Granola AI's Default Settings Spark Privacy Concerns
Granola AI exposes user notes publicly, risking legal issues over data privacy.
Why it matters: Exposed data can break client confidentiality and breach privacy laws like GDPR. Legal professionals need to secure client data rigorously.
- Default setting allows public access to user notes unless users change it.
- Internal AI uses notes for training unless users opt out, risking privacy.
- Past API vulnerability exposed user data in test versions, fixed now.
- Granola states no third-party data sharing, but internal data use persists.
The Verge highlighted that Granola AI's default public link-sharing for user notes poses privacy risks, especially for legal professionals handling client data. By default, notes are accessible to anyone with the link unless users manually update the privacy settings.
This configuration not only risks breaching client confidentiality agreements but may also violate privacy regulations such as the GDPR or California Consumer Privacy Act (CCPA), which require stringent data protection practices.
Further complicating matters, user notes contribute to internal AI training unless an opt-out is exercised, which may not be universally known or applied. Granola's policy clarifies that while they don't share data with external AI, internal use of this data persists, raising potential privacy concerns.
Even though Granola employs encryption using AWS servers based in the U.S., earlier issues like a security breach due to an API key have raised alarms about their data protection measures. Although rectified, such vulnerabilities highlight the necessity for ongoing vigilance.
It's imperative for legal professionals to adjust Granola's default settings to prevent unauthorized access. Additionally, they need to ensure compliance with applicable privacy legislation, given the potentially widespread data disclosures.
Yes, but: Legal professionals can mitigate risks by adjusting privacy settings and staying informed on data use policies.
What's next: Granola may need to revise its privacy settings and policies to enhance data protection.