What is the difference between training and inference?

In training, user data is used to improve the model; that is the most privacy-sensitive. In inference, a single question is processed to generate an answer, which is technically necessary and less sensitive, although the data may be stored for a while.

Do the big AI platforms use my conversations for training?

It differs and policies change. OpenAI uses ChatGPT conversations to improve its models unless the user turns that off, with business and API customers excluded by default. Google lets users manage Gemini activity in their settings. Anthropic asks consumer users to choose whether their chats may be used for training. Check each platform's current terms.

Which privacy rules apply to AI search in the US?

There is no single federal privacy law. A growing number of states, led by California's CCPA as amended by the CPRA, give consumers rights to know, delete and opt out of the sale or sharing of their data. The FTC also acts against unfair or deceptive data practices, including around AI. If you serve people in the EU, the GDPR applies too.

Why is attribution getting harder?

Because AI search engines share less data with website owners. You get no keyword data, so you do not know which prompt led to a visit; not every platform passes referrer information; and you know nothing about the visitor's profile. The way out is proxy metrics and first-party data.

Should I allow or block AI crawlers?

That is a deliberate trade-off. Allowing them brings visibility and citations but costs control; blocking keeps control but makes you invisible in AI answers. For most businesses the visibility outweighs the loss of control.

AI search and privacy: CCPA, GDPR and your data

Future of Search

March 28, 2026updated October 18, 2026GreatCompany

More customers from Google and ChatGPT?

Join the waitlist. Your free report shows what to improve on your site and who ChatGPT mentions instead of you.

Free reportNo payment details for your reportOpening in the US soon

AI search engines know more about their users than any search engine ever has. When someone tells ChatGPT “I run a business with 15 employees in Chicago and I need a CRM that is not too expensive”, that person shares more context in one prompt than in ten Google searches.

That raises fundamental privacy questions. How do AI platforms handle this data? What do US state privacy laws and the GDPR mean for AI search? And what is the impact on marketers and content creators?

How AI search engines use data

Conversation data

Every interaction with an AI search engine generates conversation data:

The questions asked (with personal context)
The answers given
Follow-up questions and feedback
Uploaded files (photos, documents)

Training vs inference

There is a crucial distinction:

Training: user data is used to improve the AI model. This is the most privacy-sensitive. OpenAI, Google and Anthropic have different policies, and they change, so always check the current terms:

OpenAI: ChatGPT conversations are used to improve models unless the user turns that off. Business and API customers are excluded by default.
Google: Gemini activity can be used for improvement. Users manage this in their activity settings.
Anthropic: consumer users choose whether their Claude chats may be used for training.

Inference: processing a single question to generate an answer. This is technically necessary and less privacy-sensitive, but the data may be stored for a while.

Personalization

AI search engines personalize answers based on:

Earlier conversations and saved memories
User profile and preferences
Location data (for local questions)
Linked accounts (Google account, Microsoft account)

That makes AI answers more relevant, but also increases the privacy risks.

Privacy law and AI search

In the United States

The US has no single federal privacy law. Instead, a growing patchwork of state laws applies, led by California’s CCPA, as amended by the CPRA. These laws give consumers rights such as knowing what data is collected, having it deleted and opting out of the sale or sharing of their data. California’s privacy agency has also been working on rules for automated decision-making technology. Next to the states, the FTC acts against unfair or deceptive data practices, and has made clear that this includes how companies collect and use data for AI.

In the European Union

If you serve people in the EU, the GDPR applies, with strict requirements for processing personal data. How those play out for AI models is worked out by the European data protection regulators in EDPB Opinion 28/2024, on model anonymity, legitimate interest as a legal basis and unlawfully collected training data. Under the GDPR, AI search engines must meet:

Lawfulness: there must be a valid legal basis for processing (consent, legitimate interest or contract).

Purpose limitation: data may only be used for the purpose for which it was collected.

Data minimization: only the necessary data may be processed.

Right to erasure: users must be able to have their data deleted.

European regulators are active: Italy temporarily blocked ChatGPT in 2023 over GDPR concerns, the EU AI Act adds requirements for AI systems, and several investigations into AI companies are ongoing.

The tension

AI models learn from data. The more data, the better the model. Privacy laws limit how much data may be used and for which purpose. That creates tension:

Users want personalized, accurate answers (which needs data)
Privacy laws limit how that data may be processed
AI companies navigate a gray area

Impact on marketers

Tracking gets harder

AI search engines share less user data with website owners than traditional search engines:

No keyword data: you do not know which prompt led to a visit
Limited referrer data: not all AI platforms pass referrer information
No user profile: you know nothing about the AI user visiting your site

That makes attribution harder. The solution: shift to proxy metrics (branded search, post-purchase surveys) and first-party data.

The combination of privacy law and AI changes the consent dynamic:

Cookie consent matters less when users visit fewer websites
First-party data becomes more valuable
Server-side tracking gains importance

Content and personal data

If your content contains personal data (testimonials with names, case studies with company names), AI models can process and spread that information further. Make sure you have permission to use personal data in content that AI models can read.

Impact on content creators

The rights to your content

A fundamental question: when an AI model cites or summarizes your content, what about copyright? This is an evolving legal landscape:

AI models were trained on web content, often without explicit permission from authors
Citations in AI answers resemble citations in journalism, but the scale is different
Robots.txt offers an opt-out mechanism, but it is not a legally enforceable contract. How to set up that file is in how AI crawlers read your site.

The choice: opt in or opt out?

Content creators face a dilemma:

Opt in (allow AI crawlers): your content gets cited and you gain visibility, but you lose control
Opt out (block AI crawlers): you keep control, but you become invisible in AI answers

For most businesses, opting in is the better choice: the visibility outweighs the loss of control. But it is a trade-off to make deliberately.

What you can do now

1. Privacy audit of your content

Check whether your content contains personal data that could spread through AI models:

Testimonials with full names and titles
Case studies with identifiable company data
Employee contact details

Make sure you have permission for all of it.

2. Prioritize first-party data

Build your own database of customer data through direct channels:

Email newsletters
Accounts and profiles
Communities and forums
Direct customer feedback

3. Be transparent about AI use

If you use AI tools yourself for content or customer service, say so clearly. Regulators increasingly expect it.

4. Monitor laws and regulations

State privacy laws, the AI Act and how regulators interpret them evolve fast. Keep up and adjust your strategy.

This is general information, not legal advice.

Summary

Privacy and AI search are in tension. Users share more personal information with AI than they ever did with traditional search engines. Privacy laws set limits, but practice moves faster than regulation.

For marketers this means: prepare for less tracking data, invest in first-party data and make sure your own content respects privacy rules.

Read more in the future of search, or see the technical GEO checklist for implementation details.

Read on

GEO glossary

Frequently asked questions

What is the difference between training and inference?: In training, user data is used to improve the model; that is the most privacy-sensitive. In inference, a single question is processed to generate an answer, which is technically necessary and less sensitive, although the data may be stored for a while.
Do the big AI platforms use my conversations for training?: It differs and policies change. OpenAI uses ChatGPT conversations to improve its models unless the user turns that off, with business and API customers excluded by default. Google lets users manage Gemini activity in their settings. Anthropic asks consumer users to choose whether their chats may be used for training. Check each platform's current terms.
Which privacy rules apply to AI search in the US?: There is no single federal privacy law. A growing number of states, led by California's CCPA as amended by the CPRA, give consumers rights to know, delete and opt out of the sale or sharing of their data. The FTC also acts against unfair or deceptive data practices, including around AI. If you serve people in the EU, the GDPR applies too.
Why is attribution getting harder?: Because AI search engines share less data with website owners. You get no keyword data, so you do not know which prompt led to a visit; not every platform passes referrer information; and you know nothing about the visitor's profile. The way out is proxy metrics and first-party data.
Should I allow or block AI crawlers?: That is a deliberate trade-off. Allowing them brings visibility and citations but costs control; blocking keeps control but makes you invisible in AI answers. For most businesses the visibility outweighs the loss of control.

See whether ChatGPT mentions your business.

Join the waitlist. When GreatCompany opens in the US, you get your first report right away: who ChatGPT recommends in your market and what to improve on your site.

Free to join. When we open in the US, your free AI visibility report is first in line.

Curious what AI crawlers see on your site? About the technical scan Pro $49, you do it yourself · Or automate your SEO for $99, built for WordPress