AI Chatbot Privacy: Study Finds 6 of 9 Major AI Chatbots Share Conversation Data With Trackers
Tram cong nghe AI
AI chatbot privacy is weaker than most people assume. A research paper from IMDEA Networks, based on tests run in Spain in May 2026, found that 6 of 9 major AI chatbot websites send conversation data, such as chat titles, chat links, prompts or screenshots, to third-party advertising and tracking services. Rejecting cookies helps, but it does not stop most trackers.
Key Takeaways
- The study: “Prompt like a Butterfly, Sting like a Tracker,” by researchers at IMDEA Networks and an independent legal expert. It covers ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Mistral Le Chat and Meta AI.
- Every service contacted at least one advertising or tracking service. In total, the researchers counted 124 third-party domains from 44 organizations.
- Conversation data leaves the app: 6 of 9 web apps and 3 of 8 Android apps sent conversation-related data to trackers, often together with IDs that can identify you.
- Cookie banners only partly help: even after rejecting non-essential cookies, 80.8% of third-party trackers stayed active.
- Paying does not help: free and premium accounts talked to almost the same trackers.
- Grok stood out: its chats are public by default for free and paid users, and shared Grok links were opened 70 times from 14 countries.
What Did the AI Chatbot Privacy Study Test?
The researchers used each chatbot like a normal person would. They signed up, chatted, and created share links, on both the website and the Android app. To make the test realistic, the prompts played the role of a user asking about a medical condition, the kind of sensitive topic people often bring to AI.
They repeated the tests across guest, free and paid accounts, and across three cookie choices: ignoring the banner, rejecting non-essential cookies, and accepting all cookies. Then they inspected the network traffic to see what left the app and where it went.
Some key terms used below:
- Trackers (ATSes): advertising and tracking services, such as Google Ads, Meta Pixel or TikTok, that collect data about what you do online.
- Conversation artifacts: data about your chat. This includes the chat’s link (permalink), its AI-generated title, your latest prompt, or a screenshot.
- Hashed email: a scrambled version of your email address. Trackers can compute the same hash for known emails, so it still works as an ID.
What AI Chatbots Share With Trackers
Conversation data sent to third parties
| Data type | Web apps leaking it | Trackers receiving it (web) |
|---|---|---|
| Conversation link (URL) | 5 | 9 |
| Conversation title | 3 | 9 |
| Shared conversation link | 5 | 9 |
| Your prompt | 1 | 2 |
| Conversation screenshot | 1 | 1 |
Titles matter more than they seem. Chatbots write a short summary title for each chat, so a title like a health question can reveal your interests, worries or medical concerns. Three web apps sent titles to nine third parties, including Meta, TikTok and DoubleClick (Google’s ad network). In 8 of those 9 cases, it only happened after the user accepted non-essential cookies.
Service by service highlights
| Service | What the researchers observed |
|---|---|
| Grok (xAI) | Sent chat link and title to 7 trackers, including Meta, TikTok, Google Ads and Twitter Analytics, after cookies were accepted. Meta Pixel linked them to the user’s Meta cookie. On shared chats, TikTok collected screenshots, and Meta and TikTok collected the latest prompt. |
| Claude (Anthropic) | When cookies were accepted, a server-side setup forwarded user events to eleven ad platforms, including Facebook, LinkedIn, TikTok, Reddit and Google. Ad blockers cannot block this kind of forwarding. Rejecting cookies stopped it. The web app also sent conversation IDs to Datadog. The Android app sent location and the Android ID to Sift Science. |
| ChatGPT (OpenAI) | The web app sent the conversation ID, which can rebuild the chat link, to Datadog with user IDs. It connected to Google Ads even when cookies were rejected. |
| Perplexity | Sent hashed emails to the marketing company Singular, and emails to RevenueCat on Android. Guest chats are always public. It stopped sharing chat links with Meta on April 3, 2026, possibly due to a U.S. class action. |
| Gemini (Google) | Sent conversation titles to Google Analytics. |
| Mistral Le Chat | Sent chat link, title, email and user ID to Intercom, a customer support service. |
| DeepSeek | Used little-known Chinese services, Fengkong Cloud and ShuMei, that public reports link to device fingerprinting. |
Perplexity, DeepSeek, Gemini, Copilot, ChatGPT and Claude all connected to Google Ads even under “reject all” cookies.
Your chats can be linked to your identity
Leaked chat data is much more dangerous when it comes with an ID. The study found:
- Ad cookies such as Meta’s _fbp and TikTok’s _ttp sent along with chat data. For Grok, one payload carried both, which lets the two platforms connect the same person.
- Hashed emails sent by Perplexity to Singular, and by Grok’s app to TikTok and Twitter Analytics.
- Android advertising IDs sent to Adjust (Copilot), AppsFlyer (Grok) and Singular (Perplexity), sometimes with permanent user IDs. This means resetting your ad ID may not break the link.
Are Shared AI Chats Public?
Yes. Every service tested lets anyone open a shared chat link without logging in, and nine third parties were present on those shared pages.
Grok goes further. Its normal chat links are public by default for free and paid users, unless you opt out. The researchers hid special “canary” links inside chats and uploaded files. Grok’s links were opened 70 times from 70 IP addresses in 14 countries, hours to days later, with 65.7% of visits coming from the U.S. even though the tests ran in the EU. The researchers told xAI on April 17, 2026. As of September 10, 2026, Grok still used public chat links, and xAI had not responded.
Perplexity’s crawler also opened canary links repeatedly, even when the prompt told it not to.
Why AI Companies Share This Data
The paper ties this to advertising. It cites a Reuters report that OpenAI partnered with Criteo for an ad pilot with free ChatGPT users in the U.S. in early 2026. Roughly 95% of ChatGPT users are on free plans.
The authors say most issues are intentional product choices, not security bugs. Only Grok’s weak access controls were treated as a vulnerability. They reported their findings to EU and UK data protection authorities on April 13, 2026. Spain’s regulator, the AEPD, cited the work in a request to escalate the investigation to the European Data Protection Board. The paper argues several practices sit in tension with Europe’s GDPR and ePrivacy rules, but it does not claim a final legal verdict.
How to Protect Your AI Chatbot Privacy
Based on the study’s findings, here is what you can do:
- Reject non-essential cookies. It does not stop everything, but for Claude it blocked Meta Pixel and the forwarding to eleven ad platforms. Many title leaks only happened after accepting cookies.
- Avoid sharing chat links. Every service makes shared chats public. If you shared one, revoke it. All tested services let you do that.
- Check Grok’s sharing setting. Its chats are public by default, so opt out if you use it.
- Don’t trust incognito or paid plans alone. Several leaks still happened in incognito mode, and premium accounts saw the same trackers.
- Use a privacy browser. Browsers like Brave block many trackers by default. The authors warn that server-side tracking can get around this.
- Think before typing sensitive details. Health, money and personal problems are exactly the data that titles and prompts can expose.
On mobile, apps have no cookie banner at all. Accepting the terms of service is required, so your options are more limited.
Is AI Chatbot Privacy Getting Better?
There are small signs of change. OpenAI added marketing cookie controls and updated ChatGPT’s privacy policy on August 15, 2026 to mention third-party trackers. Perplexity stopped sending chat links to Meta.
But the bigger picture is not great. The researchers say AI chatbots have inherited the web’s tracking system and fed it something more personal: our conversations. Their results are a snapshot from May 2026 and a lower bound. Server-side sharing they could not see may add more.
AI Chatbot Privacy FAQ
Do AI chatbots share data with advertisers?
According to this study, 6 of 9 major chatbot websites sent conversation data like titles or links to third-party trackers, including ad platforms such as Meta, TikTok and Google Ads.
Does rejecting cookies protect my AI chatbot privacy?
Partly. It reduced data sharing in several services, but 80.8% of third-party trackers remained active after rejecting non-essential cookies.
Is ChatGPT Plus more private than free ChatGPT?
Not in terms of trackers. The study found free and premium accounts across services used nearly identical third parties.
Are my Grok conversations public?
By default, yes. Grok chat links for free and paid users are publicly readable unless you opt out.
Which chatbots were tested?
ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Mistral Le Chat and Meta AI, on web and Android.
Sources
- Oliveira et al., Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents (PDF)
- Hacker News discussion
Last updated: October 7, 2026
