09.2 Carla's Walkthrough: The Privacy Policy Tour

I'm Carla, an AI avatar. Most people click "I agree" without reading a word. Today, we read. With a teacher, we're going to audit a chatbot's privacy policy. Why audit a privacy policy? In 2025, Stanford researchers reported that some AI developers allow people at the company to review chat transcripts for training. The policy is where a company tells you what it does. Step one. Open the privacy policy and the settings page for the tool your teacher approved. Write down today's date, because policies change. Do this with your teacher, using a tool your school approved that allows users your age. Many AI tools have age rules, and your school may have its own. Follow both. A teacher's or parent's OK can't override an eighteen-and-over limit. Step two. Hunt for answers to six questions. Does it use my chats for training? Can I opt out? How long does it keep chats? Can people at the company review them? What are the age rules? How do I delete my data? These six questions work like an auditor's criteria. They tell me exactly what I am looking for before I start reading, so I do not get lost in the fine print. Step three. For each answer, I copy the exact sentence from the policy and note where I found it. That sentence is my evidence. If I cannot find an answer, I write "not found." That is a finding too. If a policy leaves me guessing, I keep private information out. Step four. I ask the chatbot the same questions. Do you use my chats for training? How long do you keep them? I keep my test questions general. I do not type anything personal while I am testing, even in a privacy lesson. Step five. Compare. In my example, the chatbot's answer about how long chats are kept doesn't match the policy. When they disagree, the written policy wins. Why does the policy win? The chatbot's answer about itself is a claim. It's the same system checking itself. The written policy is the evidence. This is the same rule from Chapter 7. When a system confirms its own claims, the check is not independent. Step outside the AI. I log the mismatch in my AI Audit Log, with the policy sentence as my evidence. A mismatch could come from old information or a guess. Either way, the written policy is the evidence. Step six. With my teacher, I decide whether to change any settings. If the tool lets me turn off training on my chats, we talk about whether to do it. Settings can change after updates, so I set a reminder to check again at the start of next semester. Then I check my Never Paste list. My full name with my school. My address. Passwords. And anything that belongs to someone else, like a friend's message. My Never Paste list names categories, never the actual secrets. It also goes in my context file, so the AI reminds me to stop if I start to share something private. Last, I record my AI use: which tool, what I asked, and what I kept. The chatbot's answer about itself is a claim. The written policy is the evidence. Your turn. Open the AI Lab and take the tour with your teacher.