Events

Brainstorm 2026

Denver, CO

AI Privacy: What Happens to Your Data When You Use AI Tools?

11:00 am - 12:00 pm CDT

Every day, employees, faculty, and staff type sensitive information into AI tools, often without knowing where that data goes, who can read it, or how long it’s kept.

In this session, we pull back the curtain on what actually happens to your data when you use tools like ChatGPT, Copilot, Gemini, and Claude. Drawing on current provider policies, real incidents, and observed workplace behavior across 1.6 million workers, we trace the full data journey from your keyboard through cloud providers, subprocessors, human reviewers, and model training pipelines.

You’ll learn where privacy concerns become hard legal liability under PCI DSS, HIPAA, FERPA, and GLBA, what GDPR, CCPA, and the EU AI Act actually protect, and the practical settings, habits, and organizational policies that reduce your exposure. This session is informative, practical, and surprisingly fun.

Key Takeaways

After our session, you will be able to:

• Identify the three ways AI tools collect data: direct inputs, metadata, and model training pipelines, and why “deleted” doesn’t always mean gone.
• Trace where AI data actually travels, including cloud hosts, third-party sub-processors, human reviewers, and litigation holds.
• Recognize where AI use creates regulatory liability the moment cardholder data, PHI, student records, or GLBA-covered financial information touches an external AI tool.
• Compare the current data practices of the four major AI providers and understand why paid consumer tiers don’t automatically mean private.
• Opt out of AI training data use on ChatGPT, Gemini, Copilot, and Claude.
• Apply a six-step framework for building an organizational AI data policy: inventory, classify, negotiate, train, monitor, and review.
• Use the Golden Rule of AI privacy as a simple, teachable test for every prompt: would you be comfortable seeing it on the front page?