Skip to content

Anthropic's Claude Update: Extended Data Retention and AI Training Raises GDPR Concerns

Anthropic's new privacy policy for Claude could keep your chat data for years. Critics warn that the consent design may exploit users, potentially violating GDPR.

In this image, we can see an advertisement contains robots and some text.
In this image, we can see an advertisement contains robots and some text.

Anthropic's Claude Update: Extended Data Retention and AI Training Raises GDPR Concerns

Anthropic is updating its privacy policy for the AI chat platform Claude. The changes include extending chat data retention and using user input for AI training, with a design that critics argue exploits users' quick consent.

The new policy allows Anthropic to retain chat data for up to five years upon user consent, up from the current 30 days. This data will be used to train AI models, following a similar approach to OpenAI's ChatGPT. Users of consumer products like Claude Free, Pro, Max, and Claude Code must opt out by September 28, 2025, to prevent their new and resumed chats from being used for this purpose.

The design of the consent interface is controversial. It features a prominent 'Accept' button and a pre-activated switch for data enablement, making it easy for users to accidentally consent. This design is suspected of exploiting quick, unconsidered consent, a practice known as a 'dark pattern'. The European Data Protection Board (EDPB) has warned that such practices undermine the voluntary, informed, and unambiguous nature of consent required by the General Data Protection Regulation (GDPR). The use of dark patterns is illegal under GDPR and the European Court of Justice. The relevant Data Protection Authority (DPA) in Europe, such as Germany's Landesdatenschutzbehörde, could hold Anthropic accountable for these practices.

Anthropic's updated privacy policy for Claude includes extended chat data retention and AI training use. The design of the consent interface has raised concerns about exploiting user consent. Users should be aware of these changes and consider opting out by the given deadline. The relevant European DPAs will oversee compliance with GDPR rules.

Read also:

Latest