Key points
- Users can lock specific chats using a four-digit PIN or device biometrics like Face ID.
- The feature is rolling out to Free, Go, Plus, Pro, Business, Enterprise, and Edu accounts.
- Locked chats are not end-to-end encrypted and do not change data retention policies.
OpenAI announced on Tuesday that ChatGPT users can now secure individual conversations with a PIN or biometric lock, according to TechCrunch. This feature targets organizations and individuals who share devices or need to keep specific exchanges private from casual observers. The update aims to provide an additional layer of access control for sensitive discussions without altering the underlying data architecture.
By the numbers
- 4-digit PIN required to access locked conversations on supported platforms.
- 7 subscription tiers eligible, including Free, Go, Plus, Pro, Business, Enterprise, and Edu.
- 1 dedicated section created for locked chats, separate from regular history.
What the figures mean
The four-digit PIN requirement establishes a simple barrier for device sharing, preventing unauthorized viewing of specific threads. According to Engadget, this does not constitute end-to-end encryption. The availability across seven tiers indicates a broad deployment strategy, ensuring both consumer and enterprise users have access. However, the single dedicated section means locked content remains within the main account interface, requiring users to manage access carefully.
What should you do?
Managed service providers should assess whether this feature aligns with their client’s data handling policies. Teams usually need to verify if locking chats satisfies internal privacy requirements or if stronger controls are necessary. Check whether existing acceptable use policies need updating to reflect this new capability. Inform users that this feature protects against shoulder surfing but does not prevent backend data access by the vendor.
Operational impact
Organizations should determine who within the IT or security team needs to be notified about this feature rollout. Managers should ask whether employees might misuse locked chats to hide policy violations, as the feature does not bypass legal obligations. Teams usually need to clarify that this tool is for device-level privacy, not data sovereignty. Ensure that support staff understand the irreversible nature of PIN resets, which delete all locked content permanently.
What to do and how to stay safe: OpenAI
- Review current data classification policies to determine if sensitive information should ever be stored in ChatGPT, even in locked chats.
- Educate users that resetting their PIN permanently deletes all locked conversations and associated files, with no recovery option.
- Monitor for rollout progress, as the feature may not be immediately available to all accounts on every plan.
- Verify that locked chats are excluded from temporary, archived, or group chat functionalities, which remain unprotected.
Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does locking a chat provide end-to-end encryption?
No, OpenAI explicitly states that locked chats do not create end-to-end encryption or a separate encrypted vault.
What happens if I reset my PIN for locked chats?
Resetting the PIN permanently deletes all locked chats, files, and other content protected by that PIN, and this cannot be undone.
Is this feature available for all types of chats?
Locked chats are not available for temporary chats, archived chats, group chats, or chats created from shared links.
