Mental Models for the AI EconomyPrivacy & Trust
Can You Train AI on Your Customers’ Data? Ask Them First
The FTC's warning, Meta's EU opt-out and Anthropic's five-year choice set the reference points. The four variables that decide whether a training-data change keeps trust.
Every company with user data is now asking the same question: can we use it to train or improve an AI model? The legal answer depends on where you operate. The trust answer is the same everywhere, and it is the one that decides whether customers stay.
Three events set the reference points. In February 2024 the US Federal Trade Commission warned that a company quietly or retroactively changing its terms to use people's data for AI training could be acting unfairly or deceptively. In 2025 Meta began training on adults' public posts in the EU with an objection form, and privacy groups argued that an opt-out was not enough under GDPR. And in the same year Anthropic asked every consumer user of Claude to choose: allow training, and chats are kept for five years; decline, and the existing 30-day retention stays. Existing users had until October 8, 2025 to decide.
The four variables that decide the reaction
Is there a choice? Training with no choice at all is the case regulators have named. Which way does the default point? Opt-in is slower and cleaner; opt-out is common and contested. Where does the notice live? A change only in the privacy policy is a change nobody saw. Does it reach back? Data given under one promise and used under another is the change people feel as a betrayal, and it is the one the FTC called out.
How risky is your training-data update?
Under GDPR, using personal data to train a model usually relies on consent or legitimate interest. If you use legitimate interest, people have a right to object (Article 21), and the objection has to be easy to use. In the US, the state laws that honour Global Privacy Control point the same way: a person's stated preference should travel with them.
Three reference points
A design that holds up
- Ask inside the product, at a natural moment, with one sentence on what you will use and why.
- Make it forward-only. Data from before the change stays under the old rules unless people choose otherwise.
- Separate private from public. Messages, files and support transcripts deserve a stricter default than public reviews.
- Make the setting reversible, and say what reversal does to data already used.
- Collect less. The argument from The Data You Never Collect Cannot Leak applies twice here: data you never stored cannot be trained on by mistake.
The business case is plain. A training set gathered by surprise is a liability you carry forever. One gathered by asking is smaller, but every row in it is yours to keep.
Sources
- FTC: AI (and other) companies — quietly changing your terms of service could be unfair or deceptive (Feb 2024)
- Anthropic: Updates to Consumer Terms and Privacy Policy
- GDPR Article 21: Right to object
Across the series
- The European Accessibility Act Is Live. Here’s What It Asks of Your Product.
- Your Visitors Already Said No. Is Your Site Listening?
- Seats, Usage or Outcomes: Pricing an AI Product Without Losing Your Margin
- Your AI Chat Box Is Probably Unusable With a Screen Reader
- Roadmapping When the Model Gets Better Every Seven Months
- Accessibility Testing: A Green Scan Is Not a Finished Journey
- AI Data Retention: ‘Not Used for Training’ Does Not Mean Deleted
- Agent Evaluation: The Demo Worked. Can You Ship It?
Get the next essay the day it publishes.
A few a month, written from real builds. Unsubscribe in one click.
Performance marketing and search leader who builds — 15+ years in digital growth and product (AT&T/DirecTV, Microsoft, Employbridge, Site Impact), now running his own properties with AI. These essays are field notes from that loop: what AI actually changes about work, product, and the economics underneath. Based in South Florida.
- Privacy & TrustThe Data You Never Collect Cannot Leak
AI workflows make copying easy and ownership harder. A practical guide to purpose, minimization, retention, and permissions before customer data enters an agent’s context.
8 min read · interactive - Privacy & TrustYour Visitors Already Said No. Is Your Site Listening?
About a dozen US states treat Global Privacy Control as a legal opt-out, and California browsers must send one from 2027. How the signal works, what it should switch off, and a live check of your own browser.
9 min read · interactive - Privacy & TrustAI Data Retention: ‘Not Used for Training’ Does Not Mean Deleted
Training, retention, access and deletion are four different promises. Map your application, logs and provider copies, understand zero data retention, and rehearse what a deletion request actually does.
9 min read · interactive - Web & AI SearchYour Website Is Not a Stack of Pages. It Is a Knowledge Base.
Entities, relationships, schema, internal links, and answer-ready evidence: the architecture machines need when pages alone are no longer enough.
7 min read · interactive - Product StrategyThe Best Product Decision Might Be a Smaller Bet
When the evidence is thin, conviction is not a substitute for a learning plan. A practical framework for reversible decisions, meaningful experiments, and stopping rules.
8 min read · interactive - Web & AI SearchHow to Write a Service Page That Ranks and Gets Cited by AI
One service per page, the service and city in the heading, the answer first, buyer questions as headings, proof, one next step and schema behind it. Seven rules and a quick test.
4 min read - Web & AI SearchNew Website Launch Week: The Checklist That Protects Your Rankings
Get found, lose nothing, test every form and phone link, confirm analytics, then tell Google and every directory. A day-by-day checklist for the week a new site goes live.
4 min read - Web & AI SearchHow HVAC Companies Get More Service Calls from Google and AI
In South Florida every AC call is urgent. Be the obvious answer when it fails: the pages that bring in calls, effortless calling, honest answers and a profile that stays current.
4 min read - Web & AI SearchHow Dental Practices Get More New Patients from Google and AI
Insurance, cost and availability are the three questions every new patient asks first. The pages that answer them, how to handle cost honestly, and the local signals AI assistants read.
4 min read