AI Chatbots Exposing Private User Data to Tracking Firms

• AI chatbots are leaking sensitive conversation data—including chat titles, user prompts, and links—to third-party advertising and tracking companies.
• A study by the IMDEA Networks research institute found that six out of nine major AI services transmit user data to firms like Google, Meta, and TikTok.
• Privacy settings, such as rejecting non-essential cookies, failed to block tracking for 80.8% of the observed third-party trackers.

Scope of Data Exposure

• The study analyzed ChatGPT, Claude, Perplexity, Grok, Gemini, Mistral AI, Meta AI, DeepSeek, and Microsoft Copilot.
• Risks identified include:
  • Chat Titles: Often summarize intimate topics like health issues or financial details, revealing personal interests.
  • Chat Links: Can provide third parties access to entire conversation histories.
  • Identifiers: Transmission of user IDs and email addresses allows advertisers to cross-reference chat logs with existing personal profiles.

Findings on xAI's Grok

• Grok transmits chat titles and links to third-party providers by default.
• In "shared" conversations, researchers observed even more extensive data leakage, including the transmission of chat screenshots to TikTok.
• Bait links embedded in shared Grok conversations were accessed 70 times from 14 different countries.

Regulatory and Corporate Response

• Researchers reported their findings to European data protection authorities in April 2026; the Spanish AEPD has requested a review by the European Data Protection Board.
• OpenAI recently announced plans to use data from ChatGPT conversations for personalized advertising in Europe, prompting concerns from privacy regulators.
• Google stated that its tracking tools are used for technical performance monitoring, while xAI, Mistral, and Perplexity did not respond to requests for comment.