ChatGPT launched in November 2022 and quickly became the most widely used AI tool in the world. It generates text, writes code, creates images, searches the web, and analyzes files you upload. The free tier runs on GPT-5.3 with usage limits. Paid plans raise those limits and add features like voice conversations and advanced reasoning.

On consumer plans (Free, Go, Plus, Pro), your conversations train OpenAI's models by default. There is an opt-out toggle buried in Settings > Data Controls, but most people never find it. Business and Enterprise customers are excluded from training entirely. All consumer data sits on US servers. OpenAI rolled out EU data residency in February 2025 for Enterprise, Education, and API customers only.

Security credentials are solid on paper. OpenAI holds SOC 2 Type 2, ISO 27001, and several related certifications for its business products. Data is encrypted with AES-256 at rest and TLS 1.2+ in transit. But as a US company, OpenAI falls under FISA and the CLOUD Act. That means US authorities can demand access to data without telling the people affected.

Worth knowing

Since February 2026, the Free and Go plans show ads to US users. Italy's data protection authority hit OpenAI with a EUR 15 million fine in 2024 for processing personal data without a proper legal basis and skipping age verification. A Roman court threw out that fine in March 2026, but the Irish DPC still has oversight and investigations remain open in Austria and Poland. If you handle anything sensitive in ChatGPT, go to Data Controls and turn off model training. Then consider whether storing that data on US servers works for your situation.