Study: All Nine Major AI Chatbots Share Conversation Data With Trackers

Researchers at IMDEA Networks and UC3M have published a privacy analysis of nine leading conversational AI services across web and Android clients. The paper, “Prompt like a Butterfly, Sting like a Tracker”, was measured in Spain in May 2026 with Chrome developer tools and an instrumented Pixel 3a running Android 12. The services studied were ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Mistral Le Chat and Meta AI.

Every service contacts a tracker

The authors attribute 124 third-party domains to 44 organizations, 34 of them advertising and tracking services. Every service contacted at least one such partner, and Google has the widest footprint. They also found trackers missing from known databases, such as Fengkong Cloud and ShuMei, which DeepSeek's clients contact. On mobile, 71% of the endpoints called come from in-app WebViews.

Conversation content reaches third parties

The central finding: conversation content travels with the tracking data. Six of the nine web clients and three of the eight Android clients disclosed conversation URLs, titles, prompts or screenshots to third parties, often with persistent identifiers such as advertising cookies, account IDs or hashed emails. Five web clients handed conversation permalinks or global conversation identifiers to nine tracking services, three of them by default.

Grok is the most exposed: a Google Tag Manager container routes the conversation URL and the AI-generated chat title straight to Meta's Conversions API and TikTok's Events API. Claude's Segment setup forwards events to eleven ad platforms, and Perplexity sent hashed emails to Singular.

Rejecting cookies only partly helps

Consent banners changed less than users might assume: even in the “reject all” scenario, Perplexity, DeepSeek, Gemini, Copilot, ChatGPT and Claude still connected to Google Ads, and 80.8% of third-party trackers stayed active. Mobile offers no equivalent control, and subscription tier made little difference either.

Public permalinks and a legal question

Access control proved another weak point. Grok's free and paid permalinks are readable by default, Perplexity always makes guest conversations public, and as of 10 September 2026 Grok's links were still open. Canary tokens confirmed follow-up access only for Grok: 70 activations from 70 IP addresses across 48 autonomous systems in 14 countries.

The paper reads the practices against the ePrivacy Directive and the GDPR, whose Article 5(3) requires prior consent for advertising and analytics cookies. OpenAI, Anthropic, Perplexity and xAI describe the transfer of prompts to third parties only in generic terms. The team notified European and UK data protection authorities on 13 April 2026 and xAI on 17 April. Spain's AEPD cited the work on 27 May, asking European regulators to examine the issue.