Skip to Content

IAPP Europe Congress 2026

Privacy | AI governance | Cybersecurity law

BRUSSELS

16-19 November

Back to conference agenda

The Battle Over Your Chatbot Logs: Government Access, Discovery, Solutions

Wednesday, 18 Nov.

16:45 - 17:45 CET

Intermediate level

BREAKOUT SESSIONAI GOVERNANCEPRIVACYAI AND MACHINE LEARNINGDATA SECURITYGOVERNMENT ACCESSINTERNATIONAL DATA TRANSFERSRISK MANAGEMENTHEALTHCARELEGALTECHNOLOGY

Over one billion people now use AI chatbots weekly, confiding health fears, legal strategies, business plans and intimate personal reflections. Yet these conversations enjoy no legal privilege and can be accessed through at least four distinct pathways that existing privacy frameworks were not designed to govern. This session presents findings from the first comparative study of third-party access to consumer chatbot logs across five major providers (ChatGPT, Claude, Gemini, Grok, DeepSeek). Drawing on recent cases, including the Tumbler Ridge and Strasbourg law-enforcement referrals, the first reverse prompt warrant served on OpenAI, the court-ordered production of 108 million ChatGPT conversations in copyright litigation and the risks posed by FISA 702 to European users, the panel maps the full architecture of access: proactive corporate disclosure to police, compelled government access by law enforcement and intelligence agencies, civil discovery at unprecedented scale and cyberthreats. It concludes with concrete architectural and regulatory proposals, including the case for a "Sealed Mode" for sensitive conversations, and the critical trade-off between cryptographic hardening and content-based safety monitoring.

What you will learn:

  • Whether your chatbot use for legal, business, health, or strategic purposes exposes confidential information to government requests, discovery, or breach. 
  • Why conversations your people have on consumer chatbots could surface in litigation, government investigations, or cross-border police referrals to which your company or institution is not a party. 
  • What privacy teams should be advising now, from acceptable-use policies to demanding Sealed Mode and zero-retention options from providers.

Featured in this session

headshot of Théodore Christakis

Théodore Christakis

Chair, Legal & Regulatory Implications of AI, Multidisciplinary Institute in AI

University of Grenoble Alpes

headshot of William Malcolm

William Malcolm

Executive Director of Regulatory Risk and Innovation

U.K. Information Commissioner's Office

headshot of Peter Swire

Peter Swire

CIPP/US

Professor, Georgia Tech and Senior Counsel

Alston & Bird