10 ms·

OpenAI Personal Data Removal Request Form

174 points by ciccionamente 3y ago

tekchip 3y ago
You can't finish this form without selecting "country who's laws apply". The US isn't in the list so you cant submit the form. California and Illinois have GDPR-like laws. This is pretty messed up.
nilsb 3y ago
A request for a list of personal data they’re processing would be interesting. How would they even comply with such a request?
alwayseasy 3y ago
Wait, how can we verify this is OpenAI's form and not some random form on the internet? Edit: Ok the link can be found here in part 4 of : https://openai.com/policies/privacy-policy https://openai.com/policies/privacy-policy
- moolcool 3y ago
  OpenAI links to it from here https://help.openai.com/en/articles/7842364-how-chatgpt-and-our-language-models-are-developed https://help.openai.com/en/articles/7842364-how-chatgpt-and-...
  - alwayseasy 3y ago
    Oh thanks! I edited my post before seeing your comment.
- dumpsterdiver 3y ago
  Even though there is a link to the external page in question on openai's website, imo it's still poor form (badum-bum-psh) for any site to request sensitive data through a form residing on a 3rd party domain. It's one of those details that makes the hair on the back of my neck stand up.
  - dr_kiszonka 3y ago
    Haha funny comment! Thanks!
cj 3y ago
"Relevant prompts" should not be a required field. That means I need to use OpenAI to request my data be removed from its data set? Is there a way to remove PII without having to use their service?
- samstave 3y ago
  Just give me all your PII, and Ill do it for you for the small fee of your full bank account! Easy. - On a serious note - there needs to be an easier way to remove any and all PII from across the web, period. It should be illegal for ANY site to harvest PII and host it for ransom (credit/social credit site, for example should be fully illegal) Also, with "relevant prompt" -- how can I use my own account to test to see if I have PII in the system? Do I just need to attempt to prompt for my own PII to check? How do you prompt to check for your own PII without ADDING PII into the system via your testing prompts?
  - EricMausler 3y ago
    The only plausible solution I can think of that doesnt change the way the web operates is to force all PII to be opt-in instead of opt-out
    - sebzim4500 3y ago
      Isn't it already? If someone asks for PII you can just stop using the service.
      - EricMausler 3y ago
        That feels dark pattern adjacent to me. It's tone deaf to think information someone gives you as part of using a service they want from you means they are okay with that information being shared with other parties in a manner completely unrelated to the service provided. Sharing sensitive information once, or even a hundred times, should not constitute a presumed consent to opt-in to that information being shared again or data mined.
      - 3y ago
Raed667 3y ago
I have filled it weeks ago and still got no response. Anyone had any success with this ?
- Naga 3y ago
  No One at my firm has had success either. I’m guessing they were overwhelmed by responses. It’s possible that they’ve gotten millions.
  - anotherhue 3y ago
    Good thing they just got Billions from Microsoft to deal with growing pains like this.
  - permo-w 3y ago
    it’s a shame they don’t have a state of the art AI model that could swiftly process these requests
- LelouBil 3y ago
  Aren't there mandatory response delays and compliance delays with the GDPR ?
  - blazespin 3y ago
    Yeah, it's like a month I believe.
  - b800h 3y ago
    Yep. It can take a while for the relevant authorities to spin up their processes. But it will very likely happen. En masse.
discreteevent 3y ago
> we need clear evidence that the model has knowledge of the data subject conditioned on the prompts We have a system that may have information about you and may even distort information about you. In fact it probably has some information about you considering that we exercised no control over the process of ingesting information into the system. Furthermore, we don't have understanding or control of our system in such a way that we can remove that information or even discover it. However, we still released the system to the world and now we expect you to test it with various prompts and hope that you get lucky before someone other person does.
- cheschire 3y ago
  The most cost effective bug bounty program. “Find out for us how our system can be compromised and forced to leak targeted information by finding your own PII.”
  - contravariant 3y ago
    It's more like a bug bounty in reverse. They're effectively saying "We've put together an insecure system that may dox you, if you can confirm the vulnerability exists then we'll prevent it from doing so."
  - permo-w 3y ago
    and in the process provide the system with more PII
- judge2020 3y ago
  You also don't have a say over who reads your HN comments. Such comments could very well be used against you by another human. If something is public info, you must treat it as forever-public.
  - kweingar 3y ago
    You don’t always have control over what is published about you online. Comments are only one aspect of this. I’m sure you would not be happy if I widely published your full name, address, birthday, names and ages of family members, occupation, etc. just because I was able to piece it all together from public info.
fogoflove 3y ago
Just looked, and I'm guessing this is an EU thing? No option for US in dropdown.
- capableweb 3y ago
  Does the US law have anything that guarantees you to have your data deleted from platforms? I don't recall that existing, so makes sense OpenAI does the bare minimum to be compliant in the markets they're active. Just like most companies.
  - jeroenhd 3y ago
    California has a "don't sell my data" law, which may apply here. That's the only US law I can think of. Unless OpenAI is stupid enough to gather medical data from protected sources under HIPAA, that is, but I doubt even OpenAI wouldn't be nonchalant enough to use a data source like that.
  - JohnFen 3y ago
    Sadly, no. But if OpenAI was interested in not being viewed as an evil corporation, it would be in their best interest to do it for everyone anyway, since they have a mechanism. I don't think they care too much about being well-behaved, though.
    - autoexec 3y ago
      if OpenAI was interested in not being viewed as an evil corporation they'd be actually "Open", actually non-profit, and they wouldn't have cozied up to Microsoft.
gumballindie 3y ago
> a request does not guarantee that information about you will be removed from ChatGPT outputs Oh i am pretty sure that if you dont remove all data you’ll pay for it. Looking forward to hefty fines for openai.
- blazespin 3y ago
  I think you'd have to be a GDPR lawyer to understand the implications of that. It can get a little complicated.
  - agentgumshoe 3y ago
    It would certainly be an interesting outcome in a trial: Judge concludes "you must remove all likelihood of that data presenting in results." Cue re-running the training model a little bit more frequently than they'd like... At least it would certainly become opt-in very quickly, which of course it should have been from the start.
- JohnFen 3y ago
  Isn't the request to delete the data? Just removing it from the outputs wouldn't be sufficient anyway.
  - MacsHeadroom 3y ago
    The request is to delete from future training data. They don't remove it from outputs or address the fact that the model(s) has already been trained on the old data.
    - gumballindie 3y ago
      Yeah that won't fly. Data needs removing from all output, current or old.
deleted 3y ago
[deleted]
EMM_386 3y ago
Does anyone have any idea how this is handled from a technical perspective? The data isn't sitting in some database somewhere, it's inside of a large lanaguage model. It's not like they can just execute a DELETE statement or do an entirely new training run. Are they intercepting the outputs with something like a moderation server as a go-between? In that case, the data still would technically exist in the model, it just wouldn't be returned. Maybe using fine-tuning?
- chinathrow 3y ago
  > It's not like they can just execute a DELETE statement or do an entirely new training run. Of course they can - it might just be expensive but sure, they could.
  - toddmorey 3y ago
    They might honestly have to if the model was trained on data they are not legally entitled to. But that’s a risk they knew going in.
  - Kudos 3y ago
    No one likes this kind of pedantry. Everyone knows they mean that it is infeasible, not impossible. If you actually think it's feasible, now that's an interesting discussion.
    - chinathrow 3y ago
      I don't think it's pedantry - to my knowledge, the discussion about training data usage without permission (opt-in vs opt-out) is not yet done yet. Or is it?
      - Kudos 3y ago
        Feigning ignorance is another common form of pedantry.
        3y ago
blazespin 3y ago
You'll want to fact check this, but I find GPT4 is OK at this kinda stuff. If you've been asked to remove data in accordance to a gdpr request, is it best effort or do you have to strictly comply with the request? ChatGPT I am not a lawyer, but I can offer some general information about GDPR and data removal requests. The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection, processing, and storage of personal data of individuals within the European Union (EU). Under GDPR, individuals have the "right to be forgotten," also known as the "right to erasure." This means that they can request the deletion of their personal data under specific circumstances. When a data controller (the organization that determines the purposes and means of processing personal data) receives a valid GDPR request to remove personal data, they are generally required to strictly comply with the request. However, there are some exceptions, and the extent of the obligation may depend on the specific circumstances surrounding the request. The GDPR requires data controllers to respond to data removal requests without undue delay, and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. It's important to remember that GDPR compliance is not solely about "best effort." Organizations are expected to take reasonable and appropriate measures to ensure compliance with the regulation. This includes having processes in place to handle requests and promptly remove personal data where required. Failure to comply with GDPR can result in significant fines and penalties. However, it's also essential to consider that there are circumstances under which a data controller may not be required to comply with a data removal request. These exceptions can include situations where the processing of personal data is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, or for reasons of public interest. In any case, it's crucial to consult with legal counsel or a data protection officer to better understand your organization's specific obligations under GDPR and ensure proper compliance.
johntiger1 3y ago
I filled out a google docs form to opt out once, which is it?
gnufx 3y ago
So they seem to be confirming they're processing personal data. The UK ICO "at a glance" guidance for that includes: * You must identify valid grounds under the UK GDPR (known as a ‘lawful basis’) for collecting and using personal data. * You must use personal data in a way that is fair. This means you must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned. * You must be clear, open and honest with people from the start about how you will use their personal data.
thomas34298 3y ago
Somewhat related, I previously completed the form found in the help section titled "How your data is used to improve model performance" to opt out of providing training data to OpenAI: https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance https://help.openai.com/en/articles/5722486-how-your-data-is... I received a confirmation in February that my data had been excluded from model training. However, recently, after the addition of the new Data Controls feature, I noticed that I was suddenly opted in again in the settings. I've tried contacting them about it via Discord and e-mail so that they can clarify whether the exclusion is still valid, but it seems like I'm getting ignored.
- humanistbot 3y ago
  Oh this is infuriating. I did the same thing early on with that sketchy google form and thought I was good. But then after reading your comment, I went to my settings and it looks like I was opted in again. You also can't opt out without losing a feature (history of your chats), which is a form of coercion.
blazespin 3y ago
Interestingly, I find ChatGPT very reticent about giving out PII of anyone not notable. This might not be a huge issue
- pulvinar 3y ago
  But you can turn around and ask it to write a story about the person and it happily complies. That's fiction but contains some facts. Repeat this enough times and you can pull out the facts the stories have in common.
  - gtirloni 3y ago
    Has that been done successfully? Could you share the prompts you used?
    - pulvinar 3y ago
      I should have added "theoretically". I haven't had much luck with it, using a prompt like "Tell me a story about a character named X, a Y, living in Z."
      - gtirloni 3y ago
        That's a good idea. I tried it in several ways but it always added platitudes and stereotypes about where me, family and friends live or do. When I pressed it to include more real world aspect about those fictional characters, it quickly reverted to the canned response "As an AI model, I cannot... blablabla".
- gtirloni 3y ago
  Same. As an exercise, I have tried it on me, family members and friends. It gives me nothing because I'm not a public figure. I don't know all the details about GDPR but I can't imagine it allows people to erase their existence from the Internet if they became a public figure at some point.
peter_retief 3y ago
How would anyone know what information they have on them?
- goatlover 3y ago
  Ask ChatGPT?
mstolpm 3y ago
I'm wondering: How can I be certain that the model contains any personal data about me (or someone else not famous)? For a public figure, of course there is lots of information in the training data, all public data. But when asked about me or my brother, ChatGPT either refuses to answer OR hallucinates the hell of it. Then, nearly everything is wrong and the output resembles the answer to a prompt like: "Create a short bio for a fictional character named xx, living in yy and working as zz." (Okay, often yy and zz are wrong either.) Requesting to delete these hallucinated facts seems quite stubborn and ineffective?
mbgerring 3y ago
Putting the onus on the user to find a “relevant prompt” is bullshit. I don‘t care how large the training data set is, you can search it and remove data about me or authored by me if you have my personal information, much faster than I can “prove” my data is in there by trying to summon it out of the machine. The legal principle here is very, very simple — no training data without explicit legal consent. Companies need to stop being cute about this, or governments need to come down hard to start regulating this, yesterday.
- greenhearth 3y ago
  Better yet, maybe a heads-up if your stuff is going to be used?
  - __loam 3y ago
    It should be opt in. If they don't have permission they shouldn't be able to use your data.
sensanaty 3y ago
Here's to hoping this forces their hand into making the mass data-hoovering completely opt-in so they can avoid these pesky normies from bothering them again the future
- __loam 3y ago
  Anything that gives artists the right to tell OpenAI to pound sand.
sashank_1509 3y ago
I frankly don’t get this privacy argument at all. If I browse Facebook and look at pictures you uploaded and end up learning something from those pictures, what am I supposed to do? Undergo brain surgery? It feels like anything that you release on the internet publicly is fair game. If however you didn’t release it in public, put it behind a password and then OpenAI somehow got access to it and train on it, I can see the argument here but if you put up data on your own, I don’t see why you can prevent others from accessing that data. If you don’t want others using it out there, don’t put it out there.
- jsnell 3y ago
  Scale matters. It might feel like that to you, but that's not what the laws are in some economically important parts of the world. In Europe, the relevant bit is the "right to be forgotten". If you want to operate an information system, you need to implement that. It's hard to see why it wouldn't apply to a chatbot just the same as it applies to search engines. It's much easier to explain why there's a distinction between a human brain and a massive database accessible at will to billions of people.
- graeme 3y ago
  Does Open-AI make a copy of the data at any point? If so that's a copyright violation.
  - sashank_1509 3y ago
    I can't copy paste text from the internet?
    - teddyh 3y ago
      Correct.
    - gkbrk 3y ago
      What do you think copyright is? It's literally the right to copy, and without having this right you can't copy whatever content you want from others.
Nocturium 3y ago
Wouldn't it be easier if they published a list where they scraped their data from in the first place. Filling out forms, scanning id and sending it only to learn they didn't capture any of your data seems like such a waste of time. On the other hand, they already know which sites they used to scrape data. So publish it, maybe with a handy lookup portal where you can enter urls to see if it got scraped. I prefer an opt-in model, but that's not likely to happen any time soon, so this seems reasonable while this gets legally sorted out. Just because something is transmitted publicly doesn't mean it's without copyright. Otherwise any song broadcast on radio is up for grabs to be resold by anyone receiving it.
chmod775 3y ago
Reminder that you have no obligation to use their stupid form if you don't like it and all their weird requirements. You can just send them a snailmail or e-mail and they'll have to process that too. You can find templates for that all around the internet.
YeBanKo 3y ago
This has to be opt-in, not opt-out. A company should not be allowed to use personal data you did not explicitly provide it.
aorth 3y ago
According to Washington Post's reporting on the contents of the C4 dataset last week I see that ChatGPT has over 100,000 tokens from my personal blogs. Does that qualify as "personal data" in this context? Everything I've written is clearly labeled as CC-BY so it would be nice to at least be acknowledged. https://www.washingtonpost.com/technology/interactive/2023/ai-chatbot-learning/ https://www.washingtonpost.com/technology/interactive/2023/a...

174 points by ciccionamente 3y ago

You can't finish this form without selecting "country who's laws apply". The US isn't in the list so you cant submit the form. California and Illinois have GDPR-like laws. This is pretty messed up.

nilsb 3y ago

A request for a list of personal data they’re processing would be interesting. How would they even comply with such a request?

alwayseasy 3y ago

Wait, how can we verify this is OpenAI's form and not some random form on the internet? Edit: Ok the link can be found here in part 4 of : https://openai.com/policies/privacy-policy https://openai.com/policies/privacy-policy

moolcool 3y ago
OpenAI links to it from here https://help.openai.com/en/articles/7842364-how-chatgpt-and-our-language-models-are-developed https://help.openai.com/en/articles/7842364-how-chatgpt-and-...
- alwayseasy 3y ago
  Oh thanks! I edited my post before seeing your comment.
dumpsterdiver 3y ago
Even though there is a link to the external page in question on openai's website, imo it's still poor form (badum-bum-psh) for any site to request sensitive data through a form residing on a 3rd party domain. It's one of those details that makes the hair on the back of my neck stand up.
- dr_kiszonka 3y ago
  Haha funny comment! Thanks!

cj 3y ago

"Relevant prompts" should not be a required field. That means I need to use OpenAI to request my data be removed from its data set? Is there a way to remove PII without having to use their service?

samstave 3y ago
Just give me all your PII, and Ill do it for you for the small fee of your full bank account! Easy. - On a serious note - there needs to be an easier way to remove any and all PII from across the web, period. It should be illegal for ANY site to harvest PII and host it for ransom (credit/social credit site, for example should be fully illegal) Also, with "relevant prompt" -- how can I use my own account to test to see if I have PII in the system? Do I just need to attempt to prompt for my own PII to check? How do you prompt to check for your own PII without ADDING PII into the system via your testing prompts?
- EricMausler 3y ago
  The only plausible solution I can think of that doesnt change the way the web operates is to force all PII to be opt-in instead of opt-out
  - sebzim4500 3y ago
    Isn't it already? If someone asks for PII you can just stop using the service.
    - EricMausler 3y ago
      That feels dark pattern adjacent to me. It's tone deaf to think information someone gives you as part of using a service they want from you means they are okay with that information being shared with other parties in a manner completely unrelated to the service provided. Sharing sensitive information once, or even a hundred times, should not constitute a presumed consent to opt-in to that information being shared again or data mined.
    - 3y ago

Raed667 3y ago

I have filled it weeks ago and still got no response. Anyone had any success with this ?

Naga 3y ago
No One at my firm has had success either. I’m guessing they were overwhelmed by responses. It’s possible that they’ve gotten millions.
- anotherhue 3y ago
  Good thing they just got Billions from Microsoft to deal with growing pains like this.
- permo-w 3y ago
  it’s a shame they don’t have a state of the art AI model that could swiftly process these requests
LelouBil 3y ago
Aren't there mandatory response delays and compliance delays with the GDPR ?
- blazespin 3y ago
  Yeah, it's like a month I believe.
- b800h 3y ago
  Yep. It can take a while for the relevant authorities to spin up their processes. But it will very likely happen. En masse.

discreteevent 3y ago

> we need clear evidence that the model has knowledge of the data subject conditioned on the prompts We have a system that may have information about you and may even distort information about you. In fact it probably has some information about you considering that we exercised no control over the process of ingesting information into the system. Furthermore, we don't have understanding or control of our system in such a way that we can remove that information or even discover it. However, we still released the system to the world and now we expect you to test it with various prompts and hope that you get lucky before someone other person does.

cheschire 3y ago
The most cost effective bug bounty program. “Find out for us how our system can be compromised and forced to leak targeted information by finding your own PII.”
- contravariant 3y ago
  It's more like a bug bounty in reverse. They're effectively saying "We've put together an insecure system that may dox you, if you can confirm the vulnerability exists then we'll prevent it from doing so."
- permo-w 3y ago
  and in the process provide the system with more PII
judge2020 3y ago
You also don't have a say over who reads your HN comments. Such comments could very well be used against you by another human. If something is public info, you must treat it as forever-public.
- kweingar 3y ago
  You don’t always have control over what is published about you online. Comments are only one aspect of this. I’m sure you would not be happy if I widely published your full name, address, birthday, names and ages of family members, occupation, etc. just because I was able to piece it all together from public info.

fogoflove 3y ago

Just looked, and I'm guessing this is an EU thing? No option for US in dropdown.

capableweb 3y ago
Does the US law have anything that guarantees you to have your data deleted from platforms? I don't recall that existing, so makes sense OpenAI does the bare minimum to be compliant in the markets they're active. Just like most companies.
- jeroenhd 3y ago
  California has a "don't sell my data" law, which may apply here. That's the only US law I can think of. Unless OpenAI is stupid enough to gather medical data from protected sources under HIPAA, that is, but I doubt even OpenAI wouldn't be nonchalant enough to use a data source like that.
- JohnFen 3y ago
  Sadly, no. But if OpenAI was interested in not being viewed as an evil corporation, it would be in their best interest to do it for everyone anyway, since they have a mechanism. I don't think they care too much about being well-behaved, though.
  - autoexec 3y ago
    if OpenAI was interested in not being viewed as an evil corporation they'd be actually "Open", actually non-profit, and they wouldn't have cozied up to Microsoft.

gumballindie 3y ago

> a request does not guarantee that information about you will be removed from ChatGPT outputs Oh i am pretty sure that if you dont remove all data you’ll pay for it. Looking forward to hefty fines for openai.

blazespin 3y ago
I think you'd have to be a GDPR lawyer to understand the implications of that. It can get a little complicated.
- agentgumshoe 3y ago
  It would certainly be an interesting outcome in a trial: Judge concludes "you must remove all likelihood of that data presenting in results." Cue re-running the training model a little bit more frequently than they'd like... At least it would certainly become opt-in very quickly, which of course it should have been from the start.
JohnFen 3y ago
Isn't the request to delete the data? Just removing it from the outputs wouldn't be sufficient anyway.
- MacsHeadroom 3y ago
  The request is to delete from future training data. They don't remove it from outputs or address the fact that the model(s) has already been trained on the old data.
  - gumballindie 3y ago
    Yeah that won't fly. Data needs removing from all output, current or old.

deleted 3y ago

[deleted]

EMM_386 3y ago

Does anyone have any idea how this is handled from a technical perspective? The data isn't sitting in some database somewhere, it's inside of a large lanaguage model. It's not like they can just execute a DELETE statement or do an entirely new training run. Are they intercepting the outputs with something like a moderation server as a go-between? In that case, the data still would technically exist in the model, it just wouldn't be returned. Maybe using fine-tuning?

chinathrow 3y ago
> It's not like they can just execute a DELETE statement or do an entirely new training run. Of course they can - it might just be expensive but sure, they could.
- toddmorey 3y ago
  They might honestly have to if the model was trained on data they are not legally entitled to. But that’s a risk they knew going in.
- Kudos 3y ago
  No one likes this kind of pedantry. Everyone knows they mean that it is infeasible, not impossible. If you actually think it's feasible, now that's an interesting discussion.
  - chinathrow 3y ago
    I don't think it's pedantry - to my knowledge, the discussion about training data usage without permission (opt-in vs opt-out) is not yet done yet. Or is it?
    - Kudos 3y ago
      Feigning ignorance is another common form of pedantry.
      - 3y ago

blazespin 3y ago

You'll want to fact check this, but I find GPT4 is OK at this kinda stuff. If you've been asked to remove data in accordance to a gdpr request, is it best effort or do you have to strictly comply with the request? ChatGPT I am not a lawyer, but I can offer some general information about GDPR and data removal requests. The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection, processing, and storage of personal data of individuals within the European Union (EU). Under GDPR, individuals have the "right to be forgotten," also known as the "right to erasure." This means that they can request the deletion of their personal data under specific circumstances. When a data controller (the organization that determines the purposes and means of processing personal data) receives a valid GDPR request to remove personal data, they are generally required to strictly comply with the request. However, there are some exceptions, and the extent of the obligation may depend on the specific circumstances surrounding the request. The GDPR requires data controllers to respond to data removal requests without undue delay, and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. It's important to remember that GDPR compliance is not solely about "best effort." Organizations are expected to take reasonable and appropriate measures to ensure compliance with the regulation. This includes having processes in place to handle requests and promptly remove personal data where required. Failure to comply with GDPR can result in significant fines and penalties. However, it's also essential to consider that there are circumstances under which a data controller may not be required to comply with a data removal request. These exceptions can include situations where the processing of personal data is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, or for reasons of public interest. In any case, it's crucial to consult with legal counsel or a data protection officer to better understand your organization's specific obligations under GDPR and ensure proper compliance.

johntiger1 3y ago

I filled out a google docs form to opt out once, which is it?

gnufx 3y ago

So they seem to be confirming they're processing personal data. The UK ICO "at a glance" guidance for that includes: * You must identify valid grounds under the UK GDPR (known as a ‘lawful basis’) for collecting and using personal data. * You must use personal data in a way that is fair. This means you must not process the data in a way that is unduly detrimental, unexpected or misleading to the individuals concerned. * You must be clear, open and honest with people from the start about how you will use their personal data.

thomas34298 3y ago

Somewhat related, I previously completed the form found in the help section titled "How your data is used to improve model performance" to opt out of providing training data to OpenAI: https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance https://help.openai.com/en/articles/5722486-how-your-data-is... I received a confirmation in February that my data had been excluded from model training. However, recently, after the addition of the new Data Controls feature, I noticed that I was suddenly opted in again in the settings. I've tried contacting them about it via Discord and e-mail so that they can clarify whether the exclusion is still valid, but it seems like I'm getting ignored.

humanistbot 3y ago
Oh this is infuriating. I did the same thing early on with that sketchy google form and thought I was good. But then after reading your comment, I went to my settings and it looks like I was opted in again. You also can't opt out without losing a feature (history of your chats), which is a form of coercion.

blazespin 3y ago

Interestingly, I find ChatGPT very reticent about giving out PII of anyone not notable. This might not be a huge issue

pulvinar 3y ago
But you can turn around and ask it to write a story about the person and it happily complies. That's fiction but contains some facts. Repeat this enough times and you can pull out the facts the stories have in common.
- gtirloni 3y ago
  Has that been done successfully? Could you share the prompts you used?
  - pulvinar 3y ago
    I should have added "theoretically". I haven't had much luck with it, using a prompt like "Tell me a story about a character named X, a Y, living in Z."
    - gtirloni 3y ago
      That's a good idea. I tried it in several ways but it always added platitudes and stereotypes about where me, family and friends live or do. When I pressed it to include more real world aspect about those fictional characters, it quickly reverted to the canned response "As an AI model, I cannot... blablabla".
gtirloni 3y ago
Same. As an exercise, I have tried it on me, family members and friends. It gives me nothing because I'm not a public figure. I don't know all the details about GDPR but I can't imagine it allows people to erase their existence from the Internet if they became a public figure at some point.

peter_retief 3y ago

How would anyone know what information they have on them?

goatlover 3y ago
Ask ChatGPT?

mstolpm 3y ago

I'm wondering: How can I be certain that the model contains any personal data about me (or someone else not famous)? For a public figure, of course there is lots of information in the training data, all public data. But when asked about me or my brother, ChatGPT either refuses to answer OR hallucinates the hell of it. Then, nearly everything is wrong and the output resembles the answer to a prompt like: "Create a short bio for a fictional character named xx, living in yy and working as zz." (Okay, often yy and zz are wrong either.) Requesting to delete these hallucinated facts seems quite stubborn and ineffective?

mbgerring 3y ago

Putting the onus on the user to find a “relevant prompt” is bullshit. I don‘t care how large the training data set is, you can search it and remove data about me or authored by me if you have my personal information, much faster than I can “prove” my data is in there by trying to summon it out of the machine. The legal principle here is very, very simple — no training data without explicit legal consent. Companies need to stop being cute about this, or governments need to come down hard to start regulating this, yesterday.

greenhearth 3y ago
Better yet, maybe a heads-up if your stuff is going to be used?
- __loam 3y ago
  It should be opt in. If they don't have permission they shouldn't be able to use your data.

sensanaty 3y ago

Here's to hoping this forces their hand into making the mass data-hoovering completely opt-in so they can avoid these pesky normies from bothering them again the future

__loam 3y ago
Anything that gives artists the right to tell OpenAI to pound sand.

sashank_1509 3y ago

I frankly don’t get this privacy argument at all. If I browse Facebook and look at pictures you uploaded and end up learning something from those pictures, what am I supposed to do? Undergo brain surgery? It feels like anything that you release on the internet publicly is fair game. If however you didn’t release it in public, put it behind a password and then OpenAI somehow got access to it and train on it, I can see the argument here but if you put up data on your own, I don’t see why you can prevent others from accessing that data. If you don’t want others using it out there, don’t put it out there.

jsnell 3y ago
Scale matters. It might feel like that to you, but that's not what the laws are in some economically important parts of the world. In Europe, the relevant bit is the "right to be forgotten". If you want to operate an information system, you need to implement that. It's hard to see why it wouldn't apply to a chatbot just the same as it applies to search engines. It's much easier to explain why there's a distinction between a human brain and a massive database accessible at will to billions of people.
graeme 3y ago
Does Open-AI make a copy of the data at any point? If so that's a copyright violation.
- sashank_1509 3y ago
  I can't copy paste text from the internet?
  - teddyh 3y ago
    Correct.
  - gkbrk 3y ago
    What do you think copyright is? It's literally the right to copy, and without having this right you can't copy whatever content you want from others.

Nocturium 3y ago

Wouldn't it be easier if they published a list where they scraped their data from in the first place. Filling out forms, scanning id and sending it only to learn they didn't capture any of your data seems like such a waste of time. On the other hand, they already know which sites they used to scrape data. So publish it, maybe with a handy lookup portal where you can enter urls to see if it got scraped. I prefer an opt-in model, but that's not likely to happen any time soon, so this seems reasonable while this gets legally sorted out. Just because something is transmitted publicly doesn't mean it's without copyright. Otherwise any song broadcast on radio is up for grabs to be resold by anyone receiving it.

chmod775 3y ago

Reminder that you have no obligation to use their stupid form if you don't like it and all their weird requirements. You can just send them a snailmail or e-mail and they'll have to process that too. You can find templates for that all around the internet.

YeBanKo 3y ago

This has to be opt-in, not opt-out. A company should not be allowed to use personal data you did not explicitly provide it.

aorth 3y ago

According to Washington Post's reporting on the contents of the C4 dataset last week I see that ChatGPT has over 100,000 tokens from my personal blogs. Does that qualify as "personal data" in this context? Everything I've written is clearly labeled as CC-BY so it would be nice to at least be acknowledged. https://www.washingtonpost.com/technology/interactive/2023/ai-chatbot-learning/ https://www.washingtonpost.com/technology/interactive/2023/a...