Mistral AI — Europe’s flagship “privacy-safe” alternative to US AI giants — quietly changed its defaults this week so that user prompts now train its models unless you manually opt out. The change affects free Le Chat users and the free API Experiment tier. Moreover, it carries a sharp irony: the company that built its brand on EU data sovereignty and GDPR-native compliance has created the exact compliance risk it promised to solve. Developers surfaced the issue on Hacker News on September 2, 2026, and the backlash was immediate.
Who Is Affected: The Tier Breakdown #
Not every Mistral user has a problem — but if you’re on the free tier, you almost certainly do. Free Le Chat and the API Experiment tier now default to training on your prompts and outputs. You are opted in unless you’ve explicitly turned it off. Furthermore, the Team tier is the messy middle: it lost the admin toggle that allowed organizations to enforce opt-outs across the entire workspace, which means individual users in a Team account each need to opt out themselves.
The paid tiers, fortunately, are cleaner. Paid API (including the Scale plan) defaults to no training. The Enterprise tier is opted out by default. Zero Data Retention — available exclusively on the Scale API plan — goes further still, skipping the standard 30-day abuse-monitoring window entirely. However, ZDR does not cover Le Chat, Agents, or batch jobs. If you’re using any of those, you’re not under ZDR regardless of your plan.
Here’s the part that stings for developers: the free API Experiment tier is exactly where most developers land first when evaluating Mistral. Code you paste in while “just testing” — proprietary logic, internal API calls, product feature specs — may already be in the training pipeline. In other words, “just trying it out” is not the safe zone you assumed it was.
Related:[DeepSeek V4 Flash: 97% Cheaper Than Claude — Should You Switch?]
The GDPR Irony Is Hard to Ignore #
Mistral’s core pitch has always been simple: we’re the EU-native alternative, built under GDPR from day one, no cross-border data transfers, no SCCs, no adequacy decisions needed. It was a compelling differentiator against OpenAI and Google — companies that had to bolt GDPR compliance on after the fact. Consequently, European enterprises chose Mistral precisely to avoid the “is our data being trained on?” question. They’re now asking that exact question again.
The developer community’s verdict was blunt. One commenter called it “spyware, but a sovereign one.” Another noted that for any organization handling GDPR-regulated data or sensitive IP, “this basically makes the Team tier unusable.” In fact, compare the default policies directly: OpenAI’s API defaults to no training. Anthropic’s API defaults to no training. Google’s Gemini API defaults to no training. Mistral’s free API Experiment tier now defaults to training. The EU privacy champion has worse developer defaults than its US competitors on the tier where most developers start.
Making this worse: Mistral’s documentation contradicted itself for days. Some pages said Team tier users were opted out by default. Actual behavior said otherwise. As a result, developers who trusted the docs and didn’t verify their settings were exposed without knowing it. Contradictory documentation isn’t a minor footnote — it’s its own failure, separate from the policy itself.
How to Opt Out — Do It Now #
The opt-out process requires separate actions for each Mistral service. Opting out of Le Chat does not cover your API usage, and vice versa. Therefore, you must handle both independently, according to Mistral’s official opt-out documentation.
For Le Chat on the web: open the Admin Console, select “Le Chat” under the Manage section, go to Privacy settings, and disable “Allow your interactions to be used to train our models.” On mobile (iOS or Android): Settings → Data & Account Controls → deselect “Enable data sharing.” For Mistral Studio and the API: Admin Panel → Privacy menu → disable the toggle under “Anonymous improvement data.” Do not assume your team’s admin handled this. Do not assume your previous opt-out covered the API. Additionally, if your team relies on Le Chat for daily work, audit who has opted out individually — the Team tier no longer enforces this at the organization level. Verify each service today.
Key Takeaways #
- Free Le Chat and the free API Experiment tier now default to training on your prompts — opt out immediately via the Admin Console
- Le Chat and API opt-outs are completely separate — disabling one does not disable the other
- Mistral’s free API Experiment tier now has worse privacy defaults than OpenAI, Anthropic, and Google’s equivalent developer tiers
- The Team tier lost organization-wide opt-out controls — every user must opt out individually
- If you’re on paid API or Enterprise, you’re already opted out by default; ZDR (Scale plan) is the most protective option if you need zero retention