AI Conversations Feel Private. Could They Be Privileged?

By: Robert Ward

The New York Times’ lawsuit against OpenAI continues to spark debate, and not just about copyright. Most recently, a federal magistrate judge ordered OpenAI to preserve chats that the company might otherwise have deleted at a user’s request. In response, OpenAI CEO Sam Altman suggested that it may be time for a version of the attorney-client or physician-patient privilege, but for AI. While any attempt to define such an  “AI privilege” would involve tackling difficult questions about our relationships with AI systems, the more likely barrier will be the general reluctance to recognize new evidentiary privileges, particularly in federal courts. The expansive AI privilege Altman appears to envision is therefore unlikely to materialize any time soon.

The premise of Altman’s AI privilege concept is straightforward. Users often input sensitive information into AI systems like ChatGPT, including information that, if communicated to a lawyer, physician, or perhaps a spouse, might be privileged. And, as in those relationships, users generally expect that this information will not be shared with others. Finally, the ability to engage in “human-like” interactions may prompt users to experience their conversations with AI systems differently from those with a search engine, for example. Rather than a mere keyword search, users might experience the interactions as a relationship. Therefore, the argument goes, they merit the same protection as communications between lawyers and clients, physicians and patients, and spouses.

Several potential practical issues come to mind. For example, would all conversations with an AI system be protected? Such an expansive privilege is unlikely. Most testimonial privileges require that the protected communication be made to another in a particular professional or social role (such as a physician) and for a specific purpose (such as seeking medical treatment). Any AI privilege would therefore almost certainly apply only to limited categories of particularly sensitive communications.

While such questions would pose challenges, courts are likely capable of drawing defensible, if imperfect, boundaries, just as they currently do in interpreting longstanding evidentiary privileges like the attorney-client privilege. Legislatures could do the same, as they have in, for example, crafting statutes that allow journalists to refuse to reveal the identity of sources and other unpublished information.

That said, even if a particularly forward-looking state legislature were to adopt such an AI privilege, full-scale recognition is likely a long way off in federal court. Under Federal Rule of Evidence 501, a state-law AI privilege would apply in federal civil cases involving issues to be decided under that state’s law.It would not apply in federal criminal cases and other federal civil cases. In those cases, Rule 501 permits federal courts to develop and apply a federal common law of privilege. In deciding whether to recognize a testimonial privilege under Rule 501, federal courts often turn to a four-factor test set out by influential evidence scholar and treatise author John Henry Wigmore:

• The communications must originate in a confidence that they will not be disclosed.
• This element of confidentiality must be essential to the full and satisfactory maintenance of the relation between the parties.
• The relation must be one which in the opinion of the community ought to be sedulously
• The injury that would inure to the relation by the disclosure of the communications must be greater than the benefit thereby gained for the correct disposal of litigation.

A proposed privilege must meet all four factors. Where courts applying these factors have recognized “new” privileges, the privileges have typically had a significant historical pedigree (e.g., clergy-communicant privilege), or had at least been widely adopted by state legislatures or courts (e.g., the therapist-patient privilege). Where that is not the case, as with the parent-child privilege, courts have been reluctant, reflecting the common-law principle that testimonial privileges are disfavored. Proposed privileges beyond these more traditional categories have gained even less traction. For example, although at least one commentator has proposed a qualified “search-engine privilege,”[1] such a privilege has never been adopted. In fact, it appears that it has never been litigated.

Judicial recognition of a broad AI privilege is therefore unlikely in courts that rely on the Wigmore factors. Perhaps the most significant barrier to judicial recognition is the emphasis that the four factors place on the relationship between the parties. This focus on relationships poses several challenges. For example, who exactly are “the parties”? The user is one, of course. Is the other the specific model, such as Chat GPT o3? If so, is that relationship one that the community believes “ought to be sedulously fostered”? And what would it mean to evaluate the likely injury to that relationship beyond the user’s expectation of confidentiality? The number of unsettled questions to be answered in evaluating the Wigmore factors, and the significant public policy considerations they raise suggest that courts are more likely to defer to legislative action (or inaction) than to fashion a common-law AI privilege.

Users of general purpose, publicly available AI systems like ChatGPT are therefore unlikely to convince a court to recognize a broad AI privilege. That said, a narrower approach may succeed in contexts closely connected to existing evidentiary privileges. For example, to the extent AI systems are adopted by professionals like physicians or therapists, courts could treat an AI communication as one made either (a) directly to the relevant professional or (b) to a third-party “essential to and in furtherance” of the communication, such that it would not void the privilege. While this likely falls far short of what Altman had in mind, for now, it would better reflect the current balance between the need for confidence and trust in certain relationships and the judicial system’s truth-seeking function.

[1] See Matthew Werner, Google and Ye Shall Be Found: Privacy, Search Queries, and the Recognition of A Qualified Privilege, 34 Rutgers Computer & Tech. L.J. 273 (2007).