Claude Shared Chats Indexed by Google, Exposing Health Records and Children's Data in Employee-Generated AI Content

What happened

Why it matters

• ·Organizations in regulated industries face potential violations of data protection obligations where employees have input personal health information, financial data, or other regulated categories into Claude and shared those conversations, even inadvertently. Regulators examining the UK ICO Guidance on Artificial Intelligence and Data Protection or applicable sector-specific rules are unlikely to accept user error as a complete defense where no organizational controls prevented the input of sensitive data into consumer AI tools.
• ·The incident exposes a gap in acceptable use policy enforcement: most enterprise AI policies address what employees may do with AI outputs, but fewer specify controls on what data employees may input into third-party AI tools, or govern the sharing of AI-generated conversations that contain that data. Without an enforced input-data classification standard, organizations have limited visibility into how much sensitive information has already been entered into platforms like Claude.
• ·The presence of children's personal information in indexed conversations creates heightened risk under children's privacy laws across multiple jurisdictions, and organizations providing services to minors or whose employees have access to records involving children must assess whether any such data was processed through Claude and whether sharing occurred.

Governance controls affected

What to do now

• ☐Audit your acceptable use policy to confirm it explicitly prohibits inputting health records, children's data, personally identifiable information, and confidential company documents into consumer-grade AI tools including Claude, and update it if those categories are not named.
• ☐Issue immediate guidance to employees clarifying that Claude shared chats and Artifacts are publicly accessible by default when a share link is created, and that this content may be indexed by search engines.
• ☐Conduct a targeted inquiry with business units most likely to have used Claude for tasks involving regulated data, including HR, legal, healthcare operations, and customer service, to assess the scope of potential exposure.
• ☐Review your third-party AI vendor contracts and procurement assessments for consumer AI tools to confirm whether data-sharing defaults and public accessibility of user-generated content are documented and disclosed.
• ☐Classify this event under your AI incident response playbook, determine whether regulatory notification obligations apply in any jurisdiction where affected individuals are located, and document the determination with supporting rationale.

What to watch next

Anthropic has not announced a change to the default public-accessibility behavior of shared links, so the exposure pathway documented in this incident remains open for any organization whose employees continue to use Claude without explicit guidance on sharing. Compliance teams should monitor whether Anthropic introduces privacy-by-default sharing settings or other platform controls that would change the risk profile. At the regulatory level, this incident is the kind of real-world AI data leakage event that enforcement bodies in the EU, UK, and US have signaled they will use to assess whether organizations have adequate AI acceptable-use controls in place, making it a timely prompt to review NIST AI 600-1 Generative AI Profile alignment for generative AI intake and data handling programs.