If the tech industry sought to create a method of seducing users into sending their deepest, most sensitive secrets to a server in a faraway data center, it would be hard-pressed to create a better honeypot than an AI chatbot.
OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini, and their countless smaller competitors have become therapists, sounding boards, and virtual confession booths for millions of people around the world. Almost all of those AI models are set by default to collect and store that highly private data with, in many cases, no restrictions on how it’s shared or sold, used to further train the tools, or handed over to any lawsuit plaintiff or law enforcement agency that demands it through a legal process.
“You have this intelligent thing staring back at you, and you’re basically telling it, one question at a time, every possible thing there is to know about your life,” says Matt Green, a privacy- and security-focused computer science professor at Johns Hopkins University. “You're giving it this huge profile on you.”
A decade ago, text messages represented perhaps the most personal, sensitive data that most people shared from their devices, says cryptographer and software developer Moxie Marlinspike. The surveillance dangers invited by unprotected texting are what pushed him in 2014 to create Signal, the end-to-end encrypted messenger now used by well over a hundred million people. Now, he says, that critical point of privacy vulnerability has shifted to people’s interactions with AI.
“Those same things I was concerned about with messaging are happening in the AI space, but several orders of magnitude more significantly,” says Marlinspike. “People are integrating AI into their personal lives. They talk with it about their deepest insecurities, their finances, their health, their relationships.”
So earlier this year, Marlinspike launched Confer, an AI chatbot designed to allow users to ask it anything while preserving their privacy, using cryptography to technically prevent the service’s own server from being able to surveil or log their conversations. “Confer is designed to be a service where you can explore ideas without your own thoughts potentially conspiring against you someday,” he wrote in a blog post introducing it.
Marlinspike’s private AI tool is, in fact, just one standout among a new generation of AI services that promise to remedy the pervasive privacy invasion that these chatbots represent. Some advertise that they never record conversations as a policy. Others offer to anonymize them. A few, like Confer, seek to create actual technological guardrails that restrict their own access to users’ secrets.
The result of that nascent competition to create less surveillance-prone AI is a growing crowd of tools, often ones that offer confusing assurances for users as they seek to adopt an increasingly unavoidable technology without losing control of their secrets. Here’s WIRED’s guide to using AI with your privacy intact.
Zero Data Retention
When you start typing into one of the big three AI chatbots—ChatGPT, Claude, or Gemini—it’s safest to start with a baseline expectation of approximately zero real privacy from anyone who is determined to access your conversation records and has a legal path to obtaining them. That includes the owner of the service, advertisers or other companies they partner with, contractors who help fine-tune the systems, law enforcement agencies, or even someone who manages to subpoena the records as part of a civil lawsuit.
The simplest, strong exception to that rule is a contract between you—or more likely, your employer—and an AI provider that legally prevents them from retaining those records, a provision that’s come to be known as zero data retention, or ZDR. OpenAI, Anthropic, and Google all offer ZDR policies for their enterprise versions, which when enabled generally require that they immediately delete records of users’ interactions with a chatbot as soon as they’re processed.
Even these ZDR policies, which are only available for paid enterprise and developer accounts rather than for average users, have significant exceptions. Anthropic, for instance, doesn’t offer ZDR for its most sophisticated “Mythos-class” models like Fable 5.1, due to what it describes as the potential for misuse like scamming or hacking and even “autonomous misbehavior,” such as AI agents independently hacking targets to carry out their unwitting users’ requests, as has occurred in several high-profile AI-driven breaches.
OpenAI also announced last month that its ZDR implementations will analyze user activity prior to deletion—on the customer’s systems rather than its own, it says—and, if it detects abuse, flag it for the customer organization. OpenAI says its system, known as Private Safety Processing, will even alert OpenAI’s staff if it detects abuse in some cases, though without revealing the content of the conversation to them. Google, too, warns that it logs some Gemini prompts for abuse monitoring even with ZDR enabled, but without the user’s Google ID or IP address included—though that “sanitized” data can in some cases still pinpoint a particular person when the request itself includes identifiable information.
Policies, Promises, and Proxies
Regardless of those protections and exceptions, the paid, enterprise-level, contractual promises of ZDR are out of reach for the vast majority of non-corporate AI users. Instead, many consumer-targeted AI services ask us to settle for the far weaker, pinky-swear promises they’ve made not to log our conversations.
Privacy-focused cloud services company Proton, for instance, offers the AI chatbot Lumo, which it describes as “AI where every conversation is private.” That privacy, however, isn’t based on the technical guarantees of end-to-end encryption, like Proton’s other services such as Proton Mail and Proton Drive. Instead, it simply promises not to log users’ conversations, and users have to trust that Proton will adhere to that privacy policy—which, in Proton’s case, is at least backed by the company’s long track record as a privacy-focused company. “A promise is not as good as a mathematical guarantee,” Yen told WIRED in an interview last month, “but a promise made by the right people is still actually quite substantial.”
Other privacy-focused AI services like Venice.ai and Duck.ai, the AI chatbot offered by long-running private search engine DuckDuckGo, offer similar vows about keeping no logs of your conversations. Both services, however, relay your chat requests to other services such as Claude or ChatGPT, essentially acting as a proxy for your conversation that limits what information the underlying AI model can collect about you.
(Duck.ai lets the user choose which third-party model they’re using. Venice.ai appears to automatically route conversations to different services based on the request, without always making clear to the user which one it’s using, as well as answering queries with an AI model hosted on its own infrastructure in some cases. Venice.ai also touts other privacy features, like using “trusted execution environment” systems to cryptographically prevent logging of conversations—more on that below—but when WIRED attempted to reach out to Venice.ai’s staff to ask more questions about these privacy features, its AI response bot only repeatedly referred us to a nonworking email address.)
Using an anonymity proxy offers some privacy protection compared with using ChatGPT or Claude directly. Yet when they relay your requests to those services, Duck.ai and Venice.ai’s own promises about their retention of data become significantly less meaningful, points out Johns Hopkins’ Green. That’s because your chat messages can still be collected by that underlying AI model and, even stripped of any identifying metadata, those messages can often contain identifiable information.
Ask about the best coffee shops in your neighborhood, for instance, and you’ve immediately revealed information about where you live, Green points out. “All that stuff tied together is basically a fingerprint for you,” says Green.
Trusted Execution Environments and On-Device AI
Far better than privacy promises, policies, or anonymizing relays are actual technological restrictions that prevent an AI service from reading your conversations—a guarantee that the service not only does not snoop on or record your chats, but that it cannot. That’s where cryptography comes in.
Unlike encrypted messaging or storage, where the server hosting a service never sees any unencrypted data, interactions with an AI model can’t yet be truly end-to-end encrypted like a Signal or WhatsApp conversation. Currently, working AI models can only process unencrypted prompts. So instead, some AI services are offering the next best thing, what’s known as a trusted execution environment, or TEE. In that system, the server running the AI model uses a hardware setup—most often Nvidia’s Confidential Computing—in which the user’s queries are processed on isolated hardware, and the server can cryptographically prove that the rest of the system has no access to that segregated enclave of secrets.
Confer, the private AI chatbot launched by Signal creator Moxie Marlinspike, uses that Nvidia-based TEE setup— along with an authentication system based on passkeys and open-source code that anyone can audit—to offer what are perhaps the strongest consumer-level privacy protections currently available in an AI chatbot.
Meta, too, uses a TEE to offer a more private version of the Meta AI chatbot included in WhatsApp—a privacy system that Confer’s Marlinspike has said he is helping Meta to develop. Start typing into the “Ask Meta AI or Search” bar in your WhatsApp app, and an “Ask” button will appear on the right side of the text field with the Meta AI logo. Tap it and then tap the speech bubble with a lock that appears on the top right of that Meta AI chat screen, and you’ll enter a new chat screen that’s protected with a TEE system, which Meta says prevents it from keeping any record of it. That Incognito system is by no means truly end-to-end encrypted like the rest of WhatsApp’s messaging, but it appears to be Meta’s attempt at integrating AI into WhatsApp while approximating the privacy promises it offers to users in their conversations with other humans.
Unlike the Meta AI integrated into WhatsApp, Meta’s newer AI agent called Muse doesn’t yet offer a TEE-based privacy system. Instead, it promises only to run in a segregated virtual machine (VM) in the cloud, where Meta says its ad systems won’t be able to access your data and you can opt out of your data being used to train Meta’s AI. The company says, however, that it’s working on releasing Muse Confidential VM later this year, which Meta tells WIRED “is intended to cryptographically and verifiably prevent Meta from accessing data” in a user’s Muse virtual machine.
Apple also offers a privacy-preserving AI system of its own design with some TEE-like properties, what it calls Private Cloud Compute (PCC), to enforce its promise that it can’t read users’ conversations with its Apple Intelligence AI service. When you ask Apple Intelligence or Siri a query that’s processed on its servers, your personal device cryptographically checks that the server is running an unaltered version of Apple’s PCC code, which is designed to keep no logs and isolate your data from any remote access. (It’s also possible to ask Apple Intelligence or Siri to query ChatGPT or other third-party AI services. When you do, just as with other tools that relay your queries, you won’t get that same PCC level of protection, but Apple will also check with you before sending your request to a third-party service.) For most simple queries, however, Apple uses a more limited, on-device AI model that doesn’t share any of your secrets beyond your phone, computer, or smartwatch, but also isn’t as fully featured as a typical server-based model.
On that note, there are plenty of other AI tools that run locally on your computer, too, such as Ollama, LMStudio, or LocalAI. All of them ensure—by the simple fact that no data ever leaves your computer—a level of privacy that’s tough to obtain with any cloud-based AI tool. But Green warns that what you gain in privacy with locally hosted artificial intelligence, you lose in, well, intelligence. Expect these self-hosted AI tools to be frequently stumped and to hallucinate far more often than the modern, cloud-hosted AI models most users are accustomed to. “You can run these on any laptop,” Green says. “They’re just dumb as rocks.”
The Price of Privacy
That intelligence-versus-privacy question is, of course, just one of the trade-offs that privacy-conscious AI users face as they choose their preferred tool. Price is another.
Confer, for instance, uses a freemium model, charging $34.99 a month for its cheapest tier after users run out of the roughly 20 to 25 queries a day it offers for free. That’s more than the $20 a month Claude and ChatGPT charge for their cheapest paid tiers. But Marlinspike says that price premium in fact captures the actual cost of running an AI model without the subsidies that come from an expectation of future profits from data collection or advertising. “It’s more expensive, but it's the real cost,” Marlinspike says, “whereas other paid providers are subsidizing the cost with monetization of our data in one way or another.”
Given the serious energy and hardware costs of running frontier AI models, the advent of more privacy-preserving AI raises the question of how companies that don’t monetize user data will sustain themselves, Green notes. Without those data-collection-driven profits, he says, it’s not yet clear whether companies that provide more private AI services will find a sustainable business model—or whether some will eventually give up or even undermine their data protection promises down the road.
In other words, AI that doesn’t exploit your data is possible. But it may be far pricier than you think. “If you want real privacy,” Green says, “you might have to pay for it.”
