Data, Protections, and Guardrails
On this page
What You Need to Tell Families
When minors are involved, three questions always come up from parents, school leadership, and the data protection officer (DPO): What happens to the data? What protects students from inappropriate content? And how do we prevent the tool from doing the work for them? This lesson provides exact answers without promising more than the tool actually guarantees.
Where the Data Goes
The answer depends on the access method you chose in the previous lesson.
On a personal Free, Plus, or Pro account, conversations may be used to improve OpenAI’s models unless the user has disabled this setting. They remain in the history until deleted; once deleted, a conversation disappears immediately from the account, and OpenAI schedules its permanent erasure within 30 days, unless security or legal obligations require retaining it longer.
Without an account, the same setting is disabled in the browser, and the conversation is not saved beyond the session.
In a Business, Enterprise, or Edu workspace, OpenAI does not train its models on workspace data, and retention follows the workspace rules: on Enterprise and Edu, the organization can set a retention period.
Be wary, however, of tables that list a tool as “GDPR compliant.” Compliance is not a property of the software; it is an obligation of the entity using it. What the school verifies is the contract and its data processing addendum, the storage location, the legal basis for processing, family notification, and, where required, a data protection impact assessment. This work falls to the school principal working with the DPO; a teacher should not have to carry this burden alone.
Built-in Protections and Their Limits
OpenAI’s usage policies apply to all accounts, and protecting minors is a priority; no school setting can override them. For accounts where the declared, verified, or estimated age is under 18, ChatGPT activates additional protections specific to teens: content safeguards, break reminders, alerts before certain image uploads, and study tools. Parents can add parental controls, including quiet hours; they cannot read the conversations.
None of these mechanisms, however, act as filters that a school can configure class by class. The administrative settings documented by OpenAI cover functions—models, memory, link sharing, projects, apps—not content filtering by age. Teacher supervision remains the primary protection, and it cannot be delegated.
Protecting the Learning Itself
The real pedagogical risk isn’t shocking content; it’s the student letting the tool do the work. Study Mode addresses this: instead of handing over the answer, ChatGPT asks questions, explains step-by-step, checks for understanding, and offers quizzes, one question at a time. You activate it by typing @study, using the + menu, or going to chatgpt.com/studymode; it is not available in temporary chats, GPTs, or projects. Demonstrate it in class from your account: a student who sees the difference between “give me the answer” and “help me understand” knows what is expected of them.
Web search provides another guardrail, provided you use it. When ChatGPT searches the web, its responses include clickable citations and a Sources button. OpenAI warns that results and citations can be incomplete, outdated, or false: having students open the source and verify its date builds a lasting habit, even when dealing with a machine.
Finally, remember the Ministry of Education rule: using AI for an assignment without explicit authorization and without personal effort to master the material constitutes cheating. Tell students clearly, for every assignment, what is allowed. And do not buy peace of mind with a detector: OpenAI considers these tools unreliable, ChatGPT itself answers randomly when asked if it wrote a text, and the Ministry, cited by the CNIL (France’s data protection authority), advises against using them to identify AI-written copies. Sharing the conversation, showing the steps, and assessing orally offer better protection.
Supervising Without Spying
In the classroom, supervision is simple: the teacher sees the screens, circulates, and asks students to verbalize their thinking. In a school workspace, the admin console displays usage statistics—active users, messages, projects—broken down by group; it does not show conversation content. However, on Enterprise and Edu, the organization can access this content for compliance purposes via a dedicated platform. Tell users this rather than hiding it: a stated rule protects better than assumed surveillance.
Your Turn
Prepare your response to families.
- Note the access method you use and what it implies for data.
- Check the model training setting on your account.
- Test Study Mode on an exercise in your subject, then try the same request without it.
- Write ten lines for families covering data, protections, and work rules.
- Have leadership and the data protection officer review them.
Official sources: Data controls in ChatGPT · Chat and file retention in ChatGPT · ChatGPT for Teens · Using study mode in ChatGPT · Searching the web with ChatGPT · [How can educators respond to students presenting AI-generated content as their own?](https://help.openai.com/en/articles/8313351-how-can-educators-respond-to-students-presenting-ai-generated-content-as-their own) · Managing workspace settings in ChatGPT Enterprise · Workspace analytics for ChatGPT Enterprise and Edu · OpenAI Compliance Platform for Enterprise and Edu customers (OpenAI Help Center) · Usage policies · Enterprise privacy (OpenAI) · Teacher: How to use an AI system in the course of your duties? (CNIL)
Key Takeaways
- Data handling depends on the access method: training settings on a personal account, contract terms for a school workspace.
- Compliance is not a software label: it is the work of the principal, with the data protection officer.
- Teen protections apply to accounts under 18 but do not replace supervision.
- Study Mode guides the student instead of answering for them.
- AI detectors are unreliable: evaluate the process.