The 2023 OpenAI toggle backlash: an AI data-sharing setting on by default
December 2023
Users discovered a 'third-party AI' setting that was switched on by default for most of the world, fueling fears that Dropbox was quietly feeding personal files to OpenAI. Dropbox said no data was passively sent and that files were not used to train models.
What happened
In December 2023 Dropbox users noticed a new account setting labeled 'third-party AI' that was toggled on by default. The setting governed Dropbox's experimental AI search and Q&A features, which could send file contents to OpenAI when those features were used. Because the toggle was enabled by default for most of the world — with the EU, UK, and Canada opted out, but the United States and others opted in — many users concluded that their private documents were already being shared with OpenAI, or used to train its models. A widely shared post on X warning about the setting was viewed millions of times, and the story was amplified by outlets including CNBC.
Dropbox pushed back, saying the toggle merely enabled or disabled access to its AI features and that no data was 'automatically or passively' sent to any third-party AI service; data left Dropbox only when a user actively invoked an AI feature. A Dropbox spokesperson stated that customer data shared with OpenAI was not used to train or fine-tune OpenAI's models and was deleted within 30 days. CEO Drew Houston apologized for the confusion on X. Critics, including security commentators, accepted the technical clarification but argued the real problem was trust: an opt-out default on a privacy-sensitive AI feature, combined with the absence of enforceable legal limits on future data use, was precisely the kind of design choice that invites suspicion.
Impact
The episode became an early, high-profile example of the backlash awaiting cloud-storage incumbents that bolt generative-AI features onto repositories of users' private files. Even though Dropbox's clarification was widely accepted as accurate, the default-on framing damaged trust, drove a wave of guides on how to disable the setting, and pushed Dropbox to make the toggle and its data-handling more transparent. It also fed a broader, still-unsettled debate over what 'consent' means when AI features sit atop personal data — a debate that remains live as Dropbox reorganizes around its Dash AI product.