The Privacy Reckoning: Why Every PII-Laden Document Is Now a Liability
The courtroom has come to the chatbot
Twenty-five lawsuits against AI companies in 2023. By October 15, 2026, the annual count had reached 97, with roughly ten weeks left in the year. The AI Lawsuit Tracker now lists 257 cases against 76 companies, including 64 naming OpenAI. Active and resolved cases, to be clear. Still, that is quite a pile of paper.
Most concern copyright. But the cases that worry me, and should concern lawyers, mediators, advisors and clinicians, get much closer to the client sitting across the desk. What happens to the confidential information we type, upload, or simply say into these tools?
It can be stored. Reviewed. Subpoenaed and produced. The details depend on the service, its settings and the legal circumstances, but the exposure is real. When a document arrives carrying names, account numbers, diagnoses and Social Security numbers, the professional who sent it has a problem too. A convenient upload button does not transfer responsibility.
The rules are multiplying, not settling
The United States still has no comprehensive federal privacy law covering the economy as a whole. We do have sector-specific federal laws, and a growing collection of state requirements. The source summary cited here counts 20 states with comprehensive privacy laws; Indiana, Kentucky and Rhode Island brought theirs into effect on January 1, 2026. Definitions, exceptions and enforcement differ. Keeping up can feel like assembling a puzzle while someone keeps changing the pieces.
Then there are the obligations attached to the profession itself. Those do not disappear because the software is new:
- Lawyers: ABA Formal Opinion 512, issued in July 2024, brings Model Rule 1.6 directly into the generative AI discussion. It calls for informed consent before client information goes into self-learning tools of the kind that risk disclosing that information. Read the terms, understand the risks, and explain them. A boilerplate sentence in an engagement letter is not enough.
- Mediators: confidentiality is part of what people believe they are buying into. Paste a session summary into a consumer chatbot and you are sending it to an outside provider. Whether that disclosure is permitted depends on the applicable rules, agreements and safeguards. The parties should not have to discover the arrangement after the fact.
- Financial professionals: Regulation S-P requires covered institutions to maintain written safeguards for customer information. AI prompts and outputs connected with recommendations also need to be assessed under applicable books-and-records requirements. FINRA Notice 24-09 is quite direct: existing obligations continue to apply when AI is used. There is no technology exemption.
- Healthcare: HIPAA enforcement deserves attention, too. The StationX summary reports 21 OCR enforcement penalties in 2025, compared with 16 in 2024. Those are its reported counts, not a claim that every matter was a civil monetary penalty rather than a settlement. The distinction matters.
Outside the United States, the same summary reports 172 countries with data protection laws and cumulative GDPR fines of €7.1 billion by January 2026, up 21% in a year. The EU AI Act reached its general application date in August 2026, but it did not become fully applicable all at once: important high-risk requirements extend into December 2027 and August 2028. The highest penalty tier, for prohibited practices, can reach €35 million or 7% of worldwide annual turnover. California has also begun requiring risk assessments for covered processing, with separate automated decision-making requirements beginning in 2027. Different clocks, substantial consequences.
My simple take away. Having a privacy policy is only the beginning. Being able to show what data went where, and why it was allowed to go there, is the harder part.
The numbers behind the risk
These professions handle information that is expensive to lose. IBM’s 2025 study found customer PII involved in 53% of the breaches studied. Healthcare remained the costliest industry; the source summary describes a run of 14 years. These are historical study findings, not a price tag on any one client file.
| Statistic | Figure | Source |
|---|---|---|
| Average healthcare breach cost | $7.42M | IBM 2025 |
| Average financial services breach cost | $5.56M | IBM 2025 |
| Extra cost when “shadow AI” is involved | +$670K per breach | IBM 2025 |
| Organizations with no controls on uploads to AI tools | 83% | IBM 2025 |
| Organizations with no formal AI governance policy | 63% | IBM 2025 |
| Organizations already exposed through employee use of public AI | 60% | Reco 2025 |
| Breached organizations that also paid regulatory fines | 32% | IBM 2025 |
| Consumers who won’t buy from a company they don’t trust with data | 75% | CookieYes 2025 |
How to read these figures. IBM’s $670K compares high shadow-AI use with low or no use; it is not a surcharge on every AI-related breach. 63% include organizations still developing a policy. The 60% Reco and 75% CookieYes figures are retained as reported by the secondary source, without independent confirmation of their underlying survey wording or samples. These percentages should not be treated as population-wide facts.
Look at the gaps in oversight alongside the costs. That is what troubles me. The studies do not prove that most organizations have leaked client files, or that every unauthorized upload becomes a breach. They do show why a policy sitting quietly in a folder is not much comfort when nobody knows which documents have left the building.
The lawsuits: AI providers are now defendants, and your data is the evidence
The tracker’s October 15 snapshot includes 65 class actions and 25 actions brought by government enforcers. OpenAI is named in 64 cases, Google in 24, Meta and Microsoft in 21 each, and Anthropic in 18. One case can name several companies, so these counts should not be added together.
Five cases make the concern more concrete. Allegations are not findings of liability, and a ruling allowing claims to proceed is not a verdict. With that distinction in mind see table below:
| Case | What happened | Why it matters to you |
|---|---|---|
| United States v. Heppner (S.D.N.Y., Feb 2026) | Judge Rakoff held that a defendant’s chats with a consumer AI assistant were neither privileged nor work product. The FBI seized 31 documents from those chats. | The provider’s privacy policy allowed disclosure to third parties, so the court found no expectation of confidentiality. |
| NYT v. OpenAI (S.D.N.Y., Dec 2025) | OpenAI was ordered to produce 20 million ChatGPT logs. | Conversations users believed were private became discovery material in someone else’s lawsuit. |
| In re Otter.AI Privacy Litigation (N.D. Cal., filed Aug 2025) | An AI notetaker with 25 million users allegedly recorded meeting participants without their consent and trained its models on the recordings. Wiretap and California privacy claims survived dismissal in August 2026. | Client calls, depositions and mediation sessions are exactly the meetings these tools join. |
| Thele v. Google (N.D. Cal., filed Nov 2025) | The suit alleges Gemini was switched on by default across Gmail, Chat and Meet. It was dismissed in July 2026 with leave to amend. | AI can reach your email and documents without anyone choosing to upload them. |
| Vredenburgh v. OpenAI (N.D. Cal., filed Sep 2026) | The suit challenges human review of users’ ChatGPT conversations. | ”Private” chats may be read by people you never authorized. |
Case context. Heppner concerned a defendant’s own use of Claude without counsel’s direction, not a blanket holding about all legal AI use. The NYT row refers to the December 2025 production order, not the filing date of that lawsuit. Production in litigation is not the same as public release. The Otter, Thele and Vredenburgh entries describe allegations and procedural developments; they do not establish liability.
What I take from these cases is a warning about control. Information sent to an AI service may be retained, reviewed by staff, sought in discovery or obtained by investigators. Confidentiality and privilege depend on the facts and protections in place. We cannot simply assume they survived the upload.
How client data escapes
Three routes are worth separating. Only the third requires an outside attacker; the first two can start with someone just trying to finish the day’s work.
- Shadow AI. A professional wants a quick summary of a settlement memo, tax return or patient chart. A few clicks, and the file is on a third-party server. Depending on the service and its settings, it may be used for training or become available for review, legal demands or a breach. Nothing about the quiet click of a mouse tells you how far the information may travel.
- AI agents and “data exhaust.” Note-takers, CRMs and autonomous agents can need extensive access to client records. They also produce logs and transcripts, copies that may fall outside existing data-loss monitoring. In a Cloud Security Alliance financial-services survey, 61% of respondents identified sensitive-data leakage as their leading AI security concern. That is a survey result, not a finding that 61% suffered a leak.
- AI-powered attacks. Criminals can use AI to accelerate attacks and put more pressure on teams trying to patch weaknesses. On October 14, 2026, South Korean regulators reported hacking incidents at 16 financial firms and roughly 100,000 cases of data leakage. Investigators were still determining whether AI was involved. Suspected AI-agent attacks, yes; confirmed AI causation, not yet.
The document is one practical place to intervene. Firewalls and policies matter, but removing personal information before sharing reduces what can escape. Of course, changing a name is not the same as making someone unidentifiable. Context, hidden text and other details can give the person away.
It is time to strip the PII out
Policies tell people what to do. Removing unnecessary PII reduces the consequences when a sharing decision goes wrong. I would make that a routine step before a document is shared, uploaded, filed or fed to an AI tool, wherever the task and legal requirements permit it. Not an afterthought when the screen is already flashing “upload complete.”
That is the practical purpose of PII Anomalyzer. It helps identify and remove names, addresses, Social Security and account numbers, dates of birth, health insurance IDs and other PII from documents. Keep the substance needed for analysis, drafting or negotiation; keep the identifying details under your control. Review the result before sharing. The software supports that work; it does not replace the professional judgment behind it.
For the people handling these files, the benefit is concrete:
- Lawyers can reduce the exposure of client identities when preparing files for AI analysis. Protecting privilege and complying with Rule 1.6 still requires an assessment of the remaining content, the tool and the intended use.
- Mediators can better protect the confidentiality promised to the parties, while checking that the remaining details do not identify them or reveal protected discussions.
- Financial professionals can reduce unnecessary disclosure while carrying out Regulation S-P safeguards and applicable recordkeeping duties. Required original records still need to be preserved.
- Healthcare professionals can reduce exposure of patient information in a sector where IBM’s 2025 average breach cost was $7.42 million. HIPAA de-identification has specific requirements; removing obvious identifiers alone does not establish compliance.
I do not see a sensible reason to wait for another lawsuit to settle this for us. The vendor’s responsibilities do not erase our own, and a cheaper place to address risk is before the information leaves our hands. Remove what the recipient does not need. Then check what remains.
Before your next upload, run it through PII Anomalyzer. Review it, then share what is needed.
Sources
- AI Lawsuit Tracker: case counts, filings by year and most-sued companies (updated Oct 15, 2026)
- AI Lawsuit Tracker: class actions and case database
- Orrick: Court Rules AI Conversations Are Not Privileged (United States v. Heppner)
- Digital Policy Alert: OpenAI ordered to produce 20 million ChatGPT logs
- PPC Land: Otter.ai class action
- Nathan House, StationX, Data Privacy Statistics 2026 (Oct 2026), citing IBM Cost of a Data Breach 2025, Cisco 2025–26, DLA Piper 2026, IAPP and CookieYes
- The Current Regulatory Landscape: What Advisors Need to Know and The Three Core Breaching Mechanisms (source briefs supplied by the author)