Want a private ChatGPT alternative? How Proton's Lumo 2.0 locks down your data, EU style

Proton Bets on Privacy as Its AI Differentiator

Proton, the Swiss company best known for encrypted email and VPN services, has released Lumo 2.0, an upgraded version of its AI chatbot positioned as a privacy-first alternative to ChatGPT, Gemini, and Copilot. The core pitch is simple: unlike mainstream chatbots that often train on user conversations to improve their models, Proton says Lumo never uses customer data for training and builds its data-handling practices around European privacy norms rather than the more permissive defaults common in the US.

Why This Matters Beyond One Product

The launch lands at a moment when AI governance is diverging sharply across regions. The EU AI Act is entering its enforcement phase, with obligations phasing in for general-purpose AI providers around transparency, risk management, and data governance. Companies operating in or selling into the EU increasingly need to demonstrate compliance, not just claim it. A tool like Lumo, built by a company whose entire brand rests on privacy credentials from GDPR-era products like ProtonMail, is effectively marketing itself as an AI Act-friendly option by design rather than as an afterthought.

This matters because most large language model providers have historically treated user prompts as valuable training fodder, a practice that sits uneasily with GDPR's principles of data minimization, purpose limitation, and user consent. If Proton's no-training claim holds up under scrutiny, Lumo could serve as a template for how AI products get built when privacy regulation, rather than engagement metrics, is the primary design constraint.

The US Contrast

The timing also highlights a widening policy gap with the United States, where AI regulation remains fragmented and largely voluntary at the federal level, with individual states experimenting with their own rules on data use and AI transparency. American AI vendors have faced criticism and lawsuits over training data provenance and consent, but comprehensive federal privacy legislation comparable to GDPR still doesn't exist. Proton's move suggests European-style regulatory pressure, often dismissed as burdensome, can also become a competitive selling point, particularly for enterprise customers and privacy-conscious consumers wary of contributing to model training without clear consent.

What to Watch

The real test for Lumo 2.0 will be independent verification: audits, transparency reports, and how Proton handles requests from regulators or law enforcement. Privacy claims from any single vendor deserve scrutiny rather than automatic trust. But as AI safety policy discussions increasingly center on data governance as much as model behavior, Proton's bet signals that "privacy by design" may become a meaningful market segment in an AI landscape otherwise dominated by data-hungry incumbents.