(1) With limited well scoped exclusions for lawyers, medical records, erc.
Legally that is a correct statement.
If you want that changed, it will require legislation.
We'd have a better chance if anyone with power were talking about court reform to make the Supreme Court justices e.g. drawn by lot for each session from the district courts, but approximately nobody is. It'd be damn good and long overdue reform, but oh well.
And the thing is, we've already had a fairly conservative court for decades. I'm pretty likely to die, even if of old age, never having seen an actually-liberal court in the US my entire life. Like, WTF. Frankly, no wonder so much of our situation is fucked up, backwards, and authoritarianism-friendly. And (sigh) any serious attempts to fix that are basically on hold for many decades more, assuming rule of law survives that long anyway.
[EDIT] My point, in short, is that "we still have [thing], we just have to wait for a liberal court that'll support it" is functionally indistinguishable from not having [thing].
A company like OpenAI that offers a SaaS is no such friend, and in such power dynamics (individual VS company) it's probably in your best interest to have everything public if necessary.
Why tangle the data of people with very different preferences than yours up in that?
First time?
As others have said, in the United States this is, legally, completely correct: there is no right to privacy in American law. Lots of people think the Fourth Amendment is a general right to privacy, and they are wrong: the Fourth Amendment is specifically about government search and seizure, and courts have been largely consistent about saying it does not extend beyond that to e.g. relationships with private parties.
If you want a right to privacy, you will need to advocate for laws to be changed; the ones as they exist now do not give it to you.
As it stands today, a court case (A) affirming the right to use contraception is not equivalent to a court case (B) stating that a phone-company/ISP/site may not sell their records of your activity.
You conflate the absence of a statutory or regulatory regime governing private data transactions with the broader constitutional right to privacy. While it’s true that the Fourth Amendment limits only state action, U.S. constitutional law, via cases like Griswold v. Connecticut and Lawrence v. Texas, and clearly recognizes a substantive right to privacy, grounded in the Due Process Clause and other constitutional penumbras. This is not a semantic variant; it is a distinct and judicially enforceable right.
Moreover, beyond constitutional law, the common law explicitly protects privacy through torts such as intrusion upon seclusion, public disclosure of private facts, false light, and appropriation of likeness. These apply to private actors and are recognized in nearly every U.S. jurisdiction.
Thus, while the Constitution may not prohibit a website from selling your data, it does affirm a right to privacy in other, fundamental contexts. To deny that entirely is legally incorrect.
While these grand theories of traditional implicit constitutional law are nice, they're pretty meaningless in a system where five individuals can (and are willing to) vote to invalidate decades of tradition on a whim.
I too want real laws.
Common law requires a high threshold of offensiveness and are adjudicated on a case-by-case in individual jurisdictions. They offer only remedies and not a proactive right to control your data.
The original point, that there is no general right in the US to have your interactions with a company remain private, still stands. That's not a denial of all privacy rights but a recognition that US law fails to provide comprehensive privacy protection.
“As others have said, in the United States this is, legally, completely correct: there is no right to privacy in American law.”
That is an incorrect statement. The common law torts I cited can apply in the context of a business transaction, so your statement is also incorrect.
If you’re strawman is that in the US there’s no right to privacy because there’s no blanket prohibition on talking about other people, and what they’ve been up to, then run with it.
I completely disagree. Yes, the Prosser privacy torts exist: intrusion upon seclusion, public disclosure, false light, and appropriation. But they are highly fact-specific, hard to win, rarely litigated, not recognized in all jurisdictions, and completely reactive -- you get harmed first, maybe sue later!
They are utterly inadequate to protect people in the modern data economy. A website selling your purchase history? Not actionable. A company logging your AI chats? Not intrusion. These torts are not a privacy regime - they are scraps. Also when we're talking about basic privacy rights, we just as concerned with mundane material not just "highly offensive" material that the torts would apply to.
If don’t want the grocery store telling people you buy Coke, don’t shop there.
As for Safeway selling your data: you're admitting that it's on the individual to opt out, negotiate, or avoid the transaction which just highlights the absence of a rights-based framework. The burden is entirely on the consumer to protect themselves, and companies can exploit that asymmetry unless narrowly constrained by statute (and even then, often with exceptions and opt-outs).
What you're describing isn't a right to privacy -- it's a lack of one, mitigated only by scattered laws and personal vigilance. That is precisely the problem.
Why should two entities not be able to have a confidential interaction if that is what they both want? Certainly a court order could supersede such a right just as it could most others provided sufficient evidence. However I would expect such things to be both highly justified and narrowly targeted.
This specific case isn't so much about a right to privacy as it is a more general freedom to enter into contracts with others and expect those to be honored.
Is this referring to some actual legal precedent, or just your personal opinion?
You might have heard of the GDPR, but even before that, several countries had "privacy by default" laws on the books.
Your comment is dystopian given how the interaction is basically like how some people treat ai as their "friend" imagine no matter what encrypted messaging app or smth they use, the govt still snoops
Third-party privacy and relevance is a constant point of contestion in discovery. Exhibit A: this article.
How? It’s compelling OpenAI retain data they have the contractual right and technical ability to retain. Nothing is being made public, other than the order itself. Nothing is even being transferred to the plaintiff’s legal team. (At some point it will be made available. But both sides will fight over what they have access to, with the court mediating. That’s a lot of regard for third parties’ privacy.)
I do want to take this opportunity to encourage people to demand compensation from the NYT, if they do somehow get user data. After all, it's YOUR data. If someone uses it without you expressly agreeing to that use in a EULA, they are effectively engaging in piracy of your intellectual property, and you should be able to get damages. And if a judge approved it? Sue the judge, too. Hell, that's what the world has come to isn't it? The legal system is a big war between corporations and we, the people, are just carried on the wind.
(I am not a lawyer, but whatever the equivalent of a "lawyer" is in the court of public opinion, I think I'm slowly becoming one out of necessity)
You were so close. It’s compelling OpenAI to retain data they also have the right and technical ability to delete. It removes OpenAI’s ability to protect privacy if they wanted to.
It does not in any capacity prevent OpenAI from transferring everyone, globally, to zero data retention. This entire story is OpenAI trying to deflect the cost of its own decisions to the judiciary. Which is particularly shameful given the partisan attacks our courts are currently facing.
In the API that is an explicit option, as well as in the paid consumer product as well. The amount of business that they stand to lose by maliciously flouting that part of their contract is in the billions.
If you read the privacy policies you agree to, they have access to everything and outright admit it will be logged. That API option is merely a request, and absolutely need not be respected.
I can't believe we're still doing this rigamarole. If the product is not specifically designed, engineered, and open-sourced to be as privacy protecting as possible and it's not literally running on a computer you own, you have zero expectation of privacy. Once this has been proven 1 million times we don't need to prove it anymore, we can just assume and that's a very reasonable assumption.
Large companies lose far more by lying than they would gain from it.
Of course it's out of self-serving interests, but I find it hard to disagree with OpenAI on this one.