Libraries have always taken patron privacy seriously — borrowing records, search history, reference questions, and the small details people share when they need help.
AI adds new places where that information can leak, sometimes without anyone intending it.
A few things are worth making explicit:
–
*Never paste patron data into public AI tools.* Names, borrowing histories, reference questions linked to identifiable people — none of these should go into a free ChatGPT or Claude chat unless your institution has the appropriate data protection arrangements in place. –
*Know where your chatbot data goes.* If your library has a patron-facing chatbot, check whether conversations are logged, how long those logs are retained, who can access them, and whether they are used for model training. Vendor policies differ, so this deserves more than a quick skim of the terms. –
*Anonymise before analysing.* If AI is being used for collection development, usage analysis or staffing patterns, remove identifying information first. Look at aggregate circulation figures rather than individual borrowing histories. –
*Understand the privacy tier you’re actually paying for.* Institutional and enterprise plans can have different data-handling terms from free consumer accounts. If AI is becoming part of regular library work, privacy requirements should be part of the budget discussion, not an afterthought. –
*Train staff before they start experimenting.* A well-meaning staff member pasting a difficult reference query — along with enough patron detail to identify the person — can create a privacy problem very quickly. A simple policy and practical training can prevent many such mistakes. –
*Treat AI vendors like any other third-party service.* If your library would not hand patron records to an unvetted external company, the same question should be asked of an AI provider. –
*Put the rules in writing.* Even a one-page AI policy can make a big difference. Staff should know what information may be entered into an AI tool, what must stay out, and when approval is required.
Patron trust took decades to build in librarianship.
We should be careful not to spend it casually while adopting new technology.
*Has your library drafted an AI policy yet? What made it into the final version?*