ChatGPT’s Locked Chats fix an obvious privacy gap—but not the real one

ChatGPT’s new Locked Chats feature is useful precisely because it exposes an uncomfortable design failure: sensitive AI conversations were sitting in the same history as everything else. OpenAI is now adding a four-digit PIN and, where supported, biometric authentication to individual conversations. That is a welcome fix for anyone sharing a phone, computer, or screen. It is not, however, the privacy architecture that sensitive conversations deserve.

OpenAI announced the feature on October 20, 2026, and is rolling it out progressively across the web, desktop, iOS, and Android. Locked conversations disappear from the normal history, pinned chats, and internal search, then move into a separate Locked Chats area inside Projects. As Clubic reports, the option is available to free and paid users, although it may not appear immediately on every account.

Locked Chats solve the person looking over your shoulder

The strongest case for this feature is also the least glamorous one. A roommate, colleague, family member, or stranger borrowing an unlocked device should not be able to scroll through questions about health, work, relationships, finances, or private plans. ChatGPT has become a place where people write far more than disposable prompts, and a conventional sidebar is a poor boundary for that material.

On iPhone, Face ID or Touch ID can be used; compatible Android devices can use the device’s unlock method. The protection also covers files associated with the locked conversation. That makes the feature meaningfully better than merely hiding a title or moving a chat lower in the list: casual browsing no longer reveals the conversation through ordinary history or search.

In our view, this is the right level of control for a shared-device problem. Users do not necessarily want to delete a valuable conversation or send every sensitive question into a temporary mode. They may want to keep the material while restricting who can open it. The product finally recognizes that those are different needs.

Calling it private would oversell what the lock does

The word “locked” invites a much stronger interpretation than the feature supports. These conversations remain stored on the account. The lock does not add specific end-to-end encryption, change retention periods, or alter the account settings governing whether conversations may be used to improve OpenAI’s models. It also does not automatically erase information ChatGPT may already have remembered before the conversation was locked.

That distinction matters. A PIN can stop someone holding your phone from opening a chat; it cannot, by itself, resolve what happens to the data at the service or account level. Mezha notes that the feature does not remove OpenAI’s legal obligations, including responses to employer demands or legally valid requests. Nor does it revoke links that were shared earlier: those must be deleted separately.

This is why Locked Chats feels more like a privacy band-aid than privacy by design. The feature is attached to the visible interface, where the weakness is easiest to notice. The harder questions—default retention, model-improvement controls, memory boundaries, shared accounts, and administrator access—remain separate decisions for the user to discover and manage.

The forgotten PIN warning is an unusually harsh trade-off

There is another problem that should make users pause before treating the feature as a vault. According to the documentation described by Briefia, resetting a forgotten PIN permanently deletes every locked conversation and the files and information protected only by that PIN. OpenAI support cannot restore them. Changing the PIN is safe if the old PIN is known; resetting it is the destructive path.

That is a strange usability bargain. The feature asks people to create a separate four-digit secret, but the recovery mechanism is not “verify your account and regain access.” It is “erase the protected material.” There is a defensible security argument for avoiding a recovery route that weakens the lock, but the product should make that consequence impossible to miss during setup.

A four-digit PIN is also a narrow form of protection. It is convenient, but convenience should not be confused with strong isolation. Biometrics improve the everyday experience on supported devices, yet the underlying account, sessions, and service-side controls still matter. A locked chat is protected against one category of exposure, not every category.

OpenAI should make the safer choice the easier choice

The next step should not simply be more ways to hide a conversation. ChatGPT needs clearer privacy defaults for sensitive work. Users should be able to see, in one place, whether a locked conversation is retained, whether its contents can contribute to model improvement, what memory it can create, and which account sessions can access it.

OpenAI’s own security page says users can decide whether their data is used for training and improvement, and that memories, conversations, and account data can be deleted. That control exists, but Locked Chats does not turn it into a unified, understandable promise. The interface should connect the lock directly to those choices rather than making users infer that a hidden chat has the same data lifecycle as an ordinary one.

There is also a conceptual gap between protecting a conversation from a curious person and protecting it from account-level exposure. A stronger design would offer an explicit sensitive workspace with its own retention policy, memory isolation, sharing controls, and transparent export and deletion behavior. If OpenAI does not want to build that, it should at least label Locked Chats accurately: hidden from routine viewing, not confidential in every sense.

Locked Chats is worth enabling if the problem is a shared device or an unlocked screen. It is not a reason to paste secrets, confidential client material, passwords, or other information into ChatGPT with greater confidence. Our verdict is simple: use the feature as a useful front-door lock, then separately review account security, memory, retention, and model-improvement settings. The lock is overdue—and still only the first layer.