I work in AI and the data practices I see internally are not what the public statements describe, what do I do with that?

I am going to be deliberately vague because I need to be. I work at a company that develops AI products. The public-facing statements about how user data is handled, what is retained, what is used for training, are not an accurate description of what I see internally. The gap is not trivial.

I am not in a position to go public. I have a mortgage and a family and I am not naive about what happens to people who do. But I also find it difficult to sit with the knowledge that users are making decisions about what they share based on information that is not accurate.

I am asking specifically: what legitimate channels exist for raising concerns about data practices at AI companies? Are there regulatory bodies that take this seriously? Are there lawyers who work in this space? I want to understand what options exist before I decide whether to use any of them.