A lawyer finishes a session that went well. The model untangled a messy fact pattern, the analysis held up, and somewhere between habit and courtesy the lawyer clicks thumbs-up. The understanding behind that click is that it tells the tool what worked, so the tool gets better.
On Claude's commercial products, the click does not stay with the answer. It takes the entire related conversation with it - not just the message you rated. Anthropic stores that feedback copy in a secured backend for up to five years and treats the click as permission to use the conversation for model training. Unless an Owner has switched the feature off for the organization, any member can hand a conversation over this way.
That handover is what makes the commercial default matter. Anthropic does not use these conversations for model training by default. The feedback click creates the exception - the lawyer clicks on purpose, without necessarily knowing what the click authorizes. It leaves the visible conversation on the ordinary retention track your own deletion reaches, and creates a separate feedback copy on a track of its own.
The click changes the data path.
Anthropic de-links that feedback from your account before using it, and does not combine it with your other conversations. That is real protection against one exposure - attribution. It is no protection against the substance of the conversation or the duration of the copy. De-linking strips the identifier, not the content: a transcript with the client's name removed still holds the pricing model, the unfiled claim, the litigation theory. Identifiability is the vendor's exposure; content is your duty. The feedback copy then sits on its own five-year track, and Anthropic's published controls do not say that deleting the visible conversation deletes that record. Deletion, once again, is not deletion. De-linking addresses attribution. It does not answer retention.
OpenAI works differently, and the contrast is the lesson. On its business products - ChatGPT Business, Enterprise, the API - nothing you put in is trained on by default, and OpenAI documents no feedback exception inside the business chat products; the rating control that opens Anthropic's five-year path has no documented equivalent there. The one documented opt-in sits on the developer platform, off for every organization until an owner enables it - and even then the control is a thumbs-down in the API Playground, which shares the conversation up to that point, uploaded files included. Zero-retention accounts cannot opt in at all. Consumer ChatGPT is different again: there, a thumbs-up means the entire conversation may be used to train, even if you have opted out of training generally - one more reason client work does not belong in a consumer account. The point is not that one vendor is safe and the other is not. It is that the same-looking control can do different legal work depending on the product, the account type, and an administrator setting - and most lawyers cannot tell you which case they are in.
Every one of those paths leads to the same legal question: what new use of the client's information did the lawyer just authorize? Which is why a thumbs-up is not a user-experience gesture. It is a fresh disclosure-and-use decision. The vendor already held the conversation under the ordinary service terms. On Claude commercial, the click authorizes something additional: a separate copy, a longer retention path, use for the vendor's own model improvement. Nor is the click impliedly authorized by the engagement - sending the prompt for analysis may be part of carrying out the representation; sending the conversation afterward to improve the vendor's model is not. A lawyer may not reveal information relating to the representation without the client's informed consent or other authorization (Model Rule 1.6(a)), and must make reasonable efforts to prevent its unauthorized disclosure (Model Rule 1.6(c); 37 C.F.R. § 11.106(d) before the USPTO). ABA Formal Opinion 512 never mentions a feedback button, but its reasoning lands on the click: informed consent must come before information relating to the representation goes into a tool that will learn from it, and boilerplate in an engagement letter does not count. (ABA Formal Op. 512, at 7 (2024).) On a business tier that does not train by default, the click is the moment the tool starts learning. "The answer was good, so I rated it" is not informed consent.
What to do is narrow and concrete, and it starts above the individual lawyer, because reflexes do not read memos. On Claude Team or Enterprise, an Owner or Primary Owner can turn feedback off for the whole organization - the Rate chats setting, under Organization settings, Data and Privacy - and unless the firm has a deliberate, client-safe feedback process, off is the right setting. On OpenAI's developer platform, confirm feedback and data-sharing stay off except where the organization has deliberately approved them. Where the button still exists, treat it as a disclosure decision, not a reflex: do not submit feedback on any conversation carrying information relating to a representation - privileged, work-product, and trade-secret material above all.
Claude adds one operational wrinkle worth knowing before you pick your workflow. Raw content that arrives through a connector - a document pulled from Google Drive, a file reached through a connected tool - is excluded from the five-year feedback store unless it is copied into the conversation. Pasted content has no such exclusion, and neither does an uploaded file. The carve-out covers the raw material, not the conversation about it, so an answer that carries the client's substance still lands in the store. The lesson is not that connectors make client work safe. It is narrower: pasting the client's document into the window is the worse default, and the instinct that pasting is simpler and therefore safer is backwards.
One more fact, because it is the reason this piece carries a date: these terms move. OpenAI revised one of the pages cited here while this article was being written. We caught it only by re-reading; nothing on the page says what changed. Whatever you verified last quarter is a memory. Verify the path you are on the day it matters.
The button was presented, implicitly, as a way to make the tool serve you better. On at least one major vendor, it is where you, not the vendor, choose to hand the whole conversation over - for up to five years. The thumbs-up was never about your session. And whether it can reach client work should not come down to a lawyer remembering, in the half-second after a good answer, what an administrator could have switched off before the session began.
Vendor policy language cited here was verified against Anthropic's and OpenAI's published documentation on July 14, 2026; archived copies are on file.
I write more on using AI in legal practice without surrendering judgment, privilege, or the duty of competence, at The Agentic Lawyer. www.theagenticlawyer.com
Educational only, not legal advice, and no attorney-client relationship is created. Views are my own. Attorney advertising in some jurisdictions.