You opened ChatGPT, started asking it questions, and it was brilliant. So you kept using it. Maybe you drafted a contract clause, summarised a deposition, or brainstormed arguments for an upcoming motion.
What you probably didn’t do was open the Settings menu.
That was a mistake — and not a small one.
ChatGPT’s default configuration is built for a general consumer audience. It is not built for legal professionals bound by strict duties of confidentiality, professional conduct rules, and bar association ethics obligations. Out of the box, it makes choices about your data, your conversations, and your professional identity that you would almost certainly not make yourself — if you knew about them.
The good news: every one of these problems has a fix. The settings below take less than ten minutes to change, and they could save your licence.
Let’s go through them one by one.
⚠️ Before We Start: The Non-Negotiable Foundation
Everything in this article assumes you are using ChatGPT Team, Enterprise, or a comparable paid tier for client-related work.
If you are using a free or personal Plus account and feeding it client information — even in vague or anonymised form — you need to stop doing that today. Free-tier and personal accounts have weaker data protections, and OpenAI’s terms explicitly warn that personal accounts are not designed for professional use involving sensitive data. The settings below dramatically reduce your risk; they do not eliminate the need for the right account tier.
Now, let’s fix your settings.
Setting #1: Turn Off “Improve the Model for Everyone”
Where: Settings → Data Controls → “Improve the model for everyone”
Default: ON
Change it to: OFF
This is the single most important setting in ChatGPT for any legal professional, and it is turned on by default.
When this setting is enabled, OpenAI can use your conversations to train future versions of ChatGPT. Every prompt you type. Every document you upload. Every question you ask. Potentially feeding into the model that millions of other people will use tomorrow.
For a lawyer, this creates a deeply uncomfortable scenario. Even if you’re careful about not naming clients, legal documents carry distinctive details — deal structures, dispute patterns, jurisdictional nuances, negotiation positions. The obligation to protect client confidentiality doesn’t come with an asterisk that says “unless it’s an AI training input.”
How to fix it: Click your profile icon (bottom-left on desktop) → Settings → Data Controls → toggle off “Improve the model for everyone.”
On business and enterprise accounts, this protection is on by default. If you’re on a personal account, you have to do this yourself, right now.
Setting #2: Get Control of ChatGPT’s Memory — Before It Remembers the Wrong Things
Where: Settings → Personalization → Memory
Default: ON (for most paid users)
Change it to: Audit it carefully. Use Temporary Chats for sensitive work.
In 2025, OpenAI significantly expanded ChatGPT’s memory capabilities. The system now operates on two layers: “Saved Memories” (details you explicitly tell it to remember) and “Chat History” insights (conclusions it draws from past conversations on its own). This memory persists across sessions and shapes future responses.
For personal productivity, this is genuinely useful. For a lawyer, it is a loaded weapon pointed at your bar card.
Here’s the problem: ChatGPT could connect the dots across conversations in ways you never intended. A detail mentioned in passing about a client’s commercial dispute in one session could be contextualising your contract drafting in a completely different session weeks later. You may not even realise it’s happening.
There’s also a harder question: what does ChatGPT actually remember about you right now?
Find out immediately. Go to Settings → Personalization → Manage Memories. Review everything stored. Delete any memory that references client matters, case details, deal specifics, or anything that should never have left a privileged communication.
For sensitive work, use Temporary Chat mode. Like browser incognito, Temporary Chats are not saved to history, do not create memories, and are not used for training. Access it from the top-left new chat button → “Temporary Chat.” Make this your default mode for any client-adjacent work, even if it’s exploratory. Note: OpenAI does retain temporary chat data on its servers for up to 30 days for abuse-prevention purposes — so temporary does not mean legally protected.
Setting #3: Write a Custom Instruction That Turns ChatGPT Into a Legal Professional
Where: Settings → Personalization → Custom Instructions
Default: Blank
Change it to: A professionally crafted instruction set tailored to legal practice
Most lawyers are prompting ChatGPT from scratch every single session, re-establishing context each time. This is inefficient, and it also means ChatGPT is constantly defaulting to generalist behaviour when you need specialist precision.
Custom Instructions let you tell ChatGPT, once and permanently, who you are and how you want it to behave. These instructions load into every conversation automatically.
Here is a template you can adapt immediately:
“I am a practising [type of law] attorney in [jurisdiction]. When assisting with legal work, always: apply the correct jurisdiction’s law unless I specify otherwise; flag where you have uncertainty about the current state of the law; do not cite cases you cannot verify; recommend I confirm anything case-specific with primary legal sources; format legal documents in standard professional style; and never assume facts not in evidence. When drafting, match the formal register of legal writing. I will always review and verify your output before use.”
This does several critical things at once. It grounds ChatGPT in your jurisdiction. It instructs it to flag uncertainty rather than paper over it with confident-sounding text. It sets a standard for document formatting. And critically, it embeds a reminder into every session that your output requires human review — a professional conduct safeguard baked directly into the workflow.
You can also use the second Custom Instructions field (“How would you like ChatGPT to respond?”) to specify output preferences: “Be concise and precise. Use headings. Where you reference case law, include jurisdiction and year. Do not use filler language.”
Setting #4: Audit and Restrict Your Connected Apps
Where: Settings → Connected Apps (desktop browser only)
Default: Whatever you connected when it seemed convenient
Change it to: The minimum required — and nothing else
ChatGPT can now connect to external services including Google Drive, Dropbox, SharePoint, GitHub, and more. In Agent Mode, it can actively interact with these services with limited real-time supervision from you.
For a general consumer, convenient access to your cloud storage is a feature. For a lawyer with client files, privileged correspondence, and confidential contracts living in Google Drive, it is a significant access-control risk.
Ask yourself: does ChatGPT genuinely need access to your document storage? For most workflows, the answer is no — you can upload specific documents manually when needed, keeping you in full control of what the AI sees. Blanket access to your Drive means ChatGPT could draw on files you never consciously intended to share.
Action: Go to Settings → Connected Apps in your browser (this option isn’t available in the mobile app). Review every connected service. Disconnect anything non-essential. Then go to each connected service’s own third-party access settings (e.g., your Google Account’s security page) and revoke ChatGPT’s access there too — removing the connection in ChatGPT alone may not fully revoke the OAuth token on the other side.
Repeat this audit every 90 days. New connectors get added quietly, and integrations enabled in haste are often forgotten entirely.
Setting #5: Enable Two-Factor Authentication — Your Whole Practice Could Be in Those Chats
Where: Account Settings → Security → Two-Factor Authentication
Default: OFF
Change it to: ON — immediately, before you do anything else
This one sounds basic. It isn’t optional.
If you have been using ChatGPT for legal work over any meaningful period, your chat history may contain a substantial record of your legal thinking: research threads, draft arguments, document analysis, client communication templates. You may have been careful about not naming clients, or you may not have been. Either way, this data has value — and your account is a target.
A compromised ChatGPT account doesn’t just expose your AI experiments. It exposes everything you’ve ever asked, everything you’ve ever uploaded, and potentially the clients you serve. Attorney-client privilege does not survive a data breach caused by inadequate account security.
Two-factor authentication takes approximately 90 seconds to enable. Go to your account settings, navigate to Security, and turn it on. Use an authenticator app (Google Authenticator, Authy) rather than SMS-based 2FA, which is significantly less secure.
While you’re there: audit your password. If it’s reused from another service — any other service — change it now. A credential stuffing attack (where leaked passwords from one breach are tested on other accounts) is one of the most common and preventable ways accounts get compromised.
The Bonus: Think Before You Type (No Setting Can Fix This)
The five settings above dramatically reduce your exposure. But the most powerful safeguard isn’t in any menu.
It’s the habit of never typing client-identifying information into any AI system that isn’t operating under a verified, enterprise-grade data processing agreement — regardless of what the settings say.
This means anonymising inputs as a default workflow. Before you paste anything into ChatGPT, ask: “If this prompt were subpoenaed, what would it reveal?” Because in June 2025, a U.S. federal court ordered OpenAI to preserve all user chats — including deleted ones — in connection with ongoing litigation. ChatGPT conversations are not ephemeral. They are discoverable.
Your bar association’s ethics rules were written for a world that didn’t include AI. Most haven’t been updated to specifically address it. That doesn’t mean the principles don’t apply — it means you carry the interpretive burden. Competence, confidentiality, and supervision all travel with you into every AI conversation you have.
Quick Reference: Your 10-Minute ChatGPT Security Audit
| Setting | Where to Find It | What to Do |
|---|---|---|
| Model training | Settings → Data Controls | Turn OFF “Improve the model for everyone” |
| Memory | Settings → Personalization → Manage Memories | Audit and delete sensitive memories; use Temporary Chat for client work |
| Custom Instructions | Settings → Personalization → Custom Instructions | Add your jurisdiction, role, and professional safeguards |
| Connected Apps | Settings → Connected Apps (browser) | Disconnect all non-essential services |
| Two-Factor Auth | Account → Security | Enable immediately; use authenticator app |
Final Word
ChatGPT is an extraordinary tool for the legal profession. The lawyers using it well — with the right configuration, the right governance, and the right habits — are getting a genuine competitive advantage in research speed, drafting quality, and workload management.
The lawyers using it carelessly are building a liability case against themselves, one default setting at a time.
Ten minutes in your settings menu is the most important investment you’ll make in your AI workflow this year.
