I don`t know how things are in USA or UK [1], but in EU this is relatively simple question.
Necessary data can be ”bleeded” aka. transferred to third party, even it is counted as PII, if they follow GDPR. And all major players do. Or so they say. It is matter of trust.
Hate to say this at loud, but I won’t trust any company, that is from China. And same thing with US-companies. Both parties have government issues big time, and need to make money in abroad style is heavy. Microsoft leaked/is leaking data to US, even they should keep it in EU.
Do I still use Amazon and OpenAI? Yes, because I must. But all my VPSes and most of S3 activity has been moved away from AWS. But my personal emails, and transactional ones from i.e. forum, are still handled by AWS.
All of my forum based AI activity is handled by OpenAI. I don’t trust them — but what are my options? I really dislike Microsoft connection, but things could be worse…
So, we as EU-admins are quite safe when we don’t ask passport copies or personal IDs, because Discourse as a platform handles its part quite good. And as long 3rd party declares that they follow GDPR and other regulation (same thing as with Google ads etc) ”bleeding” isn’t a legal issue.
But it is a moral issue for sure. That’s why we either use AI and at same trying to teach users, or not use at all. Those are options.
And in the big picture… AI in a forum is way smaller issue, in PII wise, than using Meta, 8.8.8.8 as DNS or commercial VPN-services (or record iPhone-calls using chinese servers… [2]).