Can recruiters use ChatGPT? What candidate data law allows in an AI chat

The Morse teamPublished November 10, 202611 min read

Recruiters can use ChatGPT for job ads, outreach templates, and interview question banks, but as of November 2026 a candidate's resume, interview notes, or video brings its own rules into the chat. In the EU and UK the candidate is a data subject with a right to know who holds their data. In New York City, Illinois, and, from January 1, 2027, California and Colorado, using AI to score or rank applicants triggers audits, notices, or review rights. OpenAI's and Anthropic's own usage policies, in versions taking effect this month, list hiring as an area where a person must review what the model decides.

This isn't legal advice, and it won't tell you how to hire. It's about where a candidate's data goes once you paste it. On November 10, 2026, we read the GDPR and the EU AI Act on EUR-Lex, the Digital Omnibus regulation that moved the AI Act's hiring deadline, New York City's Local Law 144 pages, Illinois's video interview law and Public Act 103-0804, Colorado's SB 26-189, California's ADMT regulations, the EEOC's recordkeeping and selection rules in the eCFR, the FCRA, OpenAI's and Anthropic's usage policies, LinkedIn's User Agreement and its Hiring Assistant white paper, and the UK Information Commissioner's 2024 audit of AI recruiting tools. The ICO's site blocked us, so we read its news release in an Internet Archive copy from October 21, 2026. LinkedIn earns credit for its own recruiting AI. Its white paper says recruiters' Hiring Assistant inputs fall under a data processing agreement and "will not be used to train third party AI models."

Can you put a candidate's resume into ChatGPT?

Not into a personal account, if the candidate is in the EU or UK. The GDPR makes your company the controller of every CV it receives, and Article 14 says that when you get personal data from somewhere other than the person, such as a LinkedIn search or a referral, you must tell them the purposes, "the recipients or categories of recipients," and "from which source the personal data originate," at the latest "within one month" (GDPR). A chatbot your company never contracted with is unlikely to be a recipient your privacy notice names. The processor contract rules are the same ones HR faces, which we cover in can HR use ChatGPT.

The UK Information Commissioner audited AI recruiting tools and, on November 6, 2024, reported tools "inferring characteristics, including gender and ethnicity, from a candidate's name," and others that "collected far more personal information than necessary and retained it indefinitely to build large databases of potential candidates without their knowledge." It made almost 300 recommendations, and the companies accepted all of them, at least in part (ICO, archive copy). A personal chat history full of pasted CVs is a small version of that database, kept on the AI company's schedule instead of yours.

In the US, federal recordkeeping rules reach the same chat. EEOC rules say "application forms submitted by applicants and other records having to do with hiring" must be kept "for a period of one year," and longer once a charge is filed (29 CFR 1602.14). If a chatbot ranked your shortlist, that ranking may be one of those records, sitting in an account your employer can't search or hold.

Is it legal to use ChatGPT to screen resumes?

It depends on where the job is and how much weight the output carries. Tidying your own notes rarely triggers anything, while a ranked list of 40 applicants can.

• New York City: Local Law 144 bars an automated employment decision tool "unless the tool has been subject to a bias audit within one year of the use," with notice to candidates 10 business days before use, enforced since July 5, 2023 (NYC DCWP). The city's FAQ says it covers tools used "to assess candidates for hiring or promotion," for jobs tied to a New York City office, and not resume bank searches or outreach (NYC DCWP FAQ). A prompt that returns a fit score for each applicant looks a lot like the tool the law describes.
• California: the CPPA's rules define automated decisionmaking technology as technology that replaces or "substantially replace[s] human decisionmaking," and count a decision as made "without human involvement" unless the reviewer can interpret the output, reviews "any other information that is relevant," and has the authority to change the result. Hiring is a "significant decision," and a business already using such a tool must comply "no later than January 1, 2027," starting with a pre-use notice (CPPA). Copying a chatbot's shortlist into your ATS without reading the resumes is the pattern that definition catches.
• Colorado: SB 26-189, signed May 14, 2026, repealed the 2024 AI Act before it took effect. From January 1, 2027, it covers technology whose output is "used to make, guide, or assist" a decision about employment, requires notice "at the point of interaction," a plain-language explanation within 30 days of an adverse outcome, and a right to "meaningful human review" (Colorado General Assembly).
• Federally: the EEOC's AI page at eeoc.gov/ai returned "The requested page could not be found" on November 10, 2026, but the Uniform Guidelines on Employee Selection Procedures are still in the eCFR and apply to "tests and other selection procedures," including the rule that a selection rate below "four-fifths" of the highest group's is "generally" evidence of adverse impact (29 CFR 1607). A chatbot's ranking is a selection procedure if you act on it.

What do OpenAI and Anthropic say about using their AI for hiring?

Both now name hiring in their own rules. Anthropic's Usage Policy, effective November 12, 2026, lists "screening, ranking, advancing, or rejecting candidates" as a high-risk use. A user doing it must have "a qualified person" review the output "with the authority to change or modify it," and the candidate "must be clearly told that AI was used to produce it." The policy applies to "individuals using our apps (such as Claude.ai and Claude Code)," not only to companies on the API (Anthropic).

OpenAI's usage policies, in a version published October 21, 2026 and effective November 20, 2026, bar "automation of high-stakes actions in sensitive areas without human review" and list employment among those areas. They also prohibit "inference regarding an individual's emotions in the workplace and educational settings" and "evaluation or classification of individuals based on their social behavior, personal traits, or biometric data" (OpenAI). Uploading a one-way interview video and asking the model whether the candidate seemed nervous runs into both.

Can you upload a video interview to AI?

In Illinois, only after the candidate has been told and has agreed. Illinois's AI Video Interview Act requires notice, an explanation, and consent before AI analyzes a recorded interview, limits who may receive the video, and gives the applicant a 30-day deletion right, as our guide to private AI for job seekers covers from the candidate's side. A recording pasted into a chatbot for a summary can count as AI analysis of that video, and the chatbot's copy is one more you'd have to reach when a deletion request arrives. Maryland bars an employer from using facial recognition to create a "facial template" during an applicant's interview unless the applicant signs a consent waiver (Md. Code, Lab. & Empl. 3-717).

The Act also has a duty aimed at the employer alone. An employer that "relies solely upon an artificial intelligence analysis of a video interview" to decide who gets an in-person interview must report the race and ethnicity of applicants who did and didn't advance, and of those hired, to the state by December 31 each year (820 ILCS 42). Since January 1, 2026, Illinois has also required notice whenever an employer uses AI in recruitment or hiring, and its definition of AI "includes generative artificial intelligence" (Public Act 103-0804). The Illinois Department of Human Rights proposed rules for that notice, including keeping records of AI use, in the Illinois Register on May 15, 2026 (JCAR). We couldn't confirm from the state's own pages whether final rules have been adopted.

Does the EU AI Act apply to recruiters using ChatGPT?

It can, and the deadline moved. The AI Act lists as high-risk any AI "intended to be used for the recruitment or selection of natural persons," including to "analyse and filter job applications, and to evaluate candidates," and an Annex III system "shall always be considered to be high-risk" where it profiles people. Article 25 adds that anyone who modifies "the intended purpose of an AI system, including a general-purpose AI system," so that it becomes high-risk is treated as its provider, with a provider's obligations (AI Act). A chatbot set up as your team's CV filter is the case that sentence describes.

The obligations for Annex III systems were due August 2, 2026. The Digital Omnibus, Regulation (EU) 2026/1744, published July 24, 2026, moved them to December 2, 2027 (EUR-Lex). The GDPR rules above apply now.

Can you paste a LinkedIn profile into ChatGPT?

LinkedIn's User Agreement, effective November 3, 2025, lists among its don'ts: "Copy, use, display or distribute any information (including content) obtained from the Services" without "the consent of the content owner," and using "browser plugins and add-ons" to "scrape or copy the Services, including profiles" (LinkedIn). An AI extension that reads every profile you open fits that description.

LinkedIn's Hiring Assistant white paper, dated March 2026, says recruiter inputs and outputs are "Customer Personal Data" under its data processing agreement, that customer data "will not be used to train third party AI models, including those developed by OpenAI," and that the assistant "will not screen out applicants or make hiring decisions." It also says LinkedIn "will retain this information beyond the session," and deletion requests go through the customer's admin (LinkedIn).

Which rule follows each recruiting task?

We matched each rule we read on November 10, 2026 to the recruiting tasks people most often hand a chatbot, and to who carries the duty. When an agency places candidates with a client, the duty can sit with the agency: Local Law 144, for one, covers employment agencies as well as employers.

Dates coming up in the next 13 months, from the same sources:

How Morse keeps your recruiting drafts off a chatbot's servers

A recruiter's chat history grows into a second candidate pipeline, one the ATS doesn't track, the client never sees, and a deletion request has to chase down. Morse is built so that pile never forms on our side. Morse keeps your chats in your own browser, encrypted, and doesn't keep messages or log their content on its servers. It doesn't train AI on what you write, sell data, or run ads.

None of that settles who may process a candidate's CV. An agency answers to its client contracts and its candidates, and an in-house team answers to its employer's approved tools, so real names, notes, and recordings stay in the ATS. Use Morse for the work that comes before a candidate exists: the job ad, the outreach sequence, the scoring rubric, the interview kit, and the client brief.

• Private, for job ads, outreach, and interview kits. It's the mode a new chat opens in, running open-weight models such as GLM, DeepSeek, and Kimi, as well as xAI's Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. When a provider confirms zero retention on each reply, Morse checks for that confirmation and refuses any reply without it (zero data retention, explained).
• E2EE, for a client brief, a comp band, or a req that isn't public yet. Before the message leaves, your browser verifies the enclave's hardware attestation and seals the text so only that enclave can open it; Morse's servers pass along ciphertext they can't read, and the reply is decrypted only in your browser. Third-party providers, not Morse, run the enclaves, and the protection depends on the enclave hardware and attestation working as designed. E2EE runs open-weight models only and can't search the web or make images.
• Anonymous, to ask GPT, Claude, or Gemini how Local Law 144 or Article 14 works without the provider knowing it's you. Morse's proxy removes your account, email, and IP address and forwards the question under Morse's own account. The provider sees the question itself and may keep it for a limited time to check for abuse, under its own policy, which is one more reason candidates stay out of the prompt.

Attachments travel with the message and Morse never stores them. Because we don't store chats, we usually have very little to give authorities (privacy policy). Morse can't restore chats lost to a cleared browser or a lost device, so file the finished rubric with your team's documents. If you recruit from a company laptop, our guide to what your employer can see on a work laptop covers the monitoring.

Write your next outreach sequence from the Morse home page with no account, or sign up free without a card; E2EE chats are part of Pro, $19 a month.