This is general information about privacy and organizational risk, not legal advice. If a specific request, subpoena, or investigation touches your organization, get advice from a lawyer.
Short answer: yes, but the risk is smaller and more specific than the headlines suggest. AI companies say they will hand over conversation content to law enforcement when compelled by valid legal process, and two of the three major vendors have published figures confirming they have done so. For most animal advocates, day-to-day organizational work creates no special exposure. A smaller set of genuinely sensitive conversations — safeguarding, confidential sources, legal strategy, security-sensitive operations — deserves a deliberate choice about whether a permanent cloud record is the right call.
At Vegan Hacktivists we recommend most advocacy organizations run on two kinds of AI tool: a paid subscription to a frontier large language model (Claude or ChatGPT are our first choices; Gemini and Microsoft Copilot are also reasonable) and an AI meeting recorder (such as Fireflies or Granola). Together they make small teams substantially more capable — LLMs help with research, drafting, and strategy, and meeting assistants build a searchable record of a team’s collective decisions. We cover how to combine them for project management in a forthcoming guide.
Both leave a stored digital record, which is exactly why the law enforcement question is worth answering directly.
Do AI companies cooperate with law enforcement?
Each of the three major vendors says the same thing in different words: it requires valid legal process — typically a warrant for conversation content, weaker process for basic account information — and it may disclose data without any legal process at all in an emergency involving danger of death or serious injury. Read past the policy language, and the picture per vendor looks like this.
OpenAI (ChatGPT)
OpenAI’s law enforcement policy requires valid legal process for non-content account information, and a warrant or equivalent for conversation content, in the United States. It says it normally notifies the affected user unless notice is legally prohibited or an exception applies.
Its consumer privacy policy reaches further: it reserves the right to share information about someone’s use of its services with authorities for reasons including legal obligations, violations of law or policy, fraud, safety, and protection from liability. OpenAI also says that when a conversation shows an imminent and credible risk of harm to others, it notifies law enforcement on its own initiative.
OpenAI has confirmed cooperation in several named investigations, usually without describing exactly what it handed over:
- In the pending prosecution of Jonathan Rinderknecht over the Palisades Fire, prosecutors cited ChatGPT material in the criminal complaint. OpenAI told Axios it had “responded to standard law enforcement requests” concerning him, without specifying what it provided. Axios has the statement; the Department of Justice lists the trial for October 2026.
- After the Florida State University shooting, OpenAI said it proactively identified an account linked to the suspect and shared that information with law enforcement, unprompted by any request. Prosecutors reviewed the alleged shooter’s ChatGPT logs, but it is unclear from public reporting whether those came directly from OpenAI or from the shooter’s own devices. The Associated Press reported the company’s statement and the case status.
- Federal agents investigating Drew Hoehner obtained a warrant for the account behind two distinctive prompts, plus his other conversations and account information. OpenAI returned a spreadsheet; its contents are not public. Stanford’s Center for Internet and Society breaks down the warrant and what the public record does and does not show.
- In June 2026, a federal judge let a warrant for defendant Richard Kim’s OpenAI records proceed. Public reporting does not yet show what OpenAI produced or whether it will be used at trial. This legal analysis covers the case and the ruling.
OpenAI’s aggregate figures confirm the pattern without naming the cases behind it. From July to December 2025, it received 75 government requests for content and disclosed data for 62 of them, covering 84 accounts. It also disclosed non-content account data for 146 of 224 such requests. OpenAI’s transparency report defines “content” as text or files a user puts into or gets out of its services, and does not name the users, offenses, or investigations involved.
Google (Gemini)
We could not find a named criminal prosecution, as of August 2026, in which Google had publicly confirmed handing over the contents of someone’s Gemini conversations for use against them. That reflects the limits of the English-language public record we could search, not proof that no such request or disclosure has happened.
Google publishes government-request statistics across all its products but does not break out a Gemini-specific figure, so its overall numbers cannot be read as evidence about Gemini specifically.
Google’s government-request policy says stored Gemini content it holds can be obtained through applicable legal process: a subpoena for basic subscriber information, a court order for some non-content records, and a search warrant for communication content such as messages or documents. It reviews each request, tries to narrow overbroad ones, and sometimes objects. It may also disclose information to prevent death or serious physical harm, and normally gives notice unless prohibited or an exception applies. Its general privacy policy separately allows good-faith disclosures for legal process, fraud, security, and protecting rights or safety.
Anthropic (Claude)
The same search, as of 14 August 2026, turned up no named criminal prosecution in which Anthropic had publicly confirmed supplying Claude conversation content later used to prosecute someone. Its own aggregate reporting nonetheless confirms it has disclosed conversation content to government authorities.
From July to December 2025, Anthropic received two content requests covering eight accounts and provided data for both. It defines content as prompts and responses. It also received 20 non-content requests covering 55 accounts, providing data for seven, and seven preservation requests covering 29 accounts — a preservation request holds data in place while an authority pursues compulsory legal process, and does not itself compel disclosure. This is Anthropic’s latest government-request report, also listed on its Transparency Hub.
| Vendor | Content requests received | Content disclosed | Accounts affected | Period |
|---|---|---|---|---|
| OpenAI | 75 | 62 | 84 | Jul–Dec 2025 |
| Anthropic | 2 | 2 | 8 | Jul–Dec 2025 |
Claude material has still reached a criminal court, through a different route. FBI agents searching Bradley Heppner’s home seized devices holding roughly 31 documents recording his exchanges with Claude. The court ruled the documents fell under neither attorney-client privilege nor the work-product doctrine, because Claude was not his lawyer, the exchanges were not confidential under the privacy terms then in force, and his lawyers had never told him to create them. The ruling describes the seizure and the privilege decision. Heppner was later convicted of fraud; the public record does not establish that the Claude documents swayed the verdict. The Justice Department reported the conviction.
Anthropic says it discloses user information only under valid legal process or an emergency involving imminent physical harm or death. It checks each request’s validity, may reject vague or overbroad ones, usually gives notice, and generally asks authorities seeking enterprise or API data to approach the customer directly first. Its consumer privacy policy reserves the same kind of good-faith disclosures as the other vendors: legal requirements, preventing serious harm, fraud, enforcing its terms, and protecting rights or safety.
How investigators actually obtain AI conversations
A news report that police or prosecutors “had someone’s AI chats” does not mean the AI company handed them over. Investigators may instead have pulled chats, screenshots, or exported files off a phone or computer they already had lawful access to — and sometimes public reporting does not say which route was used at all.
A Congressional Research Service review describes a Missouri property-damage case where a suspect consented to a phone search and gave up the passcode; police recovered ChatGPT conversations directly from the device. In the Heppner case above, the FBI found the Claude documents on devices seized from his home, not by requesting anything from Anthropic.
For most advocates, the more realistic risk sits on a device already in your pocket: a laptop or phone that ends up in the wrong hands with your AI history logged in.
Meeting transcripts: Granola, Fireflies, and Otter
Across Granola, Fireflies, and Otter, we found no criminal case, as of August 2026, where law enforcement obtained a transcript directly from the company through compulsory legal process and used it in a prosecution — checking English-language public reporting and searchable court records. That is reassuring, but it is not proof it has never happened: demands can be sealed or unreported, and published accounts do not always name the software behind a transcript.
All three publish a policy covering the point, and the wording differs more than you might expect. Otter sets the highest bar: it discloses user content only under valid and binding compulsory legal process, puts national security letters through judicial review, refuses direct requests from law enforcement outside the United States, and says it intends to notify users unless a court forbids it. Fireflies reserves disclosure in accordance with, or as required by, applicable law, regulation, or legal process, including lawful requests by public authorities. Granola is the broadest of the three, listing disclosure “to law enforcement, governmental entities or regulatory organizations to aid an ongoing investigation or in response to a valid legal request or judicial or regulatory process” — wording that reads more permissively than a strict compulsory-process standard.
If this matters to your organization, read the policy of the tool you actually use before you rely on any summary, including this one.
How to reduce your exposure
Delete conversations that no longer need to be stored
One firm exception first: stop deleting the moment you are on notice. Routine deletion is ordinary records hygiene. It changes character completely once your organization learns of an investigation, litigation, a preservation demand, or a regulatory inquiry that touches the material. From that point, deleting relevant records can amount to obstruction of justice or evidence tampering, and that is usually a far graver problem than anything the records contained. Preserve everything that might be relevant, tell whoever runs your deletion routine to pause it, and take legal advice before removing anything further. Declining to record a future conversation is a separate question, since there is generally no obligation to create a record in the first place.
With that exception understood: deletion starts the provider’s process for the account-linked copy, but the timeline and exceptions differ by vendor.
| Provider | Deletion window | Notable exceptions |
|---|---|---|
| ChatGPT | Gone from view immediately; permanently deleted within 30 days | De-identified data, or anything retained for security or legal obligations. Files saved to ChatGPT Library must be deleted separately. |
| Claude | Gone from history immediately; gone from back-end storage within 30 days | Legally required records, Usage Policy material, de-identified model-improvement data, and feedback can be kept longer — flagged inputs and outputs up to two years, related safety scores up to seven years, feedback data up to five years |
| Gemini | No 30-day figure applies. Personal accounts: full deletion generally takes around two months; encrypted backups may hold data up to six months. Workspace: 90 days to indefinite, by admin setting | Chats already reviewed by service providers are disconnected from the account but may remain up to three years |
OpenAI, Anthropic (consumer), Anthropic (commercial), and Google each explain their own deletion process and exceptions; Google’s general retention policy and the separate Workspace rules cover the Workspace-specific figures above.
Most of the major providers will delete a chat you ask them to within 30 to 60 days. If a conversation tripped an automated safety guardrail, expect it to be kept longer — and none of them will tell you which of your conversations that applies to.
Be careful with thumbs-up and thumbs-down feedback
Rate a response with a thumbs up or thumbs down, and the whole conversation is typically saved for future model training — even if you later delete it, and even if your organization has otherwise turned off training on your data.
- OpenAI explains its business controls for this.
- Anthropic explains the same rule for Claude.
- Google explains it for both Workspace and personal accounts.
A simple rule: do not rate a conversation you would not want pulled into a separate review process.
Our recommendation
We found very few public cases of an AI company handing law enforcement direct access to a user’s account or chats. Several cases reported that way turn out, on closer reading, to be law enforcement reading chats off a phone or laptop it already had lawful access to. The lack of public cases does not mean it never happens, though: every major AI company says it will cooperate once served with valid legal process.
Record ordinary organizational work by default, but make a deliberate decision before recording an unusually sensitive conversation.
For campaign planning, volunteer coordination, fundraising, communications, research, organizational learning, or project management, a searchable transcript is worth having.
For the smaller set of conversations touching sensitive personal information, confidential sources, legal advice, safeguarding, employment matters, or security-sensitive operational detail, decide deliberately whether a complete cloud transcript belongs there at all. Pausing the recorder for one section, keeping limited written notes instead, or getting legal advice about the right channel are all reasonable alternatives.
Practical checklist
- Record ordinary meetings where a transcript will be useful.
- Tell participants and get consent before recording — recording and data-protection rules vary by location and context, so check which apply to you.
- Use an organizational Business, Team, Enterprise, or qualifying Workspace account where available. Its main benefit is stronger training and access controls, not immunity from legal process.
- Delete chats and transcripts on sensitive topics once their usefulness has passed.
- Stop deleting immediately, and take legal advice, if your organization learns of an investigation, litigation, or a preservation demand.
- Pause the recorder for unusually sensitive sections of a meeting.
- Before assuming a deletion is complete, check for separate saved copies in Drive, email, Slack, downloads, and other participants’ accounts.
- Skip feedback buttons on sensitive conversations.
- Do not treat an AI conversation as having the legal confidentiality of a conversation with a lawyer.
Where to go next
For the broader picture on what should and should not go into an AI tool at all, see Data security and privacy basics and Create your AI policy.
This resource covers privacy and organizational risk in general terms. It is not legal advice. Policies and product settings change — verify anything time-sensitive before you rely on it. Last reviewed 24 August 2026.
