French AI darling Mistral quietly changed its privacy policy after a complaint was submitted to the French data protection authority, alleging the company had breached GDPR rules.
On Monday, lawyer Jérémy Roche submitted a complaint to France’s data watchdog CNIL, first reported by French publication L’Informé.
The complaint, seen by Sifted, alleged users of the free version of Mistral’s conversational assistant Le Chat were unable to opt out of their data being used by the company to train its models.
Roche told Sifted that he filed the complaint after noticing Mistral’s pricing for Le Chat showed that only premium users of the tool could access a “no telemetry mode”, meaning data won’t be used to improve the company’s services.
Mistral did not respond to Sifted’s request comment, but subsequently appeared to have amended its privacy terms, extending the right to opt out to free users.
Mistral's changing privacy terms
Mistral, which builds generative AI models, released Le Chat on app stores last week. The technology, similar to OpenAI’s ChatGPT, lets users browse the web, access news, and analyse documents and data.
Prompts submitted to Le Chat can be considered personal data under the GDPR, which states that users have the right to oppose the processing of personal data at all times.
The complaint was drafted on the basis of Mistral’s privacy policy in place at the time, Roche told Sifted, which stated that for free Le Chat users, data such as input and output would be used to train and improve the company’s AI models. These users were unable to opt out without paying, said Roche.
In practice, this meant that it was “impossible” for users to assert their right to opposition, according to the complaint.
Mistral’s privacy terms did include that the company uses “commercially reasonable efforts” to de-identify any data before using it to train the models — but the complaint described this as an “imprecise” notion.
Premium versions of Le Chat, on the other hand, include an option to let users opt-out of model training at any time thanks to a feature available directly in their account.
“Mistral AI conditions exercising [the right to opposition] to a premium subscription of over €15 per month,” stated the complaint.
As of Wednesday, it appears Mistral has updated the terms of its privacy policy, adding that free users have the right to object to the processing of their data by emailing the company, making a request via its help centre or by sending them a letter.
“A difference seems to persist between free users of Le Chat and premium users when it comes to the modalities of exercising their right to opposition,” Roche tells Sifted. “Pro users can easily exercise this right in two clicks through the service’s interface.
“Beyond this remains the question of information for free users: this is stated within 17 pages of privacy policy, which can be found on a webpage of legal terms and conditions written in English and about 40 pages-long.
“Without seeing this option in their interface, few free users will be likely to exercise their right to opposition.”
Free users of OpenAI’s ChatGPT as well as X’s Grok can opt-out of data processing for model training directly in their account. Anthropic’s Claude is set to opt-out by default.
Earlier this year, the Italian data watchdog fined OpenAI €15m after it found that ChatGPT had breached various GDPR provisions, including in regards to the collection of personal data to train its models.
