Answers

Is it safe to put customer information into ChatGPT or another AI tool?

Ascent Vision · Published October 24, 2026

Usually not without care. What you type into an AI chat tool usually goes to the company that runs it, and its terms and settings decide how it is kept and used. The U.S. Small Business Administration advises trying not to feed AI tools sensitive data. As a default, leave out payment, health and account details, and names or contact details unless the task needs them. This is a plain summary, not legal advice.

Where pasted text goes

As general advice, treat a chat tool as another company, not a private notebook. What you type usually goes to the provider and, depending on the plan and its settings, may be kept and, as the FTC's post on AI companies describes, used to train or update models unless the provider promises otherwise. Those rules change, so this answer summarizes no single provider's; read the data terms for the plan you use before anything private goes in.

The U.S. Small Business Administration's business guide lists security among the risks of using AI: "Try not to feed any sensitive data or proprietary information", it says, to help keep it out of the data pool the system uses. The related answer on what a large language model is explains how these tools work.

What the FTC has said

In a January 2024 post, staff in the Federal Trade Commission's Office of Technology wrote that customers of AI companies may reveal sensitive or confidential information when using their models, "such as internal documents and even their own users' data". The post says companies selling access to AI models that break their privacy commitments may be liable under laws the FTC enforces, and that "There is no AI exemption from the laws on the books".

That is the agency's position, addressed to the companies that build and sell AI models; it does not set out what a business may paste into a tool. The FTC's guide "Protecting Personal Information" offers advice that fits, though it is about outsourcing in general rather than AI tools: before you outsource business functions, "investigate the company's data security practices" and compare their standards to yours. This is a plain summary, not legal advice.

What never to paste

• Payment card or bank details.
• Passwords, login codes and account numbers.
• Social Security or other government ID numbers.
• Health details, or anything a customer told you in confidence.
• Names together with addresses, phone numbers or emails, when the task does not need them.
• Call recordings or transcripts. Recording itself may need the caller's consent, as the related answer on recording customer calls explains.

A one-line rule for staff

The rule: before you paste, take out anything that identifies a customer. Most drafting jobs, such as a reply, a quote's wording or a summary of job notes, work as well with [customer] and [address] in place of real details, added back by hand afterwards.

If a tool will handle customer details often, as general advice, choose one plan for the business, read its data terms and have staff use it instead of personal accounts. Your own promises count too: if your privacy policy or a contract says how customer details are used, pasting them into another company's tool could break that promise. The related answers on whether a website needs a privacy policy and on what a small business can use AI for in marketing go further.

Sources

1. U.S. Small Business Administration, "Manage your business" (Business Guide, section "AI for small businesses"; modified July 30, 2026)
2. Federal Trade Commission, Office of Technology, "AI Companies: Uphold Your Privacy and Confidentiality Commitments" (January 9, 2024)
3. Federal Trade Commission, "Protecting Personal Information: A Guide for Business" (October 2016)

Related answers

• Do you need consent to record calls with customers?
• Does a small business website need a privacy policy?
• What is a large language model (LLM), in plain terms?
• What can a small business safely use AI for in its marketing?