Does an AI assistant keep, or learn from, what I give it?

What to look for in the terms

Two documents decide this leg: the terms you agreed to when the account was opened, and the settings behind them. The OAIC's guidance describes what some products do. Some commercial AI products will include terms or settings that allow the product owner to collect the data input by customers for further training and development of AI technologies, with the potential for personal information input into an AI product then surfacing in response to a prompt from another user.

IP Australia puts the same thing in plainer words: each AI tool comes with its own terms of use, and some may state that the company that owns the tool can store or reuse anything you upload. It adds a caution of its own: while certain AI models allow you to opt out of having your data used for training, your data may still be stored.

And its instruction is the reason this section exists: ensure that you familiarise yourself with the terms and conditions of your chosen tool to understand who owns the IP of the created works.

The questions to put to a supplier

The National AI Centre's Questions to ask AI suppliers arrives with its own advice: you do not need to ask every question, and the ones to start with are those that matter most for the task at hand, especially where the risk or impact is higher. Each of its sections gives questions to ask suppliers, what to check for in a good answer, and what to capture in writing. The questions it sets on data, and on exit, put to your own account:

• What data does the system collect, store or process?
• Will any of your data be used to train the models, now or later?
• Does any of it go to third parties, such as cloud providers or subcontractors?
• Where is the data stored or processed, including offshore locations?
• Can the AI features be limited or switched off to restrict how data is used?
• Who owns the data you put in, and the outputs it generates?
• What happens to your data if you stop using this solution?
• Can you export the data in a usable format?
• How is the data deleted after exit?

Two shapes of answer are named as the ones to look for: clear explanations of data flows and data use, and an ability to control, limit or opt out of certain uses of the data.

Retention, deletion and getting your data back

The answers belong in writing. The same guide lists what to capture, and on the data side those items are data ownership, retention and deletion terms, a clear statement on whether the data is used for training, and security responsibilities and breach notification processes. On the way out, the exit section asks for exit and termination terms, and for data export and deletion commitments. Together they are the paper trail a business can point to later.

The ACCC's snapshot, published on its media centre, shows why the terms are hard to read. It reveals that vast amounts of consumer data is currently already collected and used to train AI models, often without consumers' knowledge or informed consent, in part because of the length, complexity and ambiguity of online terms of service and privacy policies. That finding is about consumers and the companies collecting their data. It is also the reason the questions above are worth asking before the account is opened rather than after.

Where the servers are

One station on the out leg is about place. The OAIC's guidance asks a business that will deploy a generative AI system through the cloud to consider the security and privacy risks of that, including where the servers are located and whether personal information could be disclosed outside of Australia. The supplier list asks the same thing in its own words: where is the data stored or processed, including offshore locations.

The rule that follows the answer sits in the privacy policy. The OAIC's APP 1 guidelines say an APP privacy policy must set out whether personal information is likely to be disclosed to overseas recipients and the countries in which such recipients are likely to be located, if it is practicable to specify those countries in the policy (APP 1.4(f) and 1.4(g)). So place is not only a risk question. It is a disclosure question, and the policy is where the public half of the answer lives.

The other end of the same pipe

The far end of the out leg is why the In leg is worth so much care. The OAIC's guidance gives the mechanism: terms or settings can let the product owner collect what customers input, for further training and development of AI technologies, and that is how personal information input into an AI product can surface in response to a prompt from another user. Its limit is stated as plainly: once personal information has been input into AI systems, particularly generative AI products, it will be very difficult to track or control how it is used, and potentially impossible to remove the information from the system.

What happens depends on the product and on its settings. That hedge is why the terms, and the answers a supplier gives about them, are where a real answer can be found.