Can My Employer See If I Use ChatGPT? What Each Setup Reveals

Your employer cannot see your ChatGPT conversations by asking OpenAI for them. Your employer can see that you visited chatgpt.com from a company laptop, can block or log what you paste into it if the laptop is enrolled in a data loss prevention tool, and can read every prompt and response if you used a company ChatGPT Enterprise, Microsoft Copilot or Gemini for Workspace account. What is visible depends on three things: whose account, whose device and whose network.

This page works through each combination using the vendors' own administrator documentation, dated, rather than the guesses on the pages that rank for this question. One of those pages says bosses cannot pull up your logs while quoting the OpenAI document that says administrators can. Another says monitoring captures prompts even on a personal account without saying that it requires a managed browser and a specific policy. The answer is neither 'never' nor 'everything'.

The short answer by setup

Company accounts: Enterprise, Copilot, Gemini

If the account belongs to your employer, assume the record does too.

ChatGPT Enterprise and Edu. OpenAI's Compliance API documentation describes a workspace-level system through which an owner creates a scoped administrator key that can retrieve conversation logs, including message content, along with audit and authentication logs. Only owners can grant the broad "conversation messages" permission. OpenAI describes the purpose as litigation, investigations and audits, and an immutable log platform launched March 5, 2026. We could not open OpenAI's pages directly during research and rely on the published article summaries, so treat the feature as confirmed and the detail as subject to OpenAI's current documentation. We found no statement that the Team plan has the same access, so do not assume Team is either covered or exempt.

Microsoft 365 Copilot. Microsoft's documentation states that audit records are generated for every Copilot interaction with the user, the time and the resources accessed, that prompts and responses are stored in a hidden folder in the user's Exchange mailbox, that eDiscovery can search and export them, and that a retention policy, litigation hold or eDiscovery hold keeps them after the user deletes them. Deleting your Copilot history moves the items to a holding location; it does not remove them from the employer's reach. Microsoft's data loss prevention for Copilot can block a prompt containing a sensitive information type before the model sees it, and a separate "AI administrator" role exists that cannot read prompts, which means the roles that can are deliberate grants. Microsoft also states that prompts are not used to train its foundation models. Training and employer visibility are different questions.

Gemini for Google Workspace. Google's Vault documentation, updated October 13, 2026, states that retention rules can keep Gemini app conversations, "comprising user prompts and Gemini app responses", and that administrators can retain, hold, search and export them. User deletion does not remove a conversation that is under a retention rule or hold. Vault requires a Workspace edition that includes it, so not every Google employer has this.

Company laptop, personal account

This is the setup most people are asking about: a free or Plus ChatGPT account in a browser on a work laptop. OpenAI shares nothing with your employer here. What your employer sees comes from software on the laptop.

Microsoft Purview is the most documented example. Its guidance on third-party AI apps, dated May 1, 2026, states that Windows devices onboarded to Purview can be configured with endpoint data loss prevention policies that "warn or block users from sharing sensitive information with third-party generative AI sites that are accessed via a browser", with the example of a user "prevented from pasting credit card numbers into ChatGPT". Administrators see visit counts and "sensitive interactions per AI app". Capturing the prompt text itself requires the administrator to set a collection policy that includes content capture, and features that read prompts and responses for ChatGPT, Gemini and DeepSeek are "restricted to the Edge browser" or require the Purview browser extension. Microsoft also notes that endpoint DLP cannot scan data that is never saved to a file, which is why the paste check matters more than file scanning for chat tools.

So on a managed Windows laptop with Purview or a comparable tool from Zscaler, Netskope or others: the employer can see you visited an AI site, can see when you pasted something that matched a sensitive pattern, can block the paste, and can read the full prompt only if a specific capture policy is on and you used the browser the tool controls. On a laptop with no endpoint agent, the employer sees only what the network sees.

Office network and VPN

A corporate network or always-on VPN logs the domains your device connects to. chatgpt.com in that log shows you used ChatGPT; it does not show what you typed, because the connection is encrypted. Reading the content requires the network to decrypt and re-encrypt traffic, called TLS inspection, which needs a certificate installed on your device. On a company device that certificate is usually present. On a personal device connected to office Wi-Fi it is not, unless you installed it, so the network can see the domain and the volume of traffic and nothing else. Secure access service edge products advertise "prompt-level visibility" on managed devices; we could not read their technical documentation during research and do not quote it.

Incognito mode hides history from the browser on the device. It does nothing to the network log or to an endpoint agent. A personal VPN on a company laptop hides the domain from the office network but not from the endpoint agent, and may itself breach the acceptable use policy.

Your own phone

A personal phone on mobile data, running your own ChatGPT account, is outside every mechanism above. Purview's endpoint data loss prevention supports Windows and macOS, not phones. The exceptions are a phone enrolled in the company's mobile device management, where the enrollment profile determines what is visible and can include installed apps and web filtering, and a phone on office Wi-Fi, where the domain is visible. If your employer required an enrollment profile to get work email on your phone, read the notice you accepted; it lists what the profile can see. We found no vendor documentation describing prompt capture from a consumer AI app on a managed phone.

Can they tell the text was AI-written

Not reliably by software. OpenAI released a classifier for AI-written text on January 31, 2023 that identified 26% of AI text correctly and labeled human text as AI 9% of the time, and withdrew it on July 20, 2023 "due to its low rate of accuracy". A 2023 study of 14 detectors by Weber-Wulff and colleagues found none above 80% accuracy, and a 2023 study in Patterns by Liang and colleagues found detectors flagged essays by non-native English speakers as AI-written 61% of the time. An employer who accuses you of using AI on the strength of a detector score is relying on a tool its own makers have abandoned. Managers do notice when a person's writing changes register overnight, and that is a different, human, kind of detection.

What the law requires them to tell you

Federal law permits an employer to monitor its own systems. The Electronic Communications Privacy Act's wiretap provisions, 18 U.S.C. 2511(2)(d), allow interception where one party to the communication has consented, and the acceptable use policy you signed is that consent for company devices and accounts. Three states add a notice duty for electronic monitoring:

Everywhere else, no statute requires your employer to tell you that AI site visits or pastes are logged, though most do so in the acceptable use policy. Our employee monitoring laws by state page covers the full picture, and our guide to whether your employer can read your Teams or Slack messages applies the same account-device-network logic to chat.

On discipline: for an at-will employee, a written AI policy can be enforced like any other policy. Littler's survey of more than 300 employers published May 6, 2026 found 68% had a formal AI policy, up from 38% in 2025, and 54% restricted what information could be entered. The gap on the employee side is wide: in EisnerAmper's 2025 survey of 1,017 US desk workers who use AI, 36% said their employer had a formal AI policy, 22% said their use was actively monitored, 60% relied on free AI platforms and 28% said they would use AI even if it were banned. The National Labor Relations Act protects discussing AI rules with colleagues; it does not protect pasting customer data into a consumer tool.

How to keep work and personal AI use apart

1. Treat the company account as a company record. Anything in ChatGPT Enterprise, Copilot or Gemini for Workspace can be retrieved in an investigation or lawsuit, after you delete it.
2. Do not paste restricted data into a personal account on a work laptop. That is the one action DLP tools are built to catch, and the one most AI policies make a disciplinary matter.
3. Use the approved tool for work and your own phone for personal questions. Mobile data, not office Wi-Fi.
4. Read the AI policy and the monitoring notice. If you are in Connecticut, Delaware or New York and never received one, the employer is out of compliance, not you.
5. Check the consumer data setting. Consumer plans typically allow training on conversations unless you turn it off in data controls; that is a privacy question between you and the vendor, separate from your employer.
6. If you are accused of AI use based on a detector score, ask for the tool and its false positive rate. The published rates above are the answer.

Key takeaways

• OpenAI does not give your employer your personal account history. Your employer sees what its own account, device or network records.
• On a company ChatGPT Enterprise, Copilot or Gemini for Workspace account, administrators can retrieve prompts and responses, and deletion does not remove them from retention or eDiscovery holds.
• On a company laptop with a personal account, data loss prevention tools log AI site visits, detect and block pastes of sensitive data, and can capture prompt text only with a specific collection policy, usually in a managed browser.
• Office networks log the domain, not the content, unless TLS inspection is installed on the device. Incognito mode changes none of this.
• A personal phone on mobile data is outside every employer tool unless it is enrolled in mobile device management.
• AI text detectors are unreliable: OpenAI withdrew its own on July 20, 2023 for low accuracy, and independent studies found none above 80% accuracy with high false positives for non-native English writers.
• Connecticut, Delaware and New York require written notice of electronic monitoring. Elsewhere the acceptable use policy is the notice.
• 68% of employers say they have a formal AI policy; 36% of AI-using desk workers say theirs does, and 22% say their use is monitored.