Can Lawyers Use ChatGPT with Client Data?

What Courts Have Actually Done

Start with the case everyone knows. In Mata v. Avianca, Inc., decided in the S.D.N.Y. on 22 June 2023, Judge P. Kevin Castel sanctioned plaintiff's counsel $5,000 after they submitted a brief containing multiple fake case citations with fabricated quotes generated by ChatGPT, then kept defending the citations after the court and opposing counsel could not locate them.

The court's own framing matters as much as the dollar figure. As Seyfarth Shaw noted in its analysis, the judge explicitly stated the attorneys were not sanctioned merely for using ChatGPT as a research tool. They were sanctioned for failing to verify the output and for standing behind fabricated cases after being challenged. The operative failure was unverified AI output entering a court filing.

The pattern has since hardened. On 28 May 2025, in the S.D. Indiana case Mid Central Operating Engineers Health & Welfare Fund v. HoosierVac LLC, Bloomberg Law reported that Judge James Patrick Hanlon sanctioned attorney Rafael Ramirez $6,000 for filing briefs with AI-fabricated citations. The recommending magistrate judge had proposed $15,000 and wrote that "prior sanctions assessed against attorneys who've made AI-related errors have evidently failed to act as a deterrent."

The appellate courts have now joined in. In Whiting v. City of Athens, the Sixth Circuit sanctioned two attorneys for filing briefs with "over two dozen fake citations and misrepresentations of fact," as covered by the Sixth Circuit Appellate Blog. The attorneys were ordered to reimburse the appellees' full reasonable attorney fees on appeal, pay double appellate costs, and each personally pay $15,000 in punitive sanctions to the court registry.

The aggregate picture is the part firm leadership should sit with. ComplexDiscovery counted a combined $145,000 in sanctions tied to AI-generated fake citations in Q1 2026 alone, and researchers had documented 1,313 court proceedings involving AI-generated content submitted to courts as of April 2026, with 496 involving licensed attorneys.

Read together, these decisions say one thing clearly: courts have lost patience with unverified AI output. They say nothing directly about confidentiality, because a pasted client fact pattern does not surface in a docket the way a fake citation does. The confidentiality exposure is quieter, and it runs through the vendor's data pipeline rather than the courtroom.

Consumer vs Enterprise: What OpenAI Does with Your Data

The single most useful document for answering this article's title is OpenAI's own Data Controls FAQ, because it states the defaults in plain terms.

For ChatGPT Team, ChatGPT Enterprise, and API Platform accounts, OpenAI does not train on business inputs and outputs by default. Those products carry a contractual Data Processing Addendum prohibiting training use. Standard retention is up to 30 days for abuse monitoring, and Zero Data Retention is available only under Enterprise Agreements.

Consumer Free and Plus accounts have the opposite default. Content is usable for model training unless the user manually opts out via account data controls, and the 30-day retention for safety review still applies regardless of the training opt-out. That last clause is the one firms most often miss: opting out of training does not opt you out of retention.

This is why the question "can lawyers use ChatGPT?" cannot be answered without a follow-up question: which tier, under whose account, with what contractual terms? A lawyer on a personal Plus account and a lawyer on a firm Enterprise seat are having two very different data experiences with the same interface. The wider architecture questions around sanctioned deployments are covered in our piece on enterprise AI for regulated industries. What the ethics rules add on top is the subject of the next section.

What Informed Consent Would Require

The American Bar Association issued Formal Opinion 512, "Generative Artificial Intelligence Tools," on 29 July 2024. Per the ABA's announcement, it was the ABA's first ethics guidance specifically addressing generative AI use by lawyers, and it restates duties of competence, confidentiality, communication, candor, supervision, and fees for the AI context.

On confidentiality specifically, the opinion's holding is summarized by the National Conference of Bar Examiners: lawyers must understand how a given generative AI tool handles, stores, and potentially reuses input data before entering information relating to a client representation, and must obtain informed client consent before inputting information that could reveal confidential details unless an exception to Rule 1.6 applies.

Notice what that standard presupposes. Informed consent requires the lawyer to know the answer to the tier question above, and to convey it to the client in terms the client can act on. A client told "we use ChatGPT" has not been told about training defaults, retention windows, or the difference between a personal account and a contracted business tier. Whether a specific disclosure satisfies informed consent in a specific matter is a question for your firm's ethics counsel. What can be said generally is that consent built on an incomplete picture of the data pipeline is fragile.

For the full rule-by-rule breakdown, including what state bars have added since, see our companion piece on ABA Formal Opinion 512 and what law firms actually have to do.

The Masked Prompt Path

Between "ban it" and "let everyone paste freely" sits a third option that changes the question entirely: mask the identifiers before the prompt leaves. A lawyer asking a model to tighten the structure of a deposition outline does not need the witness's real name in the request. A model can summarize the shape of a contract dispute without the matter number, the opposing party, or the settlement figures. Most drafting and analysis tasks survive redaction well, because their difficulty is structural, not personal.

Done by hand, masking is unreliable under deadline pressure, which is why the interesting version of this path is masking that happens automatically, on the device, before the request is transmitted. Combined with a business-tier account and its no-training default, a masked prompt means the model receives a question about "the client" rather than a named client, and there is nothing client-identifying to retain, train on, or expose.

Two practical notes for firm leadership. First, this path only works if staff actually use it, which is a detection and alternatives problem as much as a tooling problem. We cover the signals in how to detect shadow AI and, for the legal-sector deep dive, in shadow AI in law firms and what to do next. Second, if you are weighing approaches, our comparison of approaches to shadow AI at law firms lays the options side by side. For how this applies to legal workflows specifically, see Secured AI for legal teams.

Where Secured AI Fits

Secured AI implements the masked prompt path. It sits between the user and the model, and it detects and masks identifiers, including names, dates of birth, account and record numbers, contact details, and custom patterns, on the device before the prompt leaves. When the response comes back, real values are restored locally. Identifiers are held in a zero-knowledge vault, and the master key is never stored server-side.

For law firm use, its legal data detection covers client names, matter numbers, case names, opposing parties, witness names, contract terms, and settlement details. It works with OpenAI and DeepSeek, requires no behaviour change for staff, and supports matter-level policies and role-based access. Its usage logging is deliberately honest about what it is: a record of what left and what was masked. The product is built with compliance-focused architecture, and how any firm deploys it in light of its ethical duties is, as throughout this article, a question for that firm's ethics counsel.

Frequently Asked Questions