OpenAI Called 20 Million Chats an Invasion of Privacy. It Had Already Searched 78 Million.

Before the New York Times ever sued, OpenAI had already assembled a database of roughly 78 million de-identified ChatGPT conversations, a figure that comes from a publishers' court filing and the reporting on it, not from any public accounting by OpenAI, and had used it internally to measure how much its models reproduce copyrighted work.^[6] Last November, fighting a court order to hand the Times' lawyers a sample of just 20 million anonymized conversations,^[2] OpenAI published a post by its chief information security officer titled "Fighting the New York Times' invasion of user privacy,"^[1] warning that the demand "disregards long-standing privacy protections, breaks with common-sense security practices, and would force us to turn over tens of millions of highly personal conversations from people who have no connection to the Times' baseless lawsuit."^[1] On July 9, the Times and its fellow publishers filed a motion^[6] that reads like a reply eight months in the making. The conversations, in other words, were searchable all along. What changed was who wanted to search them.

The motion, filed in Manhattan federal court before Magistrate Judge Ona Wang on behalf of the Times, the Daily News, and a group of Tribune Publishing and MediaNews Group papers, accuses OpenAI of engaging in a two-year campaign of deception over the course of the litigation.^[4] For two years, the publishers say, OpenAI told the court it was unable to search its training datasets and output logs for their articles. "For two years, OpenAI has been making misrepresentations to the court regarding its ability to search for Daily News content in its training datasets and output logs," said Steven Lieberman, a lawyer for the plaintiffs.^[4] Then depositions of an OpenAI witness, John Vincent Monaco, who was questioned in January 2026 and again that April, let the other side piece together what the company could actually do:^[4] the 78 million conversations; an internal effort called Project Giraffe, including a filter built after the lawsuit was filed that detects and records when a model regurgitates copyrighted text; billions of ChatGPT outputs deleted, the motion says, despite a preservation order;^[7] and millions of logs allegedly swapped out of the 20-million-conversation sample OpenAI eventually produced.^[6] By the newspapers' account, the sanctions filing itself quotes an OpenAI employee as having "performed multiple searches for News Plaintiffs' content."^[8] It was the company's own witness, in the filing's own words, confirming the search it had told the court it could not run.

The remedies requested aim at the heart of the case. The publishers want OpenAI barred from relying on the sample it produced, an established finding that the logs would have shown substantial regurgitation of their work, and their fees paid.^[6] The second request is the one to watch: an adverse finding on regurgitation would remove one of OpenAI's central defenses without a single log reaching a jury. A sanctions motion is an advocacy document, none of this has been ruled on, and OpenAI denies it. But the motion's key material is not a rival's forensics. It is OpenAI's own tooling, described in an OpenAI witness's deposition, under oath.

A privacy that works in one direction

Set the public record next to the alleged private one. In public, OpenAI has spent over a year framing this case as a privacy fight waged for its users: a June 2025 post titled "How we're responding to The New York Times' data demands in order to protect user privacy,"^[5] then the November sequel with "invasion" in the title. In court, its position was that searching those conversations for infringement was beyond its ability. And internally, if the motion is right, it had been doing precisely that, for itself, in a corpus it began building before the lawsuit existed, to answer the exact question it told the court it could not: how much its models actually copy.^[6]

There is a fair version of some of this. Analyzing a de-identified corpus is not an engineer reading your therapy chat, measuring your own infringement exposure is what careful lawyers advise, and courts took OpenAI's objections to handing logs to opposing counsel seriously enough to require the sample be anonymized first.^[2] But the charge at the center of the motion is narrower and much harder to defend: the claim of impossibility. If Project Giraffe could detect regurgitation and 78 million conversations could quantify it, then telling the court the search could not be done was a statement about willingness, not capability. Privacy, on this account, functioned less like a property of the system and more like a permission structure: the same data sat sealed when a court asked and open when OpenAI's own legal exposure was the question. Which is what makes the company's response to the filing so revealing. Asked about a motion accusing OpenAI of quietly assembling and mining tens of millions of user conversations, a spokesperson, Drew Pusateri, called the allegations "blatantly false" and recast the motion itself as the intrusion: as the Times' case "weakens," he said, the publishers are "persisting with their efforts to invade the privacy of people who have nothing to do with this case."^[8] Alongside it, the company's standing refrain: "We'll continue defending our users' privacy and the long-established principles of fair use."^[3] It is a flat denial, and it answers a question about OpenAI's own searches by talking about someone else's privacy, which is the exact move the motion is about.

The stakes run past this docket. AI companies now hold the most intimate text archive ever assembled, conversations people typed believing no one was on the other end, and the rules for who may search that archive are being written in discovery fights like this one, not in terms-of-service updates. OpenAI may yet win the sanctions fight, and it may even be right about fair use. What it can no longer comfortably claim is the framing it chose for itself last November, because privacy that switches on and off depending on who is asking is not a principle. It is a litigation strategy. Watch for OpenAI's opposition brief, which has to explain how "Fighting the New York Times' invasion of user privacy" and a 78-million-conversation infringement database describe the same company. And watch the bench: Magistrate Judge Wang, who has presided over the discovery fight from the start, hears the sanctions motion first, but District Judge Sidney Stein, who has already affirmed one of her rulings once in this case, is likely to have the final word on the sanctions themselves. If the adverse finding is granted, the paper of record will have won a piece of its case on OpenAI's own search results.

---

Sources

1. OpenAI, "Fighting the New York Times' invasion of user privacy," November 2025 Inline ↗

2. "OpenAI ordered to turn over 20 million ChatGPT chats to the New York Times," The Decoder, December 2025 (the 20-million-conversation production order) Inline ↗

3. "New York Times says OpenAI hid evidence in ChatGPT copyright trial," TechCrunch, July 9, 2026 (OpenAI's standing statement on privacy and fair use) Inline ↗

4. "Newspaper groups seek 'serious sanctions' against OpenAI as deception alleged in copyright lawsuit," The Spokesman-Review (New York Daily News), July 10, 2026 (court, plaintiffs, the April deposition, and the Lieberman quote) Inline ↗

5. OpenAI, "How we're responding to The New York Times' data demands in order to protect user privacy," June 5, 2025 Inline ↗

6. News Plaintiffs' Memorandum of Law in Support of Motion for Sanctions Against OpenAI, In re OpenAI, Inc. Copyright Infringement Litigation, No. 1:25-md-03143 (SHS)(OTW), Document 1427-1 (S.D.N.Y., filed July 9, 2026) Inline ↗

7. In re OpenAI, Inc. Copyright Infringement Litigation, No. 1:25-md-03143 (SHS)(OTW), preservation order compelling OpenAI to preserve and segregate output log data, Dkt. 33 (May 13, 2025), as cited in the News Plaintiffs' Memorandum of Law in Support of Motion for Sanctions, Document 1427-1 (July 9, 2026)