---
title: "Assess exposure of client information in a consumer AI tool"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-on-client-data-exposure-from-consumer-ai-tools/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B6-3-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "red"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Assess exposure of client information in a consumer AI tool

> List what the lawyer has already recorded about the tool: what was pasted, what the tool's terms say about retention and training, and who can see the output. Write no advice to the client.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-on-client-data-exposure-from-consumer-ai-tools/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Red: Lawyer writes; AI may check, clarify or collect data |
| How AI is used | List what the lawyer has already recorded about the tool: what was pasted, what the tool's terms say about retention and training, and who can see the output. Write no advice to the client. |
| What the lawyer must review | Model Rule 1.6(a) says a lawyer shall not reveal information relating to the representation unless the client gives informed consent, the disclosure is impliedly authorised, or paragraph (b) permits it. Opinion 512 says the lawyer must understand the tool and must not input that information into a tool that discloses it to the vendor or the public without informed consent or an exception. You write any advice to the client and any notice that a disclosure has to be made. The tool does not. |
| Written for | United States |
| Applies to | [Advise on client-data exposure from consumer AI tools](https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-on-client-data-exposure-from-consumer-ai-tools.md) |

## Checking plan

- What the AI does: List what the lawyer has already recorded about the tool: what was pasted, what the tool's terms say about retention and training, and who can see the output. Write no advice to the client.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A consumer tool's privacy policy is not a client consent. Read the terms before you describe what the vendor does with the text.
- If the text is a California resident's personal information, the CCPA duties are a separate question.

## Sources

- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*