Does sending client data to an LLM waive privilege?
Not automatically. But one tool's terms were enough to lose it in federal court, and that reasoning reaches the software you are building now.
The short answer
5 things that decide this
- 01Privilege is lost by disclosing a communication to a third party, so the question is not whether the data was encrypted. It is who else received it, and under what terms.
- 02In United States v. Heppner (S.D.N.Y., Feb 2026), Judge Jed Rakoff held that a defendant's conversations with a consumer AI tool were neither privileged nor work product. The tool's privacy policy permitted training on inputs, so no reasonable expectation of confidentiality survived.
- 03The terms your software runs under are now evidence. A firm may have to show a court which endpoint saw a matter's data, and what that endpoint was allowed to do with it.
- 04Work product turned on a second question: did counsel direct the work? Heppner ran his own research, so nothing he produced reflected his lawyers' strategy.
- 05Commentators reading the opinion expect enterprise tools that keep inputs confidential to be treated differently. No court has decided that yet.
The privacy policy did the work
Bradley Heppner had a grand jury subpoena and a lawyer. He also had the consumer version of Claude, which he used to research his own case and draft strategy documents. He later shared some of them with counsel. Roughly 31 of those documents came off his devices.
Judge Rakoff ruled from the bench on 10 February 2026 and issued a written opinion on 17 February. Privilege failed for three reasons. The tool is not a lawyer, so no attorney-client relationship could form. The published terms allowed the provider to use prompts for training and to disclose them, so no reasonable expectation of confidentiality survived. And Heppner had not used the tool at his counsel's direction to get legal advice.
Work product failed separately. Grant that the documents were made in anticipation of litigation. They were still not prepared by counsel or at counsel's behest, and they did not reflect counsel's strategy. Forwarding them to a lawyer afterwards did not fix that. You cannot wrap a document in privilege by emailing it to your attorney later.
- PromptMatter text leaves the firm
- GatewayLogging, caching, eval capture
- Model endpointWhich terms apply here?
- RetentionTraining, storage, subpoena reach
- LogProof of the boundary, later
Every hop is a recipient. Transmission is the disclosure event, not storage, so a vendor that says it does not keep your data has answered a different question.
Four questions that decide it for your build
Read the terms before you read the marketing. California's 2026 guidance for lawyers puts it plainly: reasonable efforts require more than reliance on generalized marketing assurances. It also warns that a user may agree to the terms of use and privacy policy simply by using the product. That applies to the person integrating the API too.
- 01Which endpoint receives the text, and do its written terms forbid training on your inputs? A support-page claim is not a term.
- 02Who else is in the path? Observability vendors, prompt caches and eval pipelines are additional recipients, and most privilege analyses forget them.
- 03Can you show, months later, which matter's data went to which endpoint on which date? A privilege log may need that answer.
- 04Does the record show a lawyer directed the work? Heppner lost work product on that point alone, and it is a field in your data model, not a policy.
Related questions
01Is an enterprise AI plan safe from this ruling?
No court has said so yet, but the reasoning points that way. Heppner turned on terms that permitted training and disclosure, and lawyers writing on the case expect tools that keep inputs confidential to be treated differently. Treat that as a strong argument you may have to make, not a settled rule, and keep the written terms where you can retrieve them.
02Does the client have to consent before we use AI on their matter?
ABA Formal Opinion 512 requires informed consent before you put client information into a self-learning tool. A boilerplate clause in an engagement letter does not count. Consent has to be an explanation of the risk. For a product, that means recording what each client was told, and when, rather than one acceptance at signup.
03Can an AI agent send or file anything by itself?
Not in California. The State Bar's 2026 guidance is direct: a lawyer must not deploy an agentic AI system in a manner that permits autonomous external transmission of client information, without appropriate safeguards and human review. That covers automated communications, filings and data transfers. If you build agents for firms, the approval gate is the requirement rather than a feature.
04We deleted the chat history. Is privilege restored?
Deletion does not undo a disclosure. Sending the text to a third party is the event that matters, and the copy on your side was never the thing protecting the communication. This is why encryption-at-rest answers a security question rather than a privilege question.
Read next
- Work product doctrine →Why Heppner failed the second test, and what it asks of your data model.
- Legal software development →What we build for firms and legaltech products, and what we have not.
- Legal AI: build vs buy →Where Harvey and Clio beat a custom build, and the narrow case where they do not.
- Hallucination →Why a fabricated citation is a filing problem, not a quality bug.
