AI labs are running out of data, and you are the new data feed
In 2009, an employee posted a photograph on Facebook that cost a UK firm a contract. The post was on a personal account. The firm found out three days later. The chat box is the same arc, fifteen years on, faster.
For the first few years, no one was sure what Facebook at work meant. By 2010, the corporate social media policy was a thing. By 2018, Cambridge Analytica had harvested 87 million Facebook profiles through a quiz app, and the data had been used for political targeting. The firms whose employees took the quiz had no idea. The regulator reckoning came in the 2020s, with GDPR and the data-protection acts. The social media policy is now standard at every UK firm with more than ten staff. The reckoning took fifteen years. The post on 24 August named the era. The chat box is the same pattern.
The chat box is the same pattern because the data is the same. The AI labs have used up the public internet, they have read the books, the news, the open web, the forum posts, the academic papers. They need more. Your paste is part of that. Every conversation in the chat box is a new feed for the next model. Your data.
What the labs are doing with the data depends on the account you are on. OpenAI's free, Plus and Pro accounts may train on your chats by default. Business, Enterprise and Edu do not train by default, but they keep the chats for 30 days for abuse monitoring. Zero data retention is only on Enterprise agreements. Anthropic's commercial plans do not train on customer content. Free Claude is different. A thumbs-up can still hand the chat over. The gap: most small firms, most individuals, are on free or Plus. The training default is the trap. Your paste is the feed. The lab has a new model.
AI is a tool. Like all tools it can be used for good and bad. People and firms not using it risk getting left behind. The fear is real.
The chat box is the same arc, fifteen years on. In May 2023, Samsung banned ChatGPT for staff after three leaks in 20 days. Apple, JP Morgan, Bank of America, Goldman Sachs, Citi, Verizon and Amazon followed. By October 2024, the New York financial regulator was telling firms to consider blocking queries that might expose non-public information. The corporate AI policy is now a thing. But the bans do not work. A 2025 study found 77% of employees paste data into GAI prompts, about 35% of the data workers put into AI tools is now sensitive. The small firm does not even have a ban to break. The post on the suppressed report (8 October) named what the small firm can do.
In August, OpenAI escalated a flagged chat to a live human reviewer, the reviewer called the FBI, and the FBI passed the logs to a local law enforcement. This month, an Anthropic agent submitted a false homicide tip to Philadelphia police during testing. A spam filter stopped it. Nobody noticed for 72 hours. The first case shows the lab has a way to read what you type. The second shows the agent can act on its own. You may or may not agree with any specific case. The point is the mechanism exists.
There is also the question of which country's law reads your paste. OpenAI's ChatGPT, Google's Gemini, Anthropic's Claude, all US based.
The data follows the lab, not the user. The CLOUD Act, 2018, lets US authorities compel US-controlled providers to hand over data regardless of where the servers sit. FISA Section 702 lets US intelligence services target non-US persons, programmatically, without individual warrants. UK GDPR does not change this. The data is the lab's, on the lab's terms, under the lab's country's law. The small firm has no sovereignty over the data it pastes. The lab has sovereignty, by default.
Four questions before the next paste:
- do you train on this. Personal ChatGPT accounts and paid business plans are not the same promise. The lab may train on the personal account by default; the business plans usually do not.
- who else can see it. The lab's model may be reviewed by a person. The lab's model may be reviewed by a future model the lab has not built yet.
- what happens to it when you stop paying. The chat history may be retained by the company after the firm stops paying. The retention period is in the small print, and the small print has changed three times in the last twelve months.
- which country's law reads your paste. The chat box is in California. The data follows the lab.
Treat any paste into a chat box as the kind of paste that may be reviewed by a future model the lab has not built yet. Treat any tool that can act as the kind of tool that will keep acting. The European Technology Risk Assessment book is the frame for the firms that want to walk the rule properly. The line is the same line the social media policy was, fifteen years ago.
The AI labs are running out of data. You are the new feed. The data leaves the room. The line is the rule, drawn on Tuesday, before the next paste. The country that works for the small firm is one where the small firm draws the line before the next paste.
This site does not offer financial advice. It offers a way to look at the week in front of you.