The $19 Pause Button for Lawyers Who Paste Into ChatGPT

The Lawyer Pasting Client Files Into ChatGPT

Don't build another PII redactor. Build the preflight layer that lets solo lawyers use consumer AI without casually handing over client identifiers.

A family lawyer opens ChatGPT. She pastes in an email from a client and asks for a cleaner reply. The email contains the client's name, the spouse's name, both children's names, a custody schedule, the county where the case is pending, a medical diagnosis and the last four digits of a bank account.

The AI hands back a usable draft in ten seconds. Somewhere between "paste" and "send," she has created a confidentiality problem she may not know she has.

That scene stopped being an edge case a while ago. Lawyers have moved from experimenting with AI to depending on it, and the governance around that dependence hasn't kept pace. The lag between the two is what you'd be selling into.

The short version, before the evidence:

Adoption outran governance

8am's 2026 Legal Industry Report, published March 5, 2026 from a survey of more than 1,300 legal professionals, found that 69% now use general-purpose AI tools such as ChatGPT, Gemini or Claude for work, up from 31% a year earlier. The top uses are the ones that carry client facts: drafting correspondence (58%), general research (58%), brainstorming (54%) and summarizing documents (47%). The same survey found 54% of firms had provided no responsible-AI training and had no plan to, and only 9% had a written, actively enforced AI policy. The barriers respondents named were data security (46%), ethics (42%) and privilege (39%).

Clio's 2026 Legal Trends for Solo and Small Law Firms, released in May 2026, sharpened the picture for the exact customer this idea serves. 71% of solo practitioners and 75% of small firms use AI to complete legal work. 47% of solos and 48% of small firms use consumer-grade tools like ChatGPT or Microsoft Copilot rather than legal-specific systems. And 57% of solos and 55% of small firms have no written AI policy at all. With 1.37 million lawyers in the U.S. and roughly half of private practitioners working solo, that is a broad market by any standard.

Why September 2026 made this urgent

On September 14, 2026, 404 Media reported on an internal OpenAI program called Project Lily, under which hundreds of contractors, paid more than $50 an hour, read real ChatGPT conversations and rate the model's responses. Reviewers can see whole conversations containing sensitive personal information, and some assignments display a "user memories summary" above the prompt describing what the user has previously asked and, in some cases, where they may live. OpenAI said it tries to strip personal data before review and acknowledged sensitive details can still get through. Switching vendors doesn't escape the pattern: Anthropic confirmed to 404 Media that it also uses human review to improve Claude.

Contractors aren't reading every conversation. Even so, the story lands because it shows how little consumer AI resembles Microsoft Word: the privacy controls form a decision tree rather than a checkbox. Turning off "Improve the model for everyone" stops new conversations from being used for training, though conversations already eligible before the toggle was flipped stay eligible. Temporary Chats are excluded from training and retained up to 30 days for safety review. But OpenAI's own help documentation warns that a thumbs up or down on a conversation can put the entire conversation back into training even with the setting off. Business products are a different regime: OpenAI does not train on inputs or outputs from ChatGPT Business, Enterprise, Edu or the API by default.

Before pasting, a careful lawyer would ask: which product am I on, what are its current practices, what am I sending, do I have authority to send it, can these facts identify my client with the name removed, does my firm have a policy, and what gets retained? Nobody with a 10:41 a.m. deadline walks that tree from memory. Software can collapse it into a habit, and that is the job this product takes on.

The heist sits one level above redaction

The obvious startup is "install this extension and we'll redact PII before it reaches ChatGPT." Skip it. Several versions already exist, and they've set the price ceiling. Caviard is a free Chrome extension that redacts more than 100 PII types locally in ChatGPT and DeepSeek. PrivacyScrubber sells local prompt and document sanitization, including a legal profile and offline PDF OCR, for $15 a month or $110 lifetime. anonym.legal runs a server-side anonymization API covering 285-plus entity types from free up to €29 a month. At the enterprise end, Nightfall's browser DLP scans 100-plus data categories across ChatGPT, Claude, Gemini and Copilot and blocks the prompt outright.

Even the hold-and-screen mechanic is proven: Locke, an open-source Chrome extension from Sonomos, holds requests to ChatGPT, Claude, Gemini, Grok and Perplexity until a local desktop app screens them, then allows, redacts or blocks each one. Nobody has put a matter-aware layer on top of it. Detection has become a feature, so your wedge has to sit above it.

That layer is a matter-preflight layer for small law practices: software that catches client identifiers locally before a prompt leaves the browser, preserves the relationships that make the prompt useful, forces a five-second human review, and writes a minimal record proving a confidentiality check happened. Around it sit the things a generic privacy tool will never build: family-law rules, immigration identifiers, matter dictionaries, AI-use policies and client-consent workflows. The promise stays narrow. We reduce accidental disclosure of direct client identifiers and help your firm run a more defensible AI-use process. Never "your prompts are now confidential." Everything that follows depends on keeping the promise that narrow.

A generic redactor sees `Jane Miller` and returns `[PERSON_1]`. A lawyer-first preflight reads the same prompt as a matter:

`Jane Miller` → `[CLIENT_01]` `Robert Miller` → `[OPPOSING_PARTY_01]` `Ava Miller` → `[MINOR_CHILD_01]` `Robert` and `Mr. Miller` → stay mapped to `[OPPOSING_PARTY_01]` `Docket 2026-FC-1948` → `[MATTER_01]` `every other Saturday at 9 a.m.` → flagged as potentially identifying context

Then, before anything leaves the browser:

Client information detected. 3 direct identifiers masked. 2 matter identifiers masked. 1 potentially identifying fact remains. Review before sending.

What you're selling is a professional moment of friction, the way Grammarly stops you at the typo before the email goes out. Here the stop lands on the fact a lawyer should have paused over.

The ethics rulings sell it and set the trap

ABA Formal Opinion 512, issued July 29, 2024, told lawyers that generative AI triggers their existing duties of competence, confidentiality, communication, supervision and reasonable fees. On confidentiality it went further: for self-learning tools where client input could resurface in later output, a client's informed consent is required before entering information about the representation, and boilerplate language in an engagement letter is not adequate. Florida's Opinion 24-1 and North Carolina's 2024 Formal Ethics Opinion 1 followed with the same instruction to obtain consent, write oversight policies and find out what the vendor retains.

A federal court has since applied the same logic in a real case. In United States v. Heppner, decided in the Southern District of New York on February 17, 2026, Judge Rakoff ruled on a fraud defendant who had used Claude to process what he learned from his counsel and to draft defense-strategy memos. The court held those AI documents were protected by neither attorney-client privilege nor work product: "Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege." It also found that by consenting to Anthropic's consumer privacy policy, Heppner had no reasonable expectation of confidentiality. Heppner was the client in that case. A lawyer pasting the same facts has no better argument, and the privacy policy she clicked through is the document the court will read.

Those rulings create demand, and they also set the biggest trap a founder can walk into: never sell "ABA compliance." Your extension has no way of knowing whether `[CLIENT_01]` plus 700 words about an unusual custody dispute still identifies the client. It doesn't know the lawyer's jurisdiction, it can't vet the vendor, and it can't turn a consumer account into an enterprise environment. Pseudonymized text also remains re-identifiable through unique facts, dates, relationships and uploaded documents, which is why tokenization falls well short of anonymization.

So write the limits into the product itself, right under the green "Preflight complete" message:

This check reduces direct-identifier exposure. It does not determine whether submission is ethically permissible, confidential, privileged, anonymous or compliant with professional rules.

A security product that states what it can't secure is more credible than one promising a magic green shield, and credibility is the entire sale to this audience. It also decides where you launch.

Start with family law

"Privacy for professionals" puts you up against every privacy extension on earth. "AI Preflight for Family Law" puts you in a room where nobody else is standing.