Your users just got three new reasons to distrust your AI. Build the receipts now.

Three stories landed in the same week, and they all pull on the same thread: can users trust what your AI is doing with their stuff? A court fight over hidden evidence, a new ad label, and a photo-scraping feature people didn't ask for. Different companies, same nerve. Let me catch you up on what changed and what it means for the trust you're asking users to hand over.

The problem was never the search, it was the pretending

The New York Times says OpenAI hid what it could do. For two years, OpenAI argued it could not search its own training data and that pulling chat logs would be too hard and too risky for user privacy. Then a deposition told a different story. The Times alleges OpenAI had already built a database of 78 million de-identified chats to check its own infringement, and ran a filter to log when the model spat back copyrighted text.

OpenAI denies it, and calls the claims an attempt to invade user privacy. But sit with the shape of it. The company said a thing was impossible while allegedly doing that exact thing in-house. That is the pattern users fear, and it is the one your team can accidentally repeat: claiming you can't see something you can, or saying data is safe while quietly using it.

Labels are cheap. The honesty behind them is not.

Google now tells people when an ad was made with AI. Click the three-dot menu on an ad in Search, YouTube, or Discover, and you'll see a "how this ad was made" note. If the advertiser used Google's own AI tools, the label turns on by itself.

Here's the crack. If the ad was made somewhere else, the advertiser has to flag it themselves. Google says it won't check. So the disclosure only works if the person who benefits from hiding it chooses to be honest. That's the tradeoff in a lot of transparency features: a label that depends on self-reporting tells your user less than it looks like it does. If you ship a badge like this, decide up front whether you can actually verify it, and don't dress up a checkbox as proof.

Consent by default, not consent by menu-diving

Meta's new "Muse Image" tool lets people generate AI images using photos from public Instagram accounts. Tag a public account, use their pictures. The person whose face it is gets no notice. Private accounts and users under 18 are excluded, but everyone else is opted in by default.

To opt out, you dig into your profile, tap "Sharing and reuse," and toggle off "Allow people to create with and reuse your content" for both posts and reels. That's a lot of steps to protect yourself from a thing you never agreed to. And Meta carries baggage here: a $5 billion FTC fine in 2019 for misleading people about how much control they had over their data. Public skepticism is already baked in. Pew found 35% of people are more worried than excited about AI. Default-on data use spends trust you may not have.

Correction after the fact is a weak substitute for getting it right

Elon Musk says X will message you if a post you interacted with later gets a Community Note correction. Some accountability beats none. But the fix arrives after the post already spread, and only if people check their DMs and bother to undo a like.

That's the limit of bolt-on trust. A notice after the damage isn't the same as building the thing so the damage is smaller to begin with. When you plan AI features, ask where the honesty lives: at the moment of the action, or in an apology later.

The deep cut

Every one of these companies had a transparency story on paper. OpenAI had privacy arguments. Google has a label. Meta has an opt-out toggle. X has a correction DM. On paper, all four look responsible. In practice, the honest part was buried, self-reported, opted-out, or late. So the question for your next review isn't "do we disclose?" It's "can the user actually find it, trust it, and act on it before harm?" Write down, for each AI feature, exactly what data it touches, whether the user is opted in by default, and whether your disclosure depends on someone choosing to be honest. If any answer would embarrass you in a deposition or a headline, fix it before you ship. That's the whole game right now.

Three questions for your team

1. For each AI feature we run, is the user opted in by default, and would we defend that choice out loud to that user's face?
2. Where a feature uses someone's data or content, can they find the control in under 10 seconds, or is it buried three menus deep like Meta's toggle?
3. Does any "transparency" we ship rely on self-reporting we don't verify, the way Google's off-platform ad label does, and are we calling that proof when it isn't?