Meta News

AI chatbots are becoming some of the most personal technologies people use. Users discuss relationships, finances, health, work problems, legal questions, and private thoughts with systems such as ChatGPT, Claude, and Gemini.

That creates a privacy problem that security researchers increasingly compare with the early days of messaging apps. The difference is that conversations with AI can reveal far more about someone than ordinary text messages.

As Johns Hopkins security researcher Matt Green told WIRED, repeated conversations can gradually create an extremely detailed profile of a person. Signal creator Moxie Marlinspike argues that AI interactions may now represent an even greater privacy challenge than messaging did a decade ago.

For ordinary consumer AI services, the safest assumption is that conversations stored on a provider’s servers could potentially be accessible to the company or obtained through valid legal processes.

Enterprise customers have stronger options.

OpenAI, Anthropic, and Google offer versions of Zero Data Retention (ZDR) agreements for certain enterprise and developer products. These arrangements generally require conversations to be deleted after processing.

Even ZDR is not absolute. Providers can maintain limited mechanisms for detecting abuse, and policies vary depending on the model and service being used.

For most consumers, however, contractual ZDR protections are not available.

Several AI services advertise stronger privacy.

Proton’s Lumo, DuckDuckGo’s Duck.ai, and Venice.ai, for example, offer different forms of reduced logging or anonymization.

These approaches can improve privacy, but WIRED highlights an important distinction:a promise not to collect information is different from technically preventing collection.

Proxy services introduce another complication.

A service might remove someone’s IP address or identity before forwarding a prompt to another AI provider, but the prompt itself can reveal who the person is.

A collection of questions about a neighborhood, workplace, family circumstances, purchases, and interests can effectively become a fingerprint even when obvious identifiers have been removed.

One of the most promising approaches involves Trusted Execution Environments (TEEs).

AI models currently need access to unencrypted prompts while processing them, making Signal-style end-to-end encryption difficult to reproduce directly.

TEEs attempt to solve this differently.

The model operates inside an isolated hardware environment, while cryptographic mechanisms provide evidence that the surrounding infrastructure cannot access the information being processed.

Marlinspike’s new AI service,Confer, uses this approach with Nvidia Confidential Computing. Its code is also open source, allowing independent inspection of how the privacy architecture works.

Meta is experimenting with similar technology for private Meta AI conversations inside WhatsApp, while Apple has developed Private Cloud Compute for Apple Intelligence.

Apple devices can cryptographically verify that cloud requests are being processed by approved PCC software designed to prevent logging and remote access to user information.

There is an even simpler way to prevent an AI provider from reading your conversations:do not send them to a provider at all.

Tools such as Ollama, LM Studio, and LocalAI allow models to run directly on personal computers.

When properly configured for local inference, prompts and responses never need to leave the machine.

That makes local models particularly attractive for sensitive documents, proprietary source code, personal records, or other information users do not want uploaded to external services.

There is a trade-off.

Smaller models capable of running comfortably on consumer hardware generally remain less capable than the largest frontier models running in enormous cloud data centers. Privacy therefore often comes at the cost of intelligence, speed, convenience, or hardware requirements.

Cost is another important trade-off.

Confer, for example, offers a limited free tier but charges $34.99 per month for its lowest paid plan, compared with roughly $20 for the entry-level paid subscriptions of several mainstream AI assistants.

Marlinspike argues that this difference reflects the real economics of operating AI without depending on advertising or future monetization of user information.

Whether privacy-focused AI companies can build sustainable businesses around that model remains uncertain.

The broader lesson is that users increasingly need to think about AI conversations differently from ordinary web searches.

A single prompt may reveal little. Months or years of conversations can reveal an extraordinary amount about someone’s identity, habits, relationships, finances, health, work, and beliefs.

Privacy-preserving AI already exists through local models, contractual data-retention protections, and newer technologies such as trusted execution environments.

But there is still a fundamental trade-off between capability, convenience, cost, and privacy. The most private AI may not always be the cheapest or smartest one — and the smartest cloud AI may not be the place to share information you cannot afford to expose.