You.com - Enterprise AI Solutions and tools for professionals Context and purpose

As an EU‑based security and privacy professional in DPO/CSO roles, this article documents serious technical and governance concerns about You.com’s reliability, privacy controls, and apparent disregard for core GDPR obligations when serving European users. The objective is threefold: to trigger internal discussion within You.com’s leadership and engineering teams, to warn EU users and privacy professionals about concrete risks, and to provide regulators with a structured basis for formal questions and potential investigation. The focus is not on shaming for its own sake, but on facts, observed behavior, and documented failures that any competent organization should already have addressed.
Technical failures and service reliability

From a security and risk management perspective, You.com’s basic service reliability is already below what would be acceptable for tools that process personal and sometimes highly confidential data. Forum logs and user reports show persistent failures in attachment handling (chats with uploaded documents generating errors while plain-text chats succeed), frequent “something went wrong” generation errors after only a few turns, and non‑functional or unstable creative/image generation features even when You.com has internally marked them as “fixed”. The iOS application reportedly crashes on dense chats, especially when multiple files are attached, leading to immediate session loss and undermining data integrity, while severe latency and context loss in longer conversations indicate that the platform struggles to maintain continuity and state for anything beyond trivial use.

These are not just UX annoyances; they directly undermine the “availability” and “integrity” components of the CIA triad, which GDPR’s security provisions require controllers and processors to ensure via appropriate technical and organizational measures. When a service cannot reliably maintain sessions, process attachments, or preserve context, it is difficult to accept assurances that more complex responsibilities—like correct access control, lawful data flows, or accurate privacy configurations—are being handled with the necessary rigor and state‑of‑the‑art safeguards.
Privacy controls that do not work

The most alarming issues relate to privacy features that either malfunction or appear to be designed in ways that monetize user data by default. You.com offers a “private” or “non‑permanent” mode that, in practice, still stores all chats, including at the time of writing, as confirmed by direct testing and timestamped evidence retained by the author. This is not a subtle corner case: a feature explicitly positioned as non‑permanent continues to persist conversation data, creating a direct contradiction between the user’s reasonable expectation and the platform’s actual behavior, and raising questions about fairness, transparency, and data protection by design and by default under GDPR.

In addition, user reports describe a configuration where “search disabled” is selected, yet prompts are still sent to web search providers, thereby exposing personal data to third‑party services against the user’s explicit instruction. There are also credible reports that “log out from all devices” only terminates the current session, leaving other devices active; combined with persistent data storage and a lack of a true always‑on “ghost mode”, this creates unnecessary attack surface for account compromise and unauthorized access to chat histories. Blocking access when users connect via VPN further pushes them to weaken their own network security posture merely to use the service, which is particularly troubling for professionals handling sensitive data.

Privacy guarantees are further fragmented by You.com’s product and pricing design: Zero Data Retention and “no model training” protections are reportedly reserved for an expensive enterprise tier, while Pro users—who are still very likely to process regulated or confidential information—receive no clear assurance that their prompts are excluded from training or analytics. This “paywalled privacy” model is incompatible with the spirit of GDPR’s data protection by default, particularly when the service targets professionals such as lawyers, doctors, academics, and corporate employees, for whom using the standard Pro plan could conflict with professional secrecy rules and contractual confidentiality.
GDPR questions for You.com

From an EU DPO/CSO standpoint, the following concrete questions should be answered by You.com’s management, legal, and engineering teams, and, if necessary, formally by the company in correspondence with EU supervisory authorities:

    Controller, processor, and role clarity
    Under GDPR, who is the controller for EU users’ chat content and metadata, and who are the processors and sub‑processors (including third‑party model providers like OpenAI, Anthropic, or others where applicable)? How is this clearly and accessibly communicated to EU users, and where is the full list of relevant recipients or categories of recipients kept up-to-date?

    DPO and EU representative identification
    If You.com is subject to GDPR (which it appears to be, given the provision of services to EU users), who is the designated Data Protection Officer, and what are their contact details as required by GDPR when an organization’s core activities involve large‑scale monitoring or processing of personal data? If You.com has no establishment in the EU, who is its appointed EU representative under Article 27, and why is this information not clearly and prominently available in the privacy documentation despite explicit user requests for DPO/EU‑rep contact being unanswered?

    Legal bases, retention, and private mode semantics
    On what legal basis does You.com process EU users’ prompts and chat histories for service provision, analytics, and model training, and how is this basis differentiated between the free, Pro, and Enterprise tiers? What are the concrete retention periods for chat data in normal and so‑called “private/non‑permanent” modes, and how is data actually deleted or irreversibly anonymized when users invoke privacy features or deletion requests?

    Data protection by design and by default
    How does You.com reconcile a “private mode” that still stores conversations, a “search disabled” setting that reportedly still triggers web search, and a “log out from all devices” control that does not terminate all sessions, with the GDPR obligation to implement privacy‑respecting defaults and effective technical and organizational controls? What testing, change management, and security assurance processes exist to prevent such regressions in privacy‑critical features, and have these issues been documented in any Data Protection Impact Assessment?

    Third‑party transfers and model providers
    When You.com routes EU user prompts to external model providers or search engines, what contractual and technical safeguards are in place (e.g. SCCs, regional processing guarantees, strict purpose limitation, and no training on EU data), and how are these explained to users in a way that is specific and comprehensible rather than generic boilerplate? Has You.com ever reported to an EU supervisory authority any incident in which prompts were sent to unintended third parties (e.g. due to “search disabled” malfunctioning), and if not, on what basis was this assessed as not constituting a personal data breach requiring notification?

Next steps with EU authorities

Based on the documented behavior and the absence of clear DPO/EU representative information despite explicit user attempts to obtain it, a formal complaint is being prepared to the Office of the Data Protection Ombudsman in Finland, with the expectation that other EU users may file similar complaints with their own national authorities. Such a complaint will reference this article, timestamped logs of private mode persistence, evidence of malfunctioning privacy controls, and the paywalled nature of key data protection guarantees, and will request that You.com be required to provide full clarity on roles, legal bases, retention, and technical safeguards for EU data.

EU supervisory authorities have the mandate to request detailed information from controllers, conduct investigations, and, where appropriate, order corrective measures or sanctions when they identify infringements of GDPR. The intention here is not to prejudge the legal outcome, but to demonstrate that, from a professional DPO/CSO perspective, You.com in its current state cannot be recommended for processing confidential or regulated EU personal data, and to invite regulators, privacy professionals, and users to scrutinize and challenge a model where privacy is both technically unreliable and commercially up‑sold rather than provided by design and by default.
Retention: 90 days Expires in: 88d 23h