Someone is paid to read it — the training default follows the account, and redaction is not disclosure

404 Media reported on 14 September 2026 that OpenAI is hiring hundreds of contractors, recruited through Crossing Hurdles and paid by Mercor, to read real ChatGPT prompts and rate four candidate responses under an internal programme called Project Lily; reviewers see whole conversation histories and a memories summary carrying location context, behind a Privacy Filter model that OpenAI itself says can miss uncommon identifiers and over- or under-redact. The obvious reading is that this is a consumer privacy story, and OpenAI's own help page corrects it: content from services for individuals such as ChatGPT and Codex may be used to train, while ChatGPT Business, ChatGPT Enterprise and the API are off by default — so the training default follows the account tier, not the product, and the exposed surface in an engineering org is the personal Plus or Pro subscription open beside the work repository, which carries no Article 28 processor contract. The second correction is that better redaction does not cure it: in EDPS v SRB, C-413/23 P, decided 4 September 2025, the Court of Justice held that the transmitting controller's duty to inform applies before the transfer and that identifiability is assessed from the controller's point of view at the time of collection, not the recipient's — a duty the Garante has already enforced against this company, EUR 15,000,000 on 20 December 2024 plus a six-month information campaign. The practitioner move is an inventory keyed on accounts rather than tools: one line per assistant in the stack with the subscription it signs in under.

Post

Hundreds of contractors are being hired to read real ChatGPT conversations. Your Enterprise agreement does not cover the account your engineer opened at home.

404 Media published the programme on 14 September 2026. It is called Project Lily. Contractors read real user prompts and rate four candidate responses; recruiting runs through a firm called Crossing Hurdles, and Mercor pays. Reviewers see whole conversation histories and a user memories summary that carries location context. Usernames are stripped.

What this changes for anyone shipping an agent stack in the EU:

  1. It is not a consumer story. OpenAI's own help page: "When you use our services for individuals such as ChatGPT and Codex, we may use your content to train our models." And: "By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API." The split is the account, not the product.

  2. So your exposure is the engineer with a personal Pro subscription open beside the work repo. Your Enterprise agreement does not reach that window, and neither does your Article 28 processor contract — a consumer plan does not come with one.

  3. Redaction is not disclosure. OpenAI runs a Privacy Filter model first and concedes it can miss uncommon identifiers and under- or over-redact. Treat that as true. The duty sits upstream of it.

  4. EDPS v SRB, C-413/23 P, decided 4 September 2025: the transmitting controller's duty to inform applies before the transfer, and identifiability is judged from the controller's point of view at collection, not the recipient's. Better redaction improves the reader's position. It does not improve yours.

  5. This exact duty has been enforced against this exact company. The Garante fined OpenAI EUR 15 million on 20 December 2024 and ordered a six-month public information campaign on what user data trains the model.

My Monday: one line per assistant in the stack, with the account it signs in under. An afternoon. It tells you which half of OpenAI's market your code is actually in.

Which seat is your code sitting in?

#DSGVO #AIAct #AgenticAI #EUTech #DevSecOps

First comment

Sources, in the order the argument uses them.

404 Media's investigation, 14 September 2026 — the programme, the recruiting chain, what reviewers see, and OpenAI's own words on the Privacy Filter model: https://www.404media.co/inside-project-lily-the-humans-reading-your-chatgpt-chats/

OpenAI's help page on how your data is used to improve model performance — the two sentences in point 1, and the Codex note: https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance

The Court of Justice press release for C-413/23 P, EDPS v SRB, 4 September 2025 — identifiability from the controller's point of view, and the duty to inform before transfer: https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250107en.pdf

The Garante's decision against OpenAI, 20 December 2024 — EUR 15 million and the six-month information campaign: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432

The Next Web's write-up, 14 September 2026 — independent confirmation, and the per-tier default that point 1 turns on: https://thenextweb.com/news/chatgpt-human-reviewers-gdpr

OpenAI's privacy policy, effective 6 February 2026 — vendors and service providers are disclosed in general terms; human rating of prompts is not: https://openai.com/policies/row-privacy-policy/

Cut for length: Temporary Chat is excluded from training entirely. It is a real per-conversation control, and it also disables memory and history, which is why almost nobody leaves it on.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.