomorphizes the model. It asks whether an A.I. can be a party to a privileged relationship (the answer is, obviously, no) instead of asking whether the use of a computational tool waived protection for information that was already protected. The title of their analysis, published in the Sedona Conference Journal, says it all: the machine is not the interlocutor. Note the consistency with the line I described in the fall, when in Garcia v. Character Technologies a court saw in a chatbot a product rather than a speaker. One does not confide in a product; one uses it.
The Long Thaw: From Miller to the Supreme Court’s June 29th Chatrie Ruling
The report situates the fight within a half century of what is called the third-party doctrine. In the nineteen-seventies, the Supreme Court held that whoever voluntarily hands information to a bank (United States v. Miller) or to a phone company (Smith v. Maryland) loses constitutional protection for its privacy. In the digital era, that logic would mean privacy does not exist at all, so the courts began narrowing it: Warshak extended protection to e-mail; Riley v. California, in 2014, announced that digital is different; and Carpenter v. United States, in 2018, required a warrant for historical location data, observing that the voluntariness of sharing data one cannot decline without exiting modern life is a fiction. And on June 29th, ten days before this essay, the trajectory reached geofence warrants, the bulk location orders: in Chatrie v. United States, the Supreme Court held, six votes to three, in an opinion by Justice Kagan, that acquiring a phone’s location data from Google is a Fourth Amendment search, because a person keeps a reasonable expectation of privacy in that information even when a commercial provider holds it. The Court decided only that a search occurred and sent the case back on the question of reasonableness; the direction, though, could hardly be plainer.
From this line the report derives an elegant directive: the Fourth Amendment cases set a floor below which the analysis of A.I. confidentiality should not sink, and well above which it ought to stay. Then it supplies the numbers that raise the floor. By the Federal Reserve’s April estimates, roughly eighteen per cent of American firms have deployed A.I. tools, a sixty-eight-per-cent increase year over year, and the adopters employ about seventy-eight per cent of the American workforce. The more a conversation with a model becomes a condition of professional life, the harder it is to maintain that having one is a voluntary surrender of privacy. That is exactly the mechanism Carpenter described for cell phones.
Free ChatGPT vs. Enterprise A.I.: Confidentiality by Price Point
One thing unites all three rulings: each arose from a free or consumer edition of the tools. Heppner expressly left open whether the result would be the same for a paid platform with different data practices, and Morgan rewards tools that come with contractual guarantees. A dividing line is emerging, and it is the one I warned about last July under the name of the privilege paradox: the affluent client confers with a professional at several hundred dollars an hour under the law’s full protection, while the person who can afford only a free chatbot has none. If confidentiality follows the price list, the law will ratify digital underclasses: on one side, firms with enterprise deployments, zero retention, and contractual training bans; on the other, self-represented litigants. The report sees the danger clearly and ties it to access to justice: it is precisely the self-represented whom A.I. has genuinely helped to run their cases, so stripping them of protection would be a special kind of perversity.
The View from Warsaw: Professional Secrecy and the E.U.’s August 18 e-Evidence Deadline
I read all this from a jurisdiction that never had the privilege to lose. Polish law, like most of the Continent’s, knows no evidentiary privilege belonging to the client. What we have are professional secrets binding the lawyer, and procedural shields around them: an absolute ban on questioning defense counsel about facts covered by the defense secret, release from attorney secrecy only by a court and only when no other evidence will do, and protection for documents connected with the conduct of a defense (Articles 178, 180, and 225 of our criminal-procedure code, for those keeping score). The common denominator of every one of these constructions is a relationship with a lawyer. A client’s conversation with a chatbot sits inside none of them; it is data held by a third party, and a prosecutor can demand it under the ordinary rules for seizing objects and electronic records.
The practical stakes change on August 18th, when the European Union’s e-Evidence Regulation begins to apply. A Polish prosecutor will gain a direct route to service providers offering their wares in the Union, A.I. providers included, who by that date must designate an establishment or a representative in the E.U. to receive orders. A production order will reach the content of communications, as a rule in cases of offenses whose statutory maximum is at least three years’ imprisonment, along with a catalogue that includes terrorism and child sexual abuse. The Maine case I described in the fall, the first federal warrant for a ChatGPT user’s data, stops being American exotica and becomes a preview of domestic practice. A footnote for the punctual: the deadline for transposing the regulation’s companion directive passed in February, and the European Commission spent the spring sending formal notices to most member states, Poland among them; the regulation itself, however, applies directly, and waits for no legislature.
Two honest caveats. First, the privilege against self-incrimination, which Continental lawyers still call by its Latin name, nemo tenetur, protects a defendant from being forced to produce evidence against himself; it does not protect data already sitting with a provider. That is the same gap I flagged a year ago in the context of the Fifth Amendment. Second, the status of notes a suspect prepares for his own defense is disputed in Polish doctrine, and the log of a chatbot conversation in which he sketched that defense lies even farther from safe ground. Until the case law speaks, a careful lawyer will assume the Heppner variant: no protection. For professionals, the lesson is sharper still: feeding information covered by professional secrecy into a consumer chat window risks breaching the duty to keep it. The American bars have said so outright, in the A.B.A.’s Formal Opinion 512 and the City Bar’s own Opinion 2024-5; the European and Polish guidance points the same way; and the G.D.P.R. adds requirements of its own for corporate deployments, a lawful basis and a processing agreement, while creating no evidentiary secrecy whatsoever.
How to Use A.I. Confidentially: What Prudence Looks Like Now
The report closes with seven recommendations for counsel, which compress into a single principle: choose deliberately and document, because a future confidentiality fight will be decided by the facts you are creating today. Hence: enterprise tiers with contractual training bans, zero retention, and deletion rights, rather than consumer tools; a preserved copy of the policies and terms in force at the moment of use, because those, not today’s, will be the ones examined; A.I. clauses in engagement letters, and written warnings to clients that a public chatbot is no substitute for a conversation with counsel; protective orders with Morgan-style conditions for A.I. tools; and caution around sharing features, because a public link to a conversation can outlive the conversation itself in the Internet’s archives. The report gives A.I. agents a paragraph of their own: they remain tools, but an agent wired into e-mail, calendars, and repositories can walk information out to actual third parties, and at that point there is no dispute about conceptual frames. There is a classic disclosure.
Slowly, Then All at Once
Law moves slowly, until it moves all at once. I built my July essay on that observation, and I hold it today with more confidence, not less. Warner and Morgan show that courts can see A.I. for what it technically is: a tool. Heppner is a reminder that the direction is not settled at the level of privilege doctrine, but Chatrie has just raised the constitutional floor beneath it. My forecast, offered with the caution proper to probable rather than certain things: the tool frame wins, because the alternative annihilates the confidentiality of a lawyer’s whole digital infrastructure, from e-mail to cloud, and no court will want its name on that result. Until then, a brutal but honest rule of practice applies: talk to a public chatbot as if a prosecutor will read the transcript. In light of Heppner, one just did.
No one, meanwhile, has dissolved the tension I described in November: the state wants access to the logs, because criminals use the same models, and users want confidentiality, because the models have become the notebook of their most intimate affairs. The City Bar’s report does not resolve that dilemma. It does something more useful; it teaches courts what they are talking about. For companies and law firms, the assignment is immediate, because deployment architecture, vendor contracts, and internal usage policies will determine which side of the Morgan line your data lands on, long before the first Polish court weighs in.
Which points to the destination. In 2010, Warshak taught American law to treat the e-mail inbox as private space, and the profession has built on that assumption ever since; no lawyer hesitates before typing a client’s secret into a message to co-counsel. The task now is to make a conversation with A.I. exactly that unremarkable: confidential by default, covered by doctrine when counsel directs the use, secured by contract when counsel does not. Nobody is asking the law to extend a privilege to a machine. The ask is smaller, and more urgent: to let lawyers work with the defining tool of this decade with the same untroubled confidence with which they open their own mail. Until the doctrine settles, the contracts will carry the weight, which is why the fine print, for once, is the whole story.
Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.
There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.
One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).
Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.
He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.
