Industry30 Oct 20267 min read

AI privacy news in October 2026: what changed

A court allowed subpoenas for deleted AI chats, a study traced chat data to trackers, and NVIDIA, Google, and Cohere moved more AI into enclaves.

Figure from a paper by IMDEA Networks: lines connect nine AI chat services on the left to third-party services such as Google Ads, Meta, and TikTok on the right, for web clients and for Android clients. — Figure: Oliveira et al., IMDEA Networks, CC BY 4.0

A US court allowed subpoenas to four AI providers for one defendant's chats, deleted ones included, on 21 October 2026, the same day NVIDIA and Google moved more AI into trusted execution environments (TEEs).

In AI privacy, October also brought a study of trackers in nine AI chat services, an exposure of chat logs at an AI aggregator, complaints over the tracking of AI data workers, and a new EU position on personal data in AI.

A court order covers deleted AI chats

In a 21 October order, the US District Court for the Southern District of Florida said Fontainebleau Florida Hotel may serve subpoenas on four AI service providers in its defamation suit. The suit is at the damages stage. The hotel seeks punitive damages without Florida's statutory cap, and the court found that some of the defendant's AI chats bear on alleged intent.

The subpoenas may cover chats since 3 December 2024 about the hotel, its lawyers, and its employees, owners, or representatives, including chats on those subjects that were later deleted. The court refused requests about the litigation itself, its orders, and its judges, and it refused to make the defendant consent to the subpoenas.

The court "emphasizes that a party's communications with and use of AI does not automatically establish either discoverability or protection," Magistrate Judge Marty Fulgueira Elfenbein wrote. The parties must first confer on how the providers, "to the extent they have responsive materials," will be instructed to produce them. The order names no provider, and it compels none: "Nothing in this Order compels a nonparty provider to produce information or resolves objections that may be raised by a subpoena recipient."

Where data goes in AI services

Researchers at IMDEA Networks in Madrid measured the web and Android clients of nine AI chat services: ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, MS Copilot, Mistral, and Meta AI. Every service contacted at least one advertising or tracking service (ATS), and the paper counts 124 third-party domains from 44 organizations.

Six of the nine web clients and three of the eight Android clients sent conversation URLs, titles, prompts, or screenshots to third parties. A user's choice changes the result: 77.3% of the web identifiers sent to third parties went only after a user accepted non-essential cookies, while trackers still collected data in four of nine free-tier services after a user rejected them.

EUobserver reported on 1 October that the paper is accepted for publication next year. After a preview in May, Spain's data protection agency, the AEPD, asked the European Data Protection Board to share the preliminary findings with its European counterparts.

On 21 October, Cybernews reported that 302.ai, an AI aggregator, had left 17.6 million files, 22.72 TB in all, in a public Microsoft Azure storage bucket, among them more than 144,000 chat logs. Cybernews found the bucket on 2 August and saw it closed on 8 September, after contacting the company. It reported no sign that bad actors had viewed or copied the files.

On 27 October, the privacy group noyb and three partners filed five GDPR complaints in four EU countries against Scale AI, which runs Outlier, an AI data annotation platform with more than 900,000 freelance workers. The complaints allege that trackers from companies such as TikTok, LinkedIn, and Facebook run on workers' devices without a valid legal basis, and that Scale did not answer requests for access to the data. The group asks the authorities to investigate and impose a fine.

"The report's claims are unfounded and inaccurate," Scale told The Register, adding that "Outlier's practices are disclosed to contributors and require their consent."

New rules in Europe and California

The Council of the EU's Permanent Representatives Committee agreed its mandate on the Digital Omnibus, a bill that amends the GDPR, on 21 October. Under the text, developing and operating AI may rest on legitimate interest under GDPR Article 6(1)(f), unless another law requires consent or a person's rights override that interest, in particular where the person is a child.

The text adds that "the development and operation of an AI system or AI model does not in itself constitute a legitimate interest," so each case needs its own assessment. The Council must still negotiate with the European Parliament.

In California, a 5 October alert from the law firm Latham & Watkins counted "more than two dozen AI laws" enacted in the 2026 session. AB 1979 treats businesses that offer healthcare chatbots as providers under the state's Confidentiality of Medical Information Act, and AB 1159 prohibits the use of student information to train generative AI or develop AI systems.

Confidential computing spreads through chips and clouds

Intel wrote on 9 October that it is "focusing its Confidential Computing roadmap on Intel TDX," its Trust Domain Extensions, and that Diamond Rapids, its next Xeon platform, "will be the last to include Intel SGX." Its work with NVIDIA, Intel wrote, "extends data and model protection across the AI pipeline."

NVIDIA announced Confidential Bare Metal on 21 October, a deployment option that lets frontier model builders run sensitive workloads on dedicated third-party servers. Cohere plans to integrate it into Model Vault, and Google Cloud is extending it to its A4X Max instances.

Google Cloud made Confidential G4 generally available the same day, on NVIDIA RTX PRO 6000 Blackwell GPUs. In its own tests of AI inference, Google found "less than 3.5% degradation in throughput" against standard G4.

Cohere opened a public beta of confidential computing in Model Vault on 22 October, on NVIDIA H100 GPUs on Microsoft Azure. Its client software verifies signed evidence of the environment before it sends data: "If the environment does not satisfy the policy, the client refuses to send the request."

Also in October, Opaque said its team is joining Anthropic, and Microsoft published a reference architecture for sensitive AI on Azure, as we reported in Five weeks, seven giants.

Chat apps add privacy features

Brave added end-to-end encryption to chats with GLM 5.3 Flash in its Leo assistant on 15 October. The browser encrypts each prompt with Oblivious HTTP to a TEE that NEAR AI runs on Intel TDX CPUs and NVIDIA GPUs in confidential computing mode. Brave's gateway verifies the remote attestation today, and Brave plans to move that verification into the browser.

OpenAI began rolling out Locked Chats in ChatGPT on 20 October. A locked chat moves to a separate section that opens with a four-digit PIN, Face ID, or Touch ID, which keeps it from others who can see the screen or device. Locking does not "create end-to-end encryption or a separate encrypted vault," OpenAI's help page says.

Eternal, the parent of Zomato and Blinkit, announced Dark.ai in its shareholders' letter on 21 October: an AI assistant with end-to-end encryption and an encrypted memory layer that users control, running fine-tuned open-weight models on Eternal's own infrastructure. Eternal hopes to launch it globally within 2026, Open magazine reported.

What it means for you

A subpoena reaches what a provider can produce, and a tracker collects what a page lets it collect. October's launches put TEEs in more chips, clouds, and apps, so more AI can run where the people who operate the servers see only ciphertext.

Thinkr's private lane, the default, uses that design. Your browser verifies the enclave's remote attestation, then encrypts each chat to the enclave with HPKE (RFC 9180). Thinkr's proxy carries only ciphertext, so Thinkr can't read those chats. The optional backup holds only an encrypted copy, which Thinkr cannot decrypt, and the site and the app set no cookies and load no analytics scripts or ads.

In ZDR and Open, the provider of the model reads the chat to answer it, and Thinkr's proxy can read it in transit. Thinkr labels every model with its mode, and you can try the private lane free, with no account.