What does AI training opt-out mean

**It means stopping a provider from using what you send, and what the model sends back, to train its next model.** Two words need separating. **Opt-out** means the default is *we use it* and you have to act to be excluded. **Opt-in** means the default is *we don't* and you have to act to be included. The practical difference is large, because **most people never change a default** — whichever way the provider sets it is, in effect, the answer for the overwhelming majority of users. The scope is also broader than most people assume. It is normally not just your prompts but **the model's completions too**, since a reply carries the shape of the question that produced it. Attached files, pasted source code and uploaded images typically fall inside the same boundary. One frequent confusion: **'not used for training' is a different promise from 'not stored.'** Providers routinely retain data for abuse monitoring or legal obligations even when they do not train on it, and the two commitments appear as separate clauses in most terms of service.

If I opt out, what happens to data I already sent

**Nothing. Opting out is not retroactive.** The reason is technical. Training a model is not filing text in a warehouse; it is a process that nudges **billions of internal numbers, the weights,** a little at a time. Once training finishes, the original sentence does not exist inside the model as a retrievable file — its influence is spread thinly across the whole parameter set. So **'remove just this sentence' has no implementation** short of reverting to an earlier checkpoint or retraining, and neither applies to a model already deployed. Three requests need to be told apart. **Deleting your conversation history** — possible; that is stored on your account. **Excluding future data from training** — possible. **Removing your data from an already-trained model** — effectively impossible. If you have already sent something sensitive, the first move is not a deletion request. It is to ask **where that information is still valid**: if it was a password or an API key, **rotating it is far more reliable than asking for it to be forgotten.**

How do the tiers differ

**There are three, with different defaults, and as of September 2026 a fourth arrangement.** **Consumer chat products, free and personal paid.** Historically these defaulted to training on conversations with an off switch inside settings, and the tendency was strongest on free tiers — when the user is not paying in money, data tends to occupy that slot. **Business and team plans.** Generally default to no training, because enterprise buyers demand the clause during procurement and its cost is already inside the price. **APIs.** Traditionally the strictest, since developers are processing other people's data through them. **The fourth arrangement arrived with Meta's Muse Spark 1.3.** It puts two endpoints on the same model: a standard one that keeps data private at **1.25 dollars per million input tokens and 4.25 output**, and a Contributor one at **0.10 and 0.20** that requires permission to train on prompts and completions. **It is the first time the data-for-discount trade has been published as a list price** rather than negotiated privately. Individual providers change their defaults frequently, so the settings screen and terms of the product you actually use are the only authority.

How does this affect an app I build

**It stops being only your data, and this is the part most often missed.** If a developer selects a training-enabled endpoint, **the sentences typed by that product's end users go into the training set.** For a support tool, that is the support conversations. For a document summariser, the uploaded documents. For a coding assistant, the pasted source. Three obligations then rest with the developer, not the provider. **Disclosure** — were users told? **Consent** — if told, is there a mechanism to agree? **Contract** — if the service processes another company's material, does that agreement permit external training? This is why a 21x discount is **only available where the input holds no secret**: summarising or translating public documents, internal experiments, prototypes, open-source tooling. For anything touching personal data, health, finance, law, or unreleased business information, price is not the deciding variable. **And because none of it can be undone afterwards, the decision has to be made before the first request is sent.**

Tech · 4 min read · Explainer

What AI training opt-out is — the switch that keeps your prompts out of the next model

2026.09.06 06:00 5 sources cross-checked

AI training opt-out means preventing a provider from using the prompts you send and the replies the model generates as material for training its next model. The distinction that matters most is the default. Opt-out means the setting starts on and you must switch it off; opt-in means it starts off and you must switch it on. Because most people never change a default, whichever one the provider picks is effectively the outcome. The scope is also wider than people expect: model outputs are typically included alongside your inputs, as are attachments, pasted code and images. Meta's Muse Spark 1.3, released in early September 2026, put a price on this for the first time, charging 1.25 dollars per million input tokens on an endpoint that keeps data private and 0.10 dollars on one that permits training. Two limits apply: opting out is not retroactive, and if you build a product on a training-enabled endpoint, your users' text goes with it

A single toggle switch on a pale wall beside a sunlit window, a green potted plant on a shelf below

The three lines

Definition — a setting that stops your prompts and the model's replies becoming training material for the next model
Defaults — consumer chat tiers often start on; business plans and APIs generally start off
Limits — it is not retroactive, and it carries your users' text as well as your own

Key questions

What does AI training opt-out mean: **It means stopping a provider from using what you send, and what the model sends back, to train its next model.** Two words need separating. **Opt-out** means the default is *we use it* and you have to act to be excluded. **Opt-in** means the default is *we don't* and you have to act to be included. The practical difference is large, because **most people never change a default** — whichever way the provider sets it is, in effect, the answer for the overwhelming majority of users. The scope is also broader than most people assume. It is normally not just your prompts but **the model's completions too**, since a reply carries the shape of the question that produced it. Attached files, pasted source code and uploaded images typically fall inside the same boundary. One frequent confusion: **'not used for training' is a different promise from 'not stored.'** Providers routinely retain data for abuse monitoring or legal obligations even when they do not train on it, and the two commitments appear as separate clauses in most terms of service.
If I opt out, what happens to data I already sent: **Nothing. Opting out is not retroactive.** The reason is technical. Training a model is not filing text in a warehouse; it is a process that nudges **billions of internal numbers, the weights,** a little at a time. Once training finishes, the original sentence does not exist inside the model as a retrievable file — its influence is spread thinly across the whole parameter set. So **'remove just this sentence' has no implementation** short of reverting to an earlier checkpoint or retraining, and neither applies to a model already deployed. Three requests need to be told apart. **Deleting your conversation history** — possible; that is stored on your account. **Excluding future data from training** — possible. **Removing your data from an already-trained model** — effectively impossible. If you have already sent something sensitive, the first move is not a deletion request. It is to ask **where that information is still valid**: if it was a password or an API key, **rotating it is far more reliable than asking for it to be forgotten.**
How do the tiers differ: **There are three, with different defaults, and as of September 2026 a fourth arrangement.** **Consumer chat products, free and personal paid.** Historically these defaulted to training on conversations with an off switch inside settings, and the tendency was strongest on free tiers — when the user is not paying in money, data tends to occupy that slot. **Business and team plans.** Generally default to no training, because enterprise buyers demand the clause during procurement and its cost is already inside the price. **APIs.** Traditionally the strictest, since developers are processing other people's data through them. **The fourth arrangement arrived with Meta's Muse Spark 1.3.** It puts two endpoints on the same model: a standard one that keeps data private at **1.25 dollars per million input tokens and 4.25 output**, and a Contributor one at **0.10 and 0.20** that requires permission to train on prompts and completions. **It is the first time the data-for-discount trade has been published as a list price** rather than negotiated privately. Individual providers change their defaults frequently, so the settings screen and terms of the product you actually use are the only authority.
How does this affect an app I build: **It stops being only your data, and this is the part most often missed.** If a developer selects a training-enabled endpoint, **the sentences typed by that product's end users go into the training set.** For a support tool, that is the support conversations. For a document summariser, the uploaded documents. For a coding assistant, the pasted source. Three obligations then rest with the developer, not the provider. **Disclosure** — were users told? **Consent** — if told, is there a mechanism to agree? **Contract** — if the service processes another company's material, does that agreement permit external training? This is why a 21x discount is **only available where the input holds no secret**: summarising or translating public documents, internal experiments, prototypes, open-source tooling. For anything touching personal data, health, finance, law, or unreleased business information, price is not the deciding variable. **And because none of it can be undone afterwards, the decision has to be made before the first request is sent.**

When you type something into an AI service, how far that sentence travels is decided by a pricing tier and one setting.

AI training opt-out is the mechanism that stops the provider using your prompts, and the model's replies, as material for training its next model.

1. Opt-out and opt-in — the default is the outcome

Method	Starting state	What you must do	What usually happens
Opt-out	Training is on	Switch it off in settings	Most accounts stay on
Opt-in	Training is off	Grant permission	Most accounts stay off

The difference between the two is not wording. It is that people do not change defaults. Whichever way a provider sets it is, in practice, the answer for the large majority of its users.

The scope is wider than most assume. It is usually not only what you type but what the model replies, because a completion carries the shape of the prompt that produced it. Attachments, pasted code and uploaded images generally fall inside the same line.

One common confusion: "not used for training" and "not stored" are different promises. Providers routinely retain data for abuse monitoring or legal obligations even when they do not train on it. In most terms of service these are separate clauses.

2. The defaults differ by tier

Tier	Typical default	Why
Consumer chat (free, personal paid)	Often trains	When the payment is not money, data tends to fill the slot
Business / team plans	Usually does not train	Enterprise buyers require the clause; it is priced in
API	Strictest	Developers are processing other people's data through it

The free-tier tendency is an old pattern, and the same one that governs advertising: if the user is not paying in cash, something else occupies that position.

Provider defaults change often. This article describes the structure; the settings screen and terms of the specific product you use are the only authority on its current state.

3. In September 2026, it got a price tag

Until recently this trade was mostly invisible. Training on free-tier conversations was routine, and large customers paying extra for a no-training clause happened under NDA.

Meta moved it onto the rate card.

Endpoint	Input / 1M tokens	Output / 1M tokens	Data condition
Standard	$1.25	$4.25	Kept private
Contributor	$0.10	$0.20	Prompts and completions used for training
Multiple	12.5x	21.25x	—

Same model, same capability, different contract. It is the first time the price of your data has been posted publicly rather than negotiated.

There is a second thing that number reveals: 21x is Meta's own public estimate of what real developer usage data is worth to it.

4. Two hard limits

It is not retroactive

Training is not filing text away. It is a process that nudges billions of internal weights slightly. Once it finishes, the original sentence is not stored as a retrievable object — its influence is spread thinly across the entire parameter set.

Request	Possible?
Delete conversation history from my account	Yes
Exclude my future data from training	Yes
Remove my data from an already-trained model	Effectively no

If something sensitive has already gone in, the first move is not a deletion request. Ask where that information is still valid. For a password or an API key, rotating it is far more reliable than asking for it to be forgotten.

It is not only your data

Build on a training-enabled endpoint and your users' text goes with it.

Support tool → the support conversations
Document summariser → the uploaded documents
Coding assistant → the pasted source

Three obligations then sit with the developer: disclosure (were users told), consent (is there a mechanism), and contract (if you process another company's material, does that agreement permit external training).

5. So how do you choose

Not on price. On what is actually in the input.

Training-enabled is fine for — summarising or translating public documents, internal experiments, prototypes, open-source tooling.

It is not an option for — anything carrying personal data, health, finance or legal work, and internal use where roadmaps, source code or unreleased results appear in the prompt.

Decide before the first request, because nothing can be undone afterwards.

6. What is still open

Tier defaults are a tendency, not a rule. This describes a repeatedly observed structure; individual providers' current settings were not verified. Only Meta's Muse Spark 1.3 prices and conditions were checked in detail.
Machine unlearning research exists. Removing specific data from a trained model is an active field, but no commercial deployment was verified. Planning on the assumption that it is impossible remains the safer position.
The regulatory position is unsettled. How Korea's Personal Information Protection Act and the EU GDPR apply to training data is outside this article's scope. On the copyright side, litigation and government filings are already in progress.
Whether this pricing model spreads is unknown. If other providers adopt it, "training consent" becomes a standard line item on every AI rate card.