Demand for Direct Access, User Control, and Disclosure of Legal Basis
I am asking OpenAI to publicly explain and address a basic issue of user access, transparency, ownership, and control over information maintained about ChatGPT users.
I am also making a direct request concerning my own information:
I want direct access to the memories and other persistent or derived information OpenAI maintains about me, and I want meaningful control over that information.
These are records and representations concerning me, generated from my conversations, my information, and my interactions with ChatGPT. I do not accept a dynamically generated summary as a substitute for access to the actual information maintained and used about me.
I am a paying customer of this service. If OpenAI has designed a system in which information about me can be collected, inferred, stored, reconstructed, modified, merged, summarized, retained, or reused while I am unable to inspect and control the underlying information, then I want OpenAI to identify the specific legal and contractual authority on which it relies for operating that system in this manner.
I am therefore asking OpenAI to answer the following questions publicly and specifically:
1. Why are ChatGPT users not provided direct access to every memory, derived record, user representation, inference, profile element, or other persistent information maintained about them and capable of affecting future ChatGPT responses?
2. What exactly is the relationship between the information OpenAI maintains about a user and the “Memory summary” presented to that user? If the summary is reconstructed or regenerated, what information is it reconstructed from?
3. Why is the user-facing memory representation repeatedly reconstructed rather than providing the user with a stable, complete, inspectable record of the underlying information?
4. When a user deletes a memory, what exactly is deleted? Is the underlying information itself deleted, or only a particular user-visible representation of that information?
5. Why have users reported previously deleted memories or information reappearing after Memory is later enabled again? If information can be reconstructed after deletion, from what source is it reconstructed?
6. What information concerning a user survives deletion of an individual memory, deletion of a conversation, disabling Memory, or deletion of other user-visible records?
7. What distinction does OpenAI make among saved memories, information inferred from conversation history, generated memory summaries, user models or profiles, derived attributes, internal representations, safety-related records, and any other persistent information associated with an individual user?
8. Why can a user not inspect and control these categories individually?
9. Why can a user not determine precisely which conversation or other source produced each piece of persistent or derived information about them?
10. Why can a user not explicitly approve or reject what information is stored about them before it becomes persistent or is incorporated into subsequent memory reconstruction?
11. Can OpenAI or ChatGPT derive a new memory, inference, profile element, or equivalent representation from information that the user previously deleted? If so, under what circumstances?
12. When information is “forgotten,” “deleted,” or removed from Memory, can copies, embeddings, summaries, derived representations, logs, backups, safety records, training data, or other representations containing or encoding that information remain? If so, for how long, for what purposes, and under what deletion rules?
13. What information from ChatGPT Memory or related user representations is used for model improvement, evaluation, safety systems, personalization, analytics, or other internal purposes?
14. Under what circumstances is information about a user disclosed to, processed by, or accessible to OpenAI employees, contractors, affiliates, service providers, connected applications, or other third parties?
15. What controls exist for a user who wants ChatGPT to retain information for personalization but does not consent to that information being used for other purposes?
16. Can I obtain a complete machine-readable copy of all information OpenAI currently maintains about me—not merely my chat history and not merely the current Memory summary—including persistent memories, historical memory records, derived information, reconstructed information, user representations, and other information used to personalize or otherwise influence future interactions?
17. If the answer is no, on what basis does OpenAI maintain and use information about me while preventing me from directly accessing that information?
18. If a memory concerning me has been modified, merged, compressed, summarized, superseded, or replaced, can I obtain the earlier versions and a record of those changes?
19. If information I previously deleted subsequently contributes to a reconstructed memory, I want OpenAI to identify the retained source from which that information was recovered and explain why that source remained after deletion.
20. What procedure can I use, today, to exercise access, correction, deletion, portability, and other applicable privacy rights with respect specifically to ChatGPT Memory and the underlying information from which Memory is generated?
21. What specific law, regulation, contractual provision, consent mechanism, or other legal basis does OpenAI rely upon to maintain persistent or derived information about a user while not providing that user direct access to the complete underlying information?
22. What specific legal basis permits OpenAI to generate or maintain inferred or derived information about a user that the user cannot directly inspect, correct, control, or delete through the ChatGPT interface?
23. If OpenAI’s position is that a user has no right to inspect some categories of information maintained about that user, what categories are excluded, and under what specific law or legal doctrine does OpenAI claim that exclusion?
24. If OpenAI’s position is that deleting a memory does not require deletion of information from which substantially the same memory can later be reconstructed, what legal basis permits that retention and reconstruction, and what disclosure is provided to the user explaining this consequence before deletion?
25. If consent is the legal basis, where and when did the user provide informed consent specifically for these forms of collection, inference, reconstruction, retention, and reuse? How can that consent be withdrawn, and what happens to previously collected and derived information after withdrawal?
26. If contractual agreement to OpenAI’s Terms of Use or Privacy Policy is relied upon instead of consent, please identify the exact provision authorizing each of these practices rather than referring generally to the Terms or Privacy Policy.
27. Which privacy laws does OpenAI consider applicable to these records—including applicable U.S. state privacy laws—and how does OpenAI believe its current Memory architecture satisfies applicable rights of access, correction, deletion, portability, and transparency?
28. Does OpenAI consider generated memories, inferred characteristics, reconstructed memories, personalization profiles, and other derived representations to constitute personal data or personal information? If not, why not?
29. Does OpenAI contend that transforming information supplied by a user into an inference, summary, embedding, profile, or other derived representation changes the user’s legal rights concerning that information? If so, identify the legal basis for that position.
30. Does paying for ChatGPT alter any of these rights, obligations, or data practices? If not, please state that clearly. If it does, identify exactly how.
This is not simply a request for a better Memory interface.
This is a request for access to information about me and for an explanation of the legal authority under which that information is maintained and controlled.
I want access to my memories and meaningful control over memories and other persistent or derived information maintained about me.
OpenAI should not treat the ability to display a generated summary as equivalent to giving a person access to the information actually maintained about that person.
Likewise, a deletion control should not reasonably communicate that information has been removed if another retained representation can subsequently regenerate substantially the same information without clearly informing the user that this can occur.
At minimum, users should be able to inspect the complete persistent and derived information associated with them; obtain it in a usable and machine-readable form; identify its sources; distinguish user-supplied information from system-generated inferences; inspect modifications and reconstructions; correct inaccurate information; prevent selected information from being incorporated into memory; delete information where applicable; and understand what remains after deletion, why it remains, how it is used, with whom it is shared, and when it will actually be deleted.
If OpenAI believes users already possess these rights and controls, then please identify precisely where and how I can exercise each of them.
If OpenAI believes I am not legally entitled to access or control some category of information maintained about me, then please identify that category and cite the specific legal authority upon which OpenAI relies for denying that access or control.
I am specifically requesting that OpenAI provide me with access to the information maintained about me rather than merely generating another summary of that information.
The central question is straightforward:
If OpenAI maintains information about me in order to remember, infer, model, reconstruct, or personalize my future interactions with ChatGPT, what specific legal authority permits OpenAI to maintain and use that information regardless of opting out from “training their models”, while denying me direct access to and meaningful control over information about myself?