> ## Content Index
> Fetch the complete content index at: https://www.frontiermodels.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ChatGPT contractors read sensitive chats, 404 Media reports
- URL: https://www.frontiermodels.com/news/chatgpt-contractors-read-sensitive-chats-404-media-reports/
- Published: 2026-09-15T09:49:45.000Z
- Updated: 2026-09-15T09:49:45.000Z
- Description: Project Lily reviewers can receive conversations and memory summaries without usernames. Training opt-outs protect new chats but do not prevent all human access.
- Author: Frontier Models Desk
- Tags: News, openai, chatgpt, #candidate

Outside contractors working on OpenAI’s Project Lily read real ChatGPT conversations that can contain sensitive personal information, [404 Media reports](https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/?ref=frontiermodels.com). Reviewers reportedly receive no ChatGPT usernames, but some tasks include whole conversations and summaries of a user’s past interactions, including location and other personal context.

That means removing an account name does not necessarily strip a conversation of intimate details. For people using ChatGPT to discuss personal problems or draft private messages, the report reveals a human audience behind an exchange that can feel one-to-one. OpenAI says users can exclude new conversations from model training, although that does not prevent every kind of human access.

OpenAI’s [consumer data FAQ](https://help.openai.com/en/articles/7039943-data-usage-for-consumer-services-faq?ref=frontiermodels.com) explicitly permits authorized employees and trusted service providers to access content for model improvement unless a user opts out. It also gives this warning:

> “Please do not enter sensitive information that you would not want reviewed or used.”
> 
> OpenAI, Data Usage for Consumer Services FAQ

That warning puts a practical boundary on the assistant’s private tone. The policy discloses human access; 404’s reporting describes what one such review process can put in front of a contractor.

Joseph Cox reports examining internal guides, Slack channels, a contractor dashboard, a rating system and multiple real prompts. In the workflow he describes, reviewers summarize what the user wants, then critique four generated replies and score each from one to seven. The materials did not identify which current or future OpenAI model Project Lily supports. Frontier Models has not independently inspected the leaked material.

According to 404, reviewers are instructed to escalate tasks containing personal information or safety concerns. The outlet withheld the prompts to protect its source, so readers cannot independently assess the sensitive details it describes.

OpenAI told 404 that conversations pass through a version of its Privacy Filter before reaching contractors. The company’s [public description of that technology](https://openai.com/index/introducing-openai-privacy-filter/?ref=frontiermodels.com) says it is not an anonymization tool and can miss uncommon identifiers or ambiguous private references. No Project Lily-specific error rate is published. OpenAI also says human access is restricted, logged and subject to confidentiality obligations and privacy training; those safeguards have not been independently audited for this workflow.

## What the controls actually prevent

OpenAI’s policies establish which conversations may be used for training, but they do not disclose how Project Lily selects its tasks. Eligibility does not mean every conversation is read. Personal Free, Plus and Pro workspaces share data for training by default, according to [OpenAI’s help documentation](https://help.openai.com/en/articles/8983130-what-if-i-want-to-keep-my-history-on-but-disable-model-training?ref=frontiermodels.com).

| Chat or account setting               | Model-training use                                                                             | Remaining human access                                                                                |
| ------------------------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| Personal chats, default settings      | Eligible for training; Project Lily’s selection rules are not published.                       | Authorized access for model improvement, abuse or security investigations, support and legal matters. |
| Personal chats, training switched off | New conversations excluded. Submitting feedback can make the associated conversation eligible. | Abuse, security, support and legal access remain possible.                                            |
| Temporary Chat                        | Not used for training.                                                                         | May be reviewed only to monitor for abuse.                                                            |
| Business, Enterprise, Edu and API     | Excluded by default unless explicitly opted in.                                                | Product-specific exceptions remain; exclusion from training does not guarantee no human access.       |

To exclude new personal chats, turn off “Improve the model for everyone” under Settings, then Data Controls. OpenAI’s [Data Controls FAQ](https://help.openai.com/en/articles/7730893-data-controls-faq?ref=frontiermodels.com) says the choice applies across the account’s devices and lets users retain their chat history. Temporary Chats avoid training, history and new memories, and are deleted after 30 days, according to the same FAQ.

There is a consequential exception: if an opted-out user submits thumbs-up or thumbs-down feedback, OpenAI says [the entire associated conversation may be used for training](https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance?ref=frontiermodels.com). It does not say whether those conversations enter Project Lily specifically. Separately, [business-product protections](https://openai.com/enterprise-privacy/?ref=frontiermodels.com) exclude training by default but retain access for specified purposes, such as abuse review or legal requirements, depending on the product.

These controls also offer no promise of retrieving material already reviewed. The opt-out applies to new conversations. OpenAI says deleted chats are normally removed within 30 days, with exceptions for content already de-identified and separated from the account, or retained for security or legal reasons. Its policies do not explain whether deletion withdraws existing Lily tasks or annotations; the reporting does not establish that such records survive deletion, either.

We would treat the training switch as a meaningful control over future use. For a conversation whose contents must never reach another person, however, it provides no such assurance.