Here they basically admit that they use session data for training, even sessions that are marked "not for training", and they justify this by "de-identifying" the session.

Which means they can learn from whatever you discuss with ChatGPT unless you are going through a clean API (perhaps Bedrock? Anyone know?)

> We (the researchers and the agents) did not see any of their work through any means until they released it publicly — in particular, no specific user data was accessed in order to solve this problem. While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models . However, our proofs differ significantly and even the precise results proved are different in the Euler case (forced vs unforced).