If OpenAI promises to use your data one way — and, in fact, upsells you on that promise — and then gets caught using it another way, that’s a huge lawsuit, not to mention immediate violation of EU privacy laws. Given the size of OpenAI, the consequences they’d face would be detrimental to their operation, and the reward for the whistleblower would be well worth it to reveal what’s going on.

Not true. Such a reveal already happened ages ago with regular old non-AI huge US tech companies. It was revealed they leak data (on an unlimited scale, actively, secretly, knowingly and purposefully without admitting it).

The data leaking was then further legalized by (almost) all Western governments and extended from secret services to other services (police, army, etc).

I'm talking about Snowden.

Is it? Whistleblowers rarely avoid major headaches, let alone get some form of reward for their public service. And we have tons of examples of companies collecting, selling, or leaking private data illegally, with zero or negligible consequences.

You're saying how things should be, not how they are.

Thankfully we have contact law. Imagine if nobody did business with anyone else unless they had a zero trust system set up.

You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.