Which personal data does OpenAI retain after deletion requests and how can I verify removal?

1. What categories of personal data OpenAI may retain — product-by-product snapshot

OpenAI’s privacy and product pages treat different services differently: consumer ChatGPT historically retains conversation history by default (with options like disabling history or deleting conversations), while enterprise offerings advertise configurable retention, business controls, and the option for “zero data retention” for qualifying organizations and API customers ^{[2] [1] [6]}. The privacy policy describes categories of Personal Data collected and points readers to a “Security and Retention” section for details but does not in the search results list every specific artifact retained ^[7]. Available sources do not mention a single unified list of every metadata artifact (e.g., logs, backups, derived telemetry) that might persist after deletion for each product.

2. Deletion timing and legal exceptions — what OpenAI says

For enterprise customers, OpenAI states deleted conversations are removed from its systems within 30 days unless legally required to keep them, and workspace admins can set retention windows ^{[3] [1]}. For other accounts, reporting in 2025 described different defaults (retained by default until deletion) and temporary court-mandated preservation that extended retention for certain consumer and API interactions; OpenAI later said that court-ordered obligations ended on September 26, 2025 and it returned to standard retention practices, while still holding limited historical April–September 2025 data ^{[4] [5]}.

3. Zero Data Retention (ZDR) and enterprise controls — practical alternatives

Multiple sources indicate OpenAI offers a Zero Data Retention or ZDR configuration for qualifying organizations and approved API use cases, where provider-side retention of inputs/outputs is removed and provider training-use is not applied ^{[8] [6] [9]}. Independent reporting and vendor posts emphasize that ZDR is not the default for consumer services and is typically contractual or available after an approval review ^{[9] [8]}. Expert pieces note that enterprise agreements guarantee data isolation and non‑use for training by default ^[2].

4. How to request deletion and verify it in practice

OpenAI’s user guidance points users to a Privacy Portal / “Make a Privacy Request” flow and Help Center instructions for deleting accounts or making personal data removal requests; verification steps (email or phone) are required to process account deletions ^{[10] [11]}. Tech coverage of OpenAI’s “Personal Data Removal Request” form and DSAR contact (dsar@openai.com) documents the route for people seeking deletion or exercising rights in certain jurisdictions, though outlets warned companies may not honor every request if constrained by law or other limits ^{[12] [13]}.

5. Limits, forensic artifacts, and contested claims

Reporting by industry commentators and security vendors raised concerns that platform layers, logs, backups, or court orders can produce “persistent retention beyond the organization’s control,” and that deleted items could be preserved under legal process — a major reason why the May–September 2025 preservation order mattered ^{[14] [5]}. Community posts and developer feedback also raise questions about deletion of specific generated artifacts (chat completions, billing records) and whether platform dashboards allow granular deletion ^[15]. Where sources disagree: OpenAI’s enterprise pages promise 30‑day removal for deleted conversations ^[3], while some independent posts and vendor analyses warned sensitive API data could be stored indefinitely absent ZDR or contract protections ^{[14] [2]}. Both positions appear in the record.

6. How you can verify removal — pragmatic checklist

• Use OpenAI’s Privacy Portal / account deletion flow and retain confirmation emails as proof ^{[10] [11]}.
• For business/API use, negotiate explicit contractual retention and ZDR terms and request written confirmation that provider-side logs and training use are disabled ^{[6] [8]}.
• Ask for a retention/ deletion timeline in writing (enterprise docs reference 30 days for deletions) and request a written statement on legal‑hold exceptions ^{[3] [4]}.
• If you need extra assurance, request technical attestations or audits from OpenAI under your contract (available-source guidance for enterprises suggests governance controls and policies; p1_s9). Available sources do not mention a self-service tool that proves every backend artifact was purged for consumer accounts.

7. Bottom line and what to watch next

OpenAI’s public materials show product-differentiated retention: consumer chat history is saved by default but deletable; enterprise and qualifying API customers can get stronger guarantees including ZDR and shorter removal windows ^{[2] [6] [8]}. However, legal orders, logs, and platform artifacts have complicated claims about “complete” deletion in 2025; OpenAI acknowledged a preservation period in 2025 and said obligations tied to that order ended on September 26, 2025 ^{[4] [5]}. If you need strict non‑retention, the evidence in current reporting points to contracting for ZDR or enterprise terms and keeping written confirmations rather than relying on default consumer settings ^{[8] [6]}.