OpenAI’s Project Lily Exposed

Person typing on laptop with digital security shield overlay — Photo: Rawpixel.com / Shutterstock

Leaked documents say OpenAI paid people to read real ChatGPT chats, raising new questions about consent and privacy that most users never expected.

Story Snapshot

Reports describe “Project Lily,” where contractors read full user-chat transcripts.
OpenAI’s help pages say limited staff and vendors can access user content for set reasons.
OpenAI says a Privacy Filter hides personal details, but some sensitive data can slip through.
Users can limit data use with settings like temporary chats and training opt-outs.

What the leaked program claims and why it matters

Named outlets report that OpenAI used a program called “Project Lily” to have contractors read real ChatGPT conversations and rate replies. India Today says reviewers sometimes saw entire exchanges that could include personal details. These reports alarm users who assumed a private chat was only between them and a machine. The core issue is not whether any review happened. The issue is whether users saw, understood, and agreed to it in a clear way.

OpenAI’s help materials state that a limited number of authorized employees and trusted service providers may access content for safety, support, legal, and improvement purposes. That disclosure exists, but many users never read long policies. People often type health, finance, or family details into a chat box. When those details may reach human eyes, even in part, trust can drop fast. That gap between formal notice and real understanding drives the current backlash.

How OpenAI says it reduces risk

OpenAI says it uses both automated tools and human review to monitor activity, in line with its policies. The company also offers controls. Temporary chats are deleted, do not add to memory, and are not used for training, which reduces exposure if users toggle that setting on. These tools give people options, but the default path still matters. If data use is on by default, many users will not change it, either due to habit or confusion.

Reports say OpenAI runs a Privacy Filter to remove personal information before a person reviews a chat, but the company acknowledges the filter can miss details at times. Reviewers do not see usernames, according to coverage, which lowers direct risk of linking a chat to an account. Still, a full conversation can carry unique facts about a job, a school, or a medical issue. Even when names are hidden, context can reveal more than people realize.

Why both left and right share this concern

Americans across the spectrum worry that powerful firms set the rules, then bury key choices in legal pages. Conservatives see mission creep, weak consent, and higher risks for small businesses and families. Liberals see power imbalances, where data flows up to large companies while users lose control. Both sides see a pattern: institutions ask for trust first and transparency later. This story fits that pattern, which fuels anger at unaccountable “elites.”

Contractors rate and critique ChatGPT's replies and have been tasked with training the model to be less sycophantic, a problem that OpenAI has linked to user harm in multiple lawsuits.

OpenAI says it tries to remove personal information before prompts reach reviewers but… pic.twitter.com/tVqHcjEUlU

— Annie Cushing (@AnnieCushing) September 15, 2026

Policy makers face a simple test. Make disclosures short, plain, and on-screen before chats are used for training or human review. Force the choice to the front, not the footnotes. Companies can start by defaulting to no human review unless a user opts in. Clear buttons for “do not use my chats” and “delete after 30 days” would help. Users can already turn on temporary chats and review privacy settings today, but defaults drive outcomes.

What users can do right now

Users who handle sensitive data should switch on temporary chats and training opt-outs in settings. People should avoid sharing names, account numbers, addresses, and medical or legal secrets in any consumer chatbot. If a task needs strict privacy, consider paid tiers with stronger limits and signed terms, or do not put that data into a chatbot at all. Until rules catch up, the safest assumption is simple: anything you type could be seen, analyzed, or kept longer than you expect.