The FTC's AI chatbot investigations, 2023 to 2026, and what they ask about your chats

The Morse teamPublished November 11, 202611 min read

As of November 2026, the FTC's AI chatbot investigation has three parts: a 2023 civil investigative demand to OpenAI, reported by the Washington Post; September 2025 orders asking seven companion chatbot companies, OpenAI among them, how they use what people tell their chatbots; and October 2026 demands to OpenAI and Anthropic that Axios reported and Anthropic's own IPO filing confirms. None of them has produced a complaint, a fine, or a finding against a chatbot company. Each one asks how long the company keeps your chats, who can read them, and whom it gives them to.

We read the FTC's press releases, its 6(b) order, two Office of Technology posts, and its staff report on AI partnerships on November 11, 2026. We also read the 2023 demand itself, from the copy the Washington Post published (an archived copy), three Axios reports (archived copies), and Anthropic's S-1 on the SEC's site. The FTC's own pages list none of the civil investigative demands, so where only a newspaper says one exists, we label it as reported.

FTC AI chatbot investigation timeline, 2023 to 2026

Every row comes from the FTC's own pages unless it says "reported".

What is the FTC investigating OpenAI and Anthropic for in 2026?

Possible consumer protection violations tied to AI safety incidents, according to Axios. On October 15, 2026, Axios reported that the FTC had sent civil investigative demands to OpenAI and Anthropic the day before, citing a person familiar with them. The demands "are more than 50 pages long each and ask for documents concerning security incidents and safeguarding practices," and also ask for "marketing materials and documents detailing company privacy policies." On October 14, the day the demands went out, eight state attorneys general sued OpenAI, which we cover in why states are suing OpenAI.

Anthropic confirmed its own demand in its S-1 (Anthropic S-1), which we cover in Anthropic's IPO filing.

OpenAI hasn't confirmed a demand on its own pages as of November 11, 2026. A spokesperson told Axios: "We will engage constructively with the FTC." On October 26, an FTC spokesperson told Axios that "individuals at other AI companies have also received demands to testify." The FTC's artificial intelligence page lists none of this as of November 11, 2026.

What did the FTC ask AI companion chatbot companies in its 6(b) orders?

How they make money from engagement, how they protect children, and what they do with conversations. On September 11, 2025, the FTC ordered seven companies to file special reports: Alphabet, Character Technologies, Instagram, Meta Platforms, OpenAI OpCo, Snap, and X.AI Corp. One of the eight topics in the release is how the companies "use or share personal information obtained through users' conversations with the chatbots" (FTC). The release also asks whether they comply with the Children's Online Privacy Protection Act Rule.

The model order is more specific than the release (FTC 6(b) order). It gave each company 45 days and covers January 1, 2022 onward. Specification 22 asks each company to list every category of personal information it collects and, for each one, to describe:

• where it is stored, "including the extent to which You have created copies of the data for product development or other purposes"
• how long it is kept, and "how long the data is stored after a User has requested its deletion or has deleted their account"
• who inside the company can access it, and which "third parties with whom the data is shared or sold"
• "any steps You have taken to monitor, log, and audit who is accessing the data and for what purpose"

The order defines personal information to include "User Content," meaning what you type and what the chatbot says back, down to "full or partial transcripts, chat or call histories, metadata, and any information derived therefrom." Specification 7 also asks how each company makes money, naming "the use, sharing, or sale of User data" as one way. We compared what 14 companion apps' own policies say about these questions in AI companion app privacy.

What did the 2023 FTC investigation of OpenAI ask about user data?

How long OpenAI kept chats, who could read them, and what deleting them did. The Washington Post reported on July 13, 2023 that the FTC had opened "an expansive investigation into OpenAI" over whether it put "personal reputations and data at risk," and it published the demand itself (Washington Post, archived copy). The FTC's own pages don't mention it.

The demand names its subject as whether OpenAI "engaged in unfair or deceptive privacy or data security practices," back to June 1, 2020 (the demand, archived copy). Its section titled "Monitoring, Collection, Use, and Retention of Personal Information" asks, among other things:

• which staff "may access or monitor user interactions with the Product, whether that access or monitoring is real-time or later in time" (interrogatory 43)
• how long each type of personal information is stored "by default," "if a user has opted out of data retention," and "after a user has requested its deletion or has deleted their account" (interrogatory 45)
• for every way to delete personal information, "including chat histories," which data OpenAI keeps anyway, and "any process by which users can verify the efficacy of their deletion request" (interrogatory 48)

Interrogatory 37 asks about the March 2023 bug that let some users see "titles from another active user's chat history," though the demand dates OpenAI's disclosure "March 24, 2020." OpenAI's own post is dated March 24, 2023 and says payment details of "1.2% of the ChatGPT Plus subscribers" may have been visible (OpenAI, archived copy). We cover that incident in ChatGPT data breaches.

What the FTC asked about your chats, document by document

The two documents we could read in full, set side by side, with the 2026 demands as Axios describes them.

Can the FTC read your ChatGPT chats through these investigations?

Not directly. Both the 2023 demand and the 2025 order ask about chats, and both end with the same notice: a company that counts as a communications provider under the Electronic Communications Privacy Act should not "divulge a record or information pertaining to such customer or subscriber or the content of such customer's or subscriber's communications, other than the content, records, and information specifically requested." Complaints are the exception. The 2023 demand asks for a sample of consumer complaints about privacy, to be chosen by FTC counsel later, and the 2025 order asks for complaints "in a de-identified form" (specification 17). A complaint can quote a chat.

The answers stay private too. The 2023 demand says the FTC won't release what OpenAI sends under the Freedom of Information Act, and the 6(b) order says confidential information "will be reported by the Commission on an aggregate or anonymous basis." You won't learn from either how long your own chats are kept.

One instruction can make a company keep more. The 2023 demand told OpenAI to "suspend any routine procedures for Document destruction" for anything "in any way relevant to this investigation." The demand doesn't say whether that reached users' chats. A court order in the New York Times copyright case did, which we cover in can AI chats be subpoenaed.

What has the FTC said AI companies can't do with your data?

Break their privacy promises, mostly. In a January 9, 2024 post, FTC technology staff wrote that model-as-a-service companies must keep their promises not to use customer data "for secret purposes, such as to train or update their models." The post adds that the FTC has made companies that unlawfully obtained data delete the models and algorithms "developed in whole or in part using that unlawfully obtained data" (FTC). The post ends: "There is no AI exemption from the laws on the books." A February 2024 post added that quietly changing a privacy policy to start AI training "may be unfair or deceptive," which we cover in AI privacy policy changes.

The FTC has also pulled back one AI order. On December 22, 2025, it set aside its 2024 order against Rytr, one of the Operation AI Comply cases, saying the order "unduly burdens artificial intelligence (AI) innovation" (FTC). It still treats collecting voice data without consent as a violation. In finalizing the Cox Media Group orders on August 27, 2026, the FTC said that if the "Active Listening" service had worked as advertised, "this collection and use of consumers' voice data without adequate consent would itself violate the FTC Act" (FTC).

Has the FTC fined OpenAI or any other AI chatbot company?

No, as of November 11, 2026. The FTC's artificial intelligence page lists no complaint or order against OpenAI, Anthropic, or any of the seven companion chatbot companies. Its nearest case is DoNotPay, which agreed to pay $193,000 in Operation AI Comply over its "AI Lawyer" claims (FTC). Regulators outside the FTC have fined chatbot companies over privacy, as our page on AI chatbot privacy fines shows.

How Morse keeps your chats off its servers

When the FTC demands records on how long a company keeps chats, who can read them, and who receives them, the company answers from the chats it stores on its own servers. Morse answers the same questions this way:

• Where chats are stored. Your chat history, characters, and personas are stored in your browser, encrypted, and Morse's servers don't keep messages or log what's in them (privacy policy).
• How long after you delete. Clearing your browser or deleting your account deletes your chats, and we can't recover them, so keep anything you need.
• Who can read them. We hold one of the two keys that unlock your history, but we never receive the data it unlocks. Your account holds your sign-in details, plan, balance, and a usage ledger with no content.
• Who gets the data. Morse doesn't train AI on your content, sell your data, or show ads, and it runs no advertising trackers or third-party analytics. Because we don't store chats, we usually have very little to give authorities.

Each message still goes to a model, and the mode you choose for the chat decides who sees it:

• Private, the default, for chats no model host should keep. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under the zero data retention agreements Morse has with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for chats no company should be able to read. Your browser checks the enclave's hardware proof before anything leaves your device, then encrypts the message for that enclave alone, so Morse's servers relay text they can't read. This rests on the enclave hardware and attestation working as designed.
• Anonymous, to use GPT, Claude, or Gemini without the company knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the text and may keep it for a limited time to check for abuse, under its own policy, so leave out names.

Morse is for adults: every user confirms they're 18 or older. In character chats, if a message reads like suicidal thinking, Morse shows crisis lines, and that check runs on your device.

Send a first message from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.