Who owns data shared with AI?

So, who owns the data and content—whether images, text, or videos—that you share with AI tools like ChatGPT, Gemini, or Copilot? That is what I aim to help shed light on in my article this week.
A university student uploads an assignment to ChatGPT and asks it to rewrite it professionally. A school teacher uses AI to prepare lesson plans and examination questions. A corporate employee uploads a business proposal to generate a presentation. A government worker uses an AI application to analyse a report containing confidential information. A business owner inputs financial figures to get advice on improving profitability. These are typical activities undertaken every day by students and professionals alike, across corporate and government sectors. These are no longer unusual activities. Almost everyone is increasingly using AI to create, analyse, summarise, and improve almost everything they do, both personally and professionally.
But have we ever stopped to ask ourselves one important question: when we share information with AI, who actually owns our data, where does it go, and who can see it? To understand this, we first need to understand what makes AI work. AI is not simply an application sitting on your mobile phone or computer. Behind every AI application is an entire technology ecosystem made up of several components, often owned and operated by different companies. Let's take ChatGPT as an example. When you type a question, your information travels through several stages.
First, there is the application, which is the interface you use to communicate with AI. This application is owned and managed by the AI provider, such as OpenAI for ChatGPT. Then comes the network, which transports your information from your device to the company's systems. This may involve your internet provider, telecom operator, and various network service providers like Omantel, Ooredoo, or Vodafone.
Your information then reaches powerful computers called servers, hosted in data centres. These servers provide the computing power needed to process your request. The information may also be stored in databases or cloud storage systems, which can be operated by the AI company or third-party technology providers. Next comes the AI model itself. This is where algorithms and mathematical processes analyse your request, identify patterns, and generate a response. Finally, the generated content travels back through the network to your device.
In simple terms, your information passes through an ecosystem involving applications, networks, servers, storage facilities, cloud providers, and AI models. Not all these components belong to the same company. So, who owns what? The AI company may own the application and the AI model. A cloud provider may own the infrastructure and data centeres. Telecom companies provide connectivity. Ownership of your content is different from ownership of the technology used to process it. Most importantly, having ownership of your data does not necessarily mean you have complete control over it.
What happens when you delete the content you shared with AI? Is your data really gone? AI providers have different retention policies. For example, OpenAI states that deleted ChatGPT conversations are generally removed from its systems within 30 days, subject to legal, security, and other exceptions. Therefore, your data is not literally deleted and may remain available for exceptional cases. The risks are therefore significant. An employee could unknowingly expose confidential company information, customer records, financial statements, or government documents. A student could upload personal information belonging to classmates. A professional could share an unpublished business strategy without understanding where that information might be processed or retained.
In my opinion, the biggest AI risk today is not necessarily what AI can create, but what we unknowingly give it. My advice is simple. Before uploading anything, ask yourself three questions: would I be comfortable if this information became accessible to someone else, does my organisation permit me to share it, and do I understand the AI application's data retention and privacy policies?
AI is an incredible tool, and we should embrace it. However, convenience should never come at the expense of privacy, confidentiality, and trust. Remember, you may own the information, but you do not necessarily own the infrastructure, control every stage of its journey, or decide who can legally access it. Until we catch up again next week, think before you engage with AI.