A Miami judge orders AI chat logs, and the records of deleted chats

The Morse teamPublished November 12, 20268 min read

A federal judge orders AI chat logs, including the records of deleted chats, in a defamation case in Miami. On November 11, 2026, Magistrate Judge Marty Fulgueira Elfenbein ordered the defendant to sign notarized consent forms letting AI providers, "including ChatGPT/OpenAI and Grok/xAI," disclose "all account data and content associated with Defendant's accounts, including but not limited to available deletion logs," and to send them from his own account email addresses by 9 a.m. the next day.

We read the November 11 order and the earlier filings it builds on, on CourtListener's copy of the docket, on November 12, 2026: Fontainebleau Florida Hotel, LLC v. Botach, No. 1:25-cv-20251 (S.D. Fla.). The hotel's claims are allegations, and we say so where they come up. This isn't legal advice.

What is the Fontainebleau case about?

The hotel is suing a man the court record names as Jacob Shmuel Botach, also known as Shmuley Boteach, for defamation. Its amended complaint, filed in February 2025, alleges that after a December 2, 2024 incident in the hotel's lobby he ran a campaign against it, "creating AI videos" and "falsely accusing them of banning Jews from the property." His notice of removal describes the same incident as one in which "a registered guest threatened and harassed Defendant based on Defendant's religious beliefs."

No jury has decided whether his statements were false. In September 2026 the court "struck his pleadings, and entered default judgment against Defendant" as a sanction for repeatedly violating an order limiting his social media posts about the hotel, according to the district court's September 18 order. What's left is damages. The court allowed the chat discovery mainly to test the hotel's claim that he meant to harm it, which under Florida law can lift the cap on punitive damages.

What did the November 11 order require?

Four things, each spelled out in the order:

1. Sign the forms as written. He must complete the hotel's updated consent forms "without altering or qualifying the language required by the Court," with his usernames, email addresses, and physical addresses, and have them notarized.
2. Send them himself. The forms go to the providers "using the email addresses associated with his respective AI accounts," not from his lawyer's address.
3. Use Grok's portal too. For Grok, he must also submit the authorization through the provider's privacy portal.
4. Review again if anything was deleted. If the deletion logs show no deleted chats, he needn't re-review the new data. "If the logs reflect deleted communications," he must find and produce the responsive, nonprivileged ones.

The same order found that he had failed to comply with at least two earlier discovery orders and made him pay the hotel's attorney's fees for the November 5 and 9 hearings. Whether he waived privilege by missing the privilege log deadline is still under advisement.

Why does consent to provider logs matter?

Because the providers asked for it, according to the hotel. The November 6 order records the hotel's report that the AI providers "maintain deletion logs for accounts but require Defendant's consent before releasing such information." For chat content, federal law adds its own bar. The Stored Communications Act stops a provider of an electronic communication service to the public from divulging "the contents of a communication" it stores, with an exception for "the lawful consent of the originator" (18 U.S.C. § 2702).

A deletion log shows whether anything is missing, which the remaining chats can't. A user can hand over an export of what's left, and the provider's log can show what was taken out. The hotel asked for provider records because of "concerns that Defendant may have deleted or failed to preserve responsive AI communications," as the October 21 order puts it. The November 6 order adds that the court "makes no finding that Defendant deleted responsive communications or engaged in spoliation at this time."

Deleting a chat doesn't take it off the company's systems right away. As of November 12, 2026, OpenAI says a deleted chat is scheduled for permanent deletion "within 30 days," unless OpenAI "must retain it longer for security or legal obligations" (OpenAI). Grok's privacy policy, now issued by SpaceX Super Intelligence and last updated October 27, 2026, says deleted conversations go within 30 days "unless it is necessary to retain the data for legal, compliance, or safety purposes" (Grok privacy policy). Both companies put a number on the window, which makes it easy to know when a deleted chat should be gone. For how to delete in each app, see deleting your ChatGPT history and deleting your Grok history.

How did the order go from no consent to full consent?

In three weeks, and only after two narrower orders hadn't produced the records. Law360's October headline said the hotel won access to "some" of his chats (Law360), and as of November 12 the AI discovery tracker kept by Damien Charlotin ends with the November 6 consent, "limited to the disclosure of deletion logs." The November 11 order replaced that with consent to disclose all account data and content.

On October 21 the judge wrote that Rule 34 "does not expressly require a party to execute an authorization allowing a third party to disclose records directly to an adversary." The November 11 order explains what changed. The hotel said he "materially modified the proposed consent forms," left out the account details and the notarization, and sent them through counsel, so the providers wouldn't process them. The court found that his changes had "rendered it useless" and, with discovery closed, granted the broader consent.

He had asked for an emergency stay of discovery while he appealed, as Mealey's reported on November 11. The motion itself isn't in CourtListener's copy of the docket as of November 12, and neither is a ruling on it. The November 11 order treats the deadlines as binding: it finds that his failure to produce the AI account data "continues to violate the Court's prior Orders."

Can your AI chats be used in a lawsuit?

Yes. Earlier rulings set the ground rules: Heppner held chats with Claude weren't privileged, Warner v. Gilbarco protected one person's ChatGPT use as work product, and a court made OpenAI preserve chats users had deleted. We cover those in can AI chats be subpoenaed and the ChatGPT court order on data retention. The October 21 order weighed both Heppner and Warner and found that neither establishes "a categorical rule governing all AI communications."

What the Miami case adds, for anyone's history:

• Your chats count as your documents. He told the court he had obtained his ChatGPT and Grok account data and given it to an e-discovery vendor, and the court still required him to review it and produce what was responsive.
• The scope has limits. The court refused requests for every chat about the lawsuit itself, about court orders, or about the two judges, because they reached past the damages questions.
• Work product is decided chat by chat. The court rejected a blanket objection and asked for a privilege log, so each withheld chat has to be justified.
• The provider's copy can be checked against yours. A deletion log can show what an export leaves out, and once a dispute is likely, deleting relevant chats can be held against you. The same discovery rules reach family cases, as our guide to AI chats in a divorce explains.

How Morse keeps your chat history off its servers

Every step of the Miami orders runs through records an AI company keeps: account data, chat content, and logs of what was deleted, all tied to a username and an email address. The consent forms were needed because the providers held those records on their servers. Morse is built not to keep that store. Your chat history lives on your device, in your browser, encrypted. Our servers don't keep messages or log message content, and your account holds only your sign-in details, plan, balance, and a usage ledger with no content. Our privacy policy says what that means when the law requires us to hand something over: "Because we don't store your chats, we usually have very little to give."

Pick a privacy mode for each chat:

• Private, for chats you don't want sitting in any company's logs. It's the default. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under zero data retention: Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for anything no one should read. Your browser checks the secure enclave's proof that it's genuine before anything leaves your device, then encrypts the message so only that enclave can read it. Our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed.
• Anonymous, to use GPT, Claude, or Gemini without the provider knowing it's you. Our proxy strips your account, email, and IP address and sends the message under Morse's own account. The provider may keep the message for a limited time to check for abuse, under its own policy.

In every mode, Morse doesn't train AI on your content, sell your data, or show ads. Unlocking your history takes two keys, one that never leaves your device and one our server gives you when you sign in. The history on your device is still your record, so the same duties apply to it in a dispute: keep what's relevant, and ask your lawyer before you clear anything.

Try a chat from the Morse home page without an account, or start free; end-to-end encrypted chats come with Pro, at $19 a month.