Nobody trusts Anthropic's ZDR, in the limited cases where they even offer it. The key thing is that weight activation sequences from a query are not "customer data" they are internal Anthropic data. So in Anthropic's legal theory they are training on their own internal data, not "customer data," and that is perfectly legal, even though it is the exact same thing in practice as training directly on customer data.