Free AI tools: what users pay in data

Analysis note

Asmaa EL FORKANI 6 min read

Free access to a conversational assistant is not a service without consideration. Depending on the settings, the main providers’ terms provide for the use of exchanges to improve models. They also provide for the review of those exchanges by humans and their retention beyond the session. For a company, an association or a public body, the use of these tools is not the decisive question. Instead, the decisive question is the nature of the information entered into them.

providers' terms – Information Systems & Digital Transformation

Observation: free assistants and the providers’ terms for consumers

Generative artificial intelligence entered organisations through individual use before any management decision. Employees, volunteers and public officials resort to assistants available free of charge, most often through personal accounts. They use them for drafting letters, summarising documents, preparing publications and translation.

These free offerings fall under the providers’ terms applicable to consumers. In contrast, business offerings fall under commercial terms and, as a general rule, under a data processing agreement. The difference lies not in the quality of the answers, but in the regime applicable to the data entered.

Analysis: what the providers’ terms provide

Three variables determine what the user gives up in data. These are the use of exchanges to train models, their review by humans and the length of their retention. The providers’ terms consulted on 21 October 2026 provide three illustrations.

  • OpenAI (ChatGPT, consumer offerings): the provider states that it may use content to train its models. However, the “Improve the model for everyone” setting makes it possible to opt out for new conversations. The provider may retain temporary chats for up to 30 days for safety reasons. In addition, user feedback on a response may lead to the use of the conversation concerned. By default, the provider does not use content in business workspaces.
  • Google (Gemini Apps): human reviewers, including those of service providers, examine a portion of exchanges. The provider retains reviewed conversations for up to three years, disconnected from the account, including after deletion of the activity. Moreover, with activity turned off, conversations remain associated with the account for 72 hours. Finally, the provider recommends not entering confidential information.
  • Anthropic (Claude, Free, Pro and Max plans): since the update announced on 28 August 2025, the provider may use conversations to improve models if the user allows it. Retention then extends to five years, compared with 30 days otherwise. However, the update does not affect services governed by the commercial terms, including the API.

The regimes set by these providers’ terms have one point in common. In each case, the setting belongs to the account holder, not to the organisation whose information that person handles. An organisation that allows its teams to use personal accounts is therefore unaware of the settings chosen. It is equally unaware of the destination of the content entered.

Analysis: the legal implications in Morocco

Entering data relating to identified or identifiable natural persons into an AI tool constitutes processing within the meaning of Law No. 09-08. Such persons include customers, employees, members and service users. The organisation from which the data originate remains responsible for them. It is answerable for the purpose, proportionality and security of the processing. This also holds where the data entry results from an employee’s initiative.

Where the provider operates the service outside Morocco, entering data may also constitute a transfer of data abroad. Article 43 of Law No. 09-08 permits such a transfer only to a State ensuring a sufficient level of protection. The National Commission for the Control of Personal Data Protection (CNDP) has drawn up a list of such States. As worded following Deliberation No. 236-2015, that list does not include the United States. Outside that list, a transfer requires one of the derogations in Article 44. These include, in particular, the express consent of the data subject or an authorisation from the CNDP. However, the consent of an employee who uses the tool does not cover the data of third parties that the employee enters into it.

By a press release of 18 March 2025, the CNDP initiated work towards a deliberation on artificial intelligence processing using personal data. In that release, it recalled the requirements of integrity, transparency, fairness and intelligibility of such processing. It also recalled individuals’ access to means of redress. No final deliberation had been identified as at 21 October 2026.

Data that are not personal are not thereby free to use. This applies, for example, to customer information covered by a confidentiality undertaking, projects, financial data, pending bids and internal documents. Entering them into a service whose provider may review or retain exchanges may breach contractual or professional confidentiality obligations.

Implications

The free tool remains suitable for tasks that involve neither personal data nor confidential information. Such tasks include, for example, rewording a public text, generating ideas, structuring an outline and explaining a concept. It ceases to be so as soon as the task concerns a customer, an employee, a case file or an internal document.

For such uses, the organisation has two levers. The first is the choice of business offerings governed by commercial terms and a data processing agreement. That choice comes after an examination of the place of processing in the light of Articles 43 and 44 of Law No. 09-08. The second is internal governance. It comprises a use charter distinguishing permitted and prohibited data, a register of uses and training for teams. Neither lever, however, removes the need to check the providers’ terms applicable at the relevant date. Indeed, providers frequently amend these terms.

Points of attention

  • Identify the AI tools actually in use, including through personal accounts.
  • Check, for each tool, the settings for training, human review and retention, as well as the date of the terms consulted.
  • Prohibit the entry of personal data, customer data and confidential information into a consumer tool.
  • Reserve processing involving personal data to offerings governed by a data processing agreement, after examination of the place of processing.
  • Record the rules adopted in a use charter and a register of uses.

References

See also: Guide – Good and bad practices for generative AI at work; Grid – AI maturity self-assessment; Library – Prompt templates by function. Information Systems & Digital Transformation practice.

Share

General information document; it constitutes neither legal advice nor an opinion on a particular situation. References to legal texts should be checked against the version in force on the date of use.

Consulting firm not registered with the Bar; no representation before the courts and no act reserved to the regulated legal professions.