AI Chatbot Privacy Warning: ChatGPT, Claude, Gemini, Grok and Perplexity May Share More Than You Think
A conversation with an AI assistant can feel personal, private and almost sealed off from the outside world. You ask about your finances, health, work problems, legal worries or private plans, and the chatbot responds as if you are in a one-on-one exchange. But new research suggests that some of those conversations may leave behind a much wider data trail than many users realize.
Researchers at the IMDEA Networks Institute in Madrid examined nine popular AI assistants in web browsers and eight of them as Android apps. The services tested included ChatGPT, Claude, Gemini, Grok and Perplexity. Their findings show that every service contacted at least one advertising or analytics company. In total, the researchers identified 44 third-party companies receiving data from these AI tools.
Even more concerning, six of the nine web versions and three of the eight Android apps sent pieces of conversation-related information to outside trackers. That data could include shared chat links, AI-generated chat titles or, in some cases, text typed by the user.
The tests were carried out in Spain in May 2026. The research paper has been accepted for the Privacy Enhancing Technologies Symposium and is expected to be published in July 2027.
What data can reach trackers?
The most common information passed to trackers was the link to a shared AI conversation. At first glance, a chat link may not sound especially sensitive. But depending on the platform and sharing settings, anyone with that link may be able to open and read the full conversation.
According to the study, chat links were shared by five web versions, including ChatGPT, Claude and Grok. Some services also passed along AI-generated conversation titles. Grok, Gemini and Mistral’s Le Chat were found to send chat titles, which are usually created automatically based on the user’s first prompt.
That matters because a title can reveal a lot. If a user asks an AI assistant for help comparing salary details with mortgage affordability, the automatically generated title may summarize that sensitive topic clearly. A short title can expose the subject of a private conversation without needing the full transcript.
Grok showed the most aggressive data sharing behavior in the study. On shared pages, it sent a screenshot, the latest user prompt, the conversation link and the title to trackers associated with Google, Meta and TikTok. Perplexity’s Android app was also found sending user-typed text to a testing service called Wingify.
The researchers also found that this data was often transmitted alongside account-related identifiers, such as a hashed email address. While hashing can make the original email less obvious, it may still allow companies to connect user activity across multiple services and build broader profiles.
Aniketh Girish from the IMDEA research team said most users would have no clear way to know this kind of data sharing is happening because there is usually no visible warning inside the AI assistant interface.
Do trackers actually read your AI chats?
The researchers emphasized that they do not have evidence showing that third-party recipients manually read users’ conversations. However, they did test how far shared links could travel by placing special links inside AI chats and monitoring access.
The results showed that some links were opened after submission. On Grok, the planted links were opened 70 times from machines in 14 countries, sometimes days later. Claude, Copilot, DeepSeek and Le Chat each fetched the links only once, shortly after submission.
The key privacy concern is not only whether someone is reading the content right now. It is that shared chat links, prompts, titles and identifiers can move through systems users do not see and cannot easily control. Once a conversation link leaves the original service, the user has limited visibility into where it goes next.
Rejecting cookies helps, but it does not solve everything
Many users assume that rejecting cookies is enough to protect their privacy. The study shows that refusing cookies does reduce tracking, but it is not a complete solution.
About three quarters of the identifiers observed in the research were only sent to third parties after users clicked “Accept all.” That means rejecting cookies can significantly reduce the amount of data shared.
For example, rejecting cookies on Claude stopped the Meta pixel and also blocked server-side forwarding to about 11 services through Anthropic’s own servers. This is important because server-side tracking is harder for users to block. A browser ad blocker can stop many scripts running on your device, but it usually cannot block data that a company forwards from its own servers.
However, the study found that rejecting cookies still left 80.8% of trackers active. Four of the nine free services continued collecting data even after rejection. Six of the nine services still contacted Google Ads.
Paid plans did not completely remove tracker activity either. The researchers found stronger privacy controls in some paid tiers, but the presence of trackers remained a concern, especially because most users rely on free versions.
Android users face another privacy risk: the advertising ID
On smartphones, the Android advertising ID can make tracking more persistent. This identifier is used by advertising networks to connect activity across apps.
The study found that Perplexity, Grok and Microsoft Copilot sent the Android advertising ID to third parties. This can allow outside companies to connect AI assistant activity with other app usage.
Android users can reduce this risk by deleting the advertising ID. On Android 12 and newer, this option is usually found in Settings, then Privacy, then Ads, then Delete advertising ID. After deletion, apps should only receive a string of zeros instead of a usable identifier.
The study also noted that DeepSeek and Meta AI did not share conversation content with outside trackers during testing. However, DeepSeek used Chinese fingerprinting services, while Meta AI sent the Android ID to Meta’s own servers.
Shared AI chats are one of the biggest privacy risks
Shared conversations deserve special attention. With major AI assistants, a shared link may allow anyone who has it to read the conversation. That can be useful when you want to show someone a result, but it can also create a long-term privacy problem.
If you have shared AI chats in the past, it is worth reviewing and deleting old links. ChatGPT provides shared link management under Settings, then Data controls, then Shared links. Claude stores shared chat controls under Settings, then Privacy, in the Shared chats area. Users can also change a Claude chat back to private through the Share menu.
Gemini and Grok also provide areas where shared links can be reviewed and removed. For Perplexity, the researchers recommend setting threads to Private in the sharing settings.
Deleting a shared link can stop new visitors from opening it, but it cannot erase copies, screenshots or saved versions that others may already have made. For sensitive topics, the safest approach is not to create a shared link in the first place.
Why this matters for AI privacy and data protection
The researchers reported their findings to European data protection authorities in April. The Spanish data protection authority later raised the issue at the European Data Protection Board in June.
The study highlights two major concerns under the GDPR. First, privacy policies may mention advertising partners but not clearly explain that conversation-related data can be sent along with tracking information. Second, the researchers question whether there is a valid legal basis for sending this type of AI chat data to third parties.
According to the authors, none of the providers had issued an official response at the time covered by the study. Perplexity reportedly removed the Meta pixel in April, likely in response to a separate legal dispute in the United States. OpenAI updated its privacy policy in mid-August to mention third-party trackers. Grok was still sending publicly accessible links in September, according to the research.
How to protect your AI conversations
If you use AI assistants regularly, treat every prompt as potentially sensitive. Avoid entering personal medical details, financial records, passwords, private business information or legal documents unless you fully understand the privacy settings of the service.
Reject cookies whenever possible instead of accepting all tracking options. Use privacy-focused browser settings and consider an ad blocker, while remembering that server-side tracking may still happen outside your device.
Review old shared AI chat links and delete anything you no longer need. Be especially careful with conversations about health, money, relationships, work, legal issues or identity documents.
On Android, delete or reset the advertising ID to limit cross-app tracking. Also review app permissions and consider using AI tools in a browser with stricter privacy controls rather than through mobile apps that may send additional identifiers.
Finally, check whether your AI assistant offers an option to opt out of model training. But do not assume that opting out of training stops all tracking. The study shows that training data and tracker data are separate privacy issues. Even if your conversation is not used to improve an AI model, metadata, links, titles or prompts may still be shared with outside systems.
The bottom line is simple: AI chatbot privacy is more complicated than it appears. ChatGPT, Claude, Gemini, Grok, Perplexity and other AI assistants can be useful tools, but users should not treat them like private diaries. If a conversation is sensitive, think carefully before typing it, sharing it or leaving it stored in a publicly accessible link.
