Last week a security researcher noticed that shared conversations from Anthropic's Claude were being indexed by Google. A specific search query pulled up thousands of them. Personal chats, work brainstorms, the odd bit of medical anxiety. Anthropic fixed the indexing quickly. The people who had already been indexed did not get an undo button.
Two days later ZDNet ran a walkthrough of the privacy settings on ChatGPT, Gemini, Copilot, and Claude. It is a useful piece and worth reading. What it accidentally documents is something else. Every major AI chatbot ships with privacy controls that require the customer to find them, understand them, and toggle them, one at a time, across three menus deep. Call it the five-toggle privacy tax.
Here is what it looks like laid out.
| Service | Toggles | Where they live | The trap |
|---|---|---|---|
| ChatGPT | 3 | Settings → Data controls; ellipsis on each chat; icon top right | Shared links stay live for as long as the chat exists. |
| Gemini | 5 | Activity page; Personal Intelligence; Settings → Activity | Opting out of training also kills your chat history. One is welded to the other. |
| Copilot | 5 | Settings → Privacy; Settings → Memory; Settings → Connectors | Two separate training switches (text, voice) and a Connectors panel for OneDrive, Gmail, Drive, and friends. |
| Claude | 4 | Settings → Privacy; Settings → Memory; the ghost icon | Training is off by default. The share dialog defaults to “public link”. |
That is between three and five deliberate acts, per service, to arrive at a defensible position. None of them are obvious. Several are hostile. Gemini's is the standout: the only way to stop Google training on your conversations is to stop Google remembering your conversations. You lose your own history to protect it from theirs. That is not a bug in the settings design. That is the settings design.
The pattern under the pattern is simple. Every default in that table is set to the option the company wants. Training on, memory on, sharing public, connectors wide open, voice recordings sent to reviewers. The opt-out is available, but it is friction, and friction is the point. Most people never toggle anything. That is what the friction is for.
You can tell a lot about a company's actual privacy posture from how many actions it takes to reach a private state.
Anthropic ships with training off. That is one toggle you did not need to find. Google ships with your voice going to human reviewers unless you know that sentence contains the word “unless”. Microsoft ships with two training switches because it has two ingest paths. Every one of these choices is a business decision dressed up as a settings screen.
The design lesson
There is a design lesson here for anyone building consumer software: the number of toggles a customer has to flip to protect themselves is the number of decisions you made against them.
The product lesson
All of this is only necessary because the conversation is happening on someone else's computer. A local assistant, running on the customer's own Mac, does not need a training toggle because there is nothing to train on. It does not need a memory switch because the memory belongs to the customer. It does not need a “delete shared link” screen because the link never left the house.
We build that. It is called Ostler. Nothing in this post is a fix for the five-toggle tax. The fix is not paying it.
Thoughts or corrections – [email protected].
Further reading: Lance Whitney, How to keep your conversations with ChatGPT, Gemini, Copilot or Claude as private as possible, ZDNet.