Bug fix: data privacy/security issue

Why is my isOptedOut flag set to false in session when my account is set to “DO NOT SHARE” - I have a business account and need to be able raise this issue to an internal support team for further clarification.

Are my account settings actually being used and is my chat data being shared and utilized without my permission?

Please advise ASAP as this is a significant issue. You can see that the flag in the session cookie is incorrect.

Hi @tom21, thanks for sharing that.

That cookie value is not an evidence of model-training consent.

From the frontend code that references isOptedOut, it appears to control whether ChatGPT stores account/profile details (name, email, avatar, login metadata, etc.) in the oai-client-auth-info cookie.

For example, when isOptedOut is set to true, the code clears the stored account information:

{
  isOptedOut: true,
  user: undefined,
  last_login_method_by_user_id: undefined
}

And elsewhere, if isOptedOut is already true, the app skips writing those user details back into the cookie:

if (accountInfo?.isOptedOut) return;

That makes it look more like a preference related to persisting account information in that cookie, not a setting that controls whether conversations are used for model training.

The training preference is managed separately under Settings → Data Controls → Improve the model for everyone. That's the user-facing control OpenAI documents for opting in or out of training, and I haven't seen anything in the oai-client-auth-info code that connects isOptedOut to that feature.

Also, I've removed the attachment from this thread since it contained personal information (name and email address). Even when examples seem harmless, it's generally a good idea not to leave that kind of data publicly visible.

So while isOptedOut: false technically means you're not opted out of something, the available code points toward cookie/account-info storage rather than model-training consent.

-Mark G.

Mark, thanks for the rapid response and explanation. This should be made clear in the account settings then. What am I opted out of? It’s a cookie flag that doesn’t match to anything, but it is clearly being used for something and if it’s not, then should be deprecated.

My original question was spawned as a result of other (not from OpenAI) web-search data indicating that this was potentially for Opting In/Out of model training. The purpose of my question was to obtain clarification.

Again - thanks for the rapid response.

Hey @tom21, thanks for the follow-up. I can see why the cookie raised questions, especially given some of the search results out there.

The flag only controlled whether certain user details were written into the cookie. It had nothing to do with model training or opting in/out of training.

Your point about visibility is fair, though. If a flag is exposed, it should either be documented clearly or deprecated if it's no longer needed.

Appreciate you digging into it and asking for clarification.

-Mark G.