Not a vulnerabilityNothing is taken by force. The second use is written down somewhere and the control exists, and the objection is that the default answers for the person.
What it is
A service accepts text, images or files in order to answer, and keeps them afterwards for a second purpose: improving a model, evaluating quality, or review by people. A control that prevents it exists, but it stands at on when the account is created, sits several steps from the input screen, applies only to what is submitted after it is changed, or is offered on a paid tier only. At the moment of typing the person is told nothing about the second purpose.
Why it is a separate entry
People put things into these services that they put nowhere else: a draft resignation, a medical letter, a client file, a message about a family member. Kept as training material, that content leaves the person's reach altogether. It cannot be found back, cannot be corrected, and cannot be removed from what has been built on it.
How it arises
retention for improvement on by default, with an opt-out per account
a business tier excluded from training while the free tier is not, without that being visible at the moment of typing
review by people described as a security measure rather than as a second purpose
an application built on another party's model, passing content on under that party's default terms
Not to be confused with
Content reaching an advertising or measurement party is User input to third parties, where the content is a by-product. Here it is the payload, and the fault is the second use of it. A store that writes the payload into a log is Logs recording content, not events, which is about the operator's own housekeeping rather than a second purpose.
How to establish it
In an account created for the test and left untouched, the control governing use of input for model improvement or review by people stands at on, and the terms of the same date state that submitted content is used for that purpose. Both are read as delivered, before anything is changed.
method document-comparisonQoD 90
Requirements on the measurement
a fresh account, nothing changed, and a record of the default state with the date and the version
record where the control sits and how many steps it is from the input screen
record whether switching it off also covers what was already submitted
record whether a paid tier differs, and whether that difference is visible at the moment of typing
What would refute it
by handThe default stands at off and the person has to switch it on.finding falls
by handSubmitted content is used to produce the answer and is destroyed within a stated short period.finding falls
by handSwitching the control off also removes what was submitted before.weakens
by handThe operator does not retain it; the content is passed to another party under that party's terms.The recipient is then the party to address, and the operator's silence about it is a transparency finding.reclassify
Where this plugs into existing processes
The one question that surfaces itIn a new account, is the training setting on or off, and what happens to what I already typed if I switch it off?
In a DPIA, verify this
Verify the default state of the control in a fresh account, and whether switching it off works backwards, instead of the supplier's statement that customer data is not used for training.
As a procurement clause
Content submitted by users is used to produce the answer and for nothing else, demonstrated by the default state of a fresh account and the terms of the same date.
With a complaint, hand over
A screenshot of the default state in a fresh account with its date, and the passage in the terms describing the second purpose.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-5-1-b
eu-gdpr-25
eu-gdpr-6-1-a
Objections, and the answer
“It is in the terms.”
A second purpose has to be clear at the moment of typing, and the default has to be the protective one. A term accepted once at sign-up is not a choice per submission.
“The data is anonymised before training.”
Free text is not anonymised by removing a name; it identifies through its content. And what is being examined is what is retained, not what may be filtered later.
“You can switch it off.”
The finding is the default, not the possibility. A control that has to be found is a control most people never reach.
“Reviewers only see fragments.”
A fragment of a medical letter is a medical letter. The unit of review does not change the category of the content.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0041: Input kept as training data by default. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0041
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0041, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.