Researchers at IMDEA Networks and Universidad Carlos III de Madrid spent May checking what nine AI assistants send out from their websites and Android apps: ChatGPT, Claude, Grok, DeepSeek, Gemini, Perplexity, Copilot, Mistral and Meta AI. All of them contact at least one outside advertising or tracking service. Six websites (ChatGPT, Claude, Gemini, Grok, Mistral and Perplexity) and three apps (ChatGPT, Claude and Perplexity) also hand other companies pieces of the conversation, such as its link, its title, the latest prompt or a screenshot, often with an identifier that ties it to a specific person.
The paper, accepted at the Privacy Enhancing Technologies Symposium (PETS), expands on May findings that covered four services. Spanish tech site Genbeta brought it back into the news on October 16 with responses from Google, OpenAI and Microsoft, all of which dispute the conclusions. The tests were run from Spain, so results elsewhere may differ. The researchers measured what leaves your browser or phone, not what companies do with it afterward, and their analysis does not rule on whether anyone broke the law.
What leaves the chat, and where it goes
A tracker is code from another company that a site or app loads to count visits, catch bugs or measure ads. Because it runs inside the page, it can read some of what is on screen and report it back. On a chatbot, that includes each conversation's link, which carries a unique code to reopen it, and the title the AI writes to summarize what you asked. That title alone can reveal a health worry or money trouble without anyone reading the chat.
It matters more when that data travels with a persistent identifier, a cookie or number that stays the same between visits and lets a company link the conversation to the rest of your activity. One example from the study is an email address turned into a fixed code, a hash, that any company already holding your address can generate and match.
Not every recipient is an advertiser. ChatGPT sends each conversation's ID to Datadog, an error-monitoring service, and Claude and Mistral send the chat link and the user's email to Intercom, their support tool. The study counts these as tracking because the data points to a person, but does not claim it ends up in ads.
Gemini sends the conversation title to Google Analytics, Google's own measurement tool, even when cookies are declined. Perplexity's Android app went as far as sending the user's prompt to Wingify, a design-testing platform.
Grok fared worst. Three assistants leaked no chat content
Grok's website sends each chat's link and title to seven third parties, including Meta, TikTok and Google Ads, along with the cookies Meta and TikTok use to recognize their users. That lets Meta tie a conversation to your Facebook or Instagram profile, if you have one. When a shared chat is opened, Meta and TikTok also get the latest prompt, and TikTok gets a screenshot. In the browser, all of this happened only after the user accepted non-essential cookies.
Grok is also the only service that leaves every conversation, free or paid, open by default to anyone with the link. The researchers planted trap links in their chats that alert them when visited and logged 70 visits from 14 countries, hours or days later.
At the other end, the study found no conversation content leaving DeepSeek, Copilot or Meta AI, though all three contact advertising services or send phone identifiers. DeepSeek even loads two Chinese fingerprinting services, which recognize a device by its characteristics instead of cookies. The researchers were unable to analyze Gemini's Android app.
This is not about ChatGPT's ads
ChatGPT started showing ads to Free and Go users in the US earlier this year and expanded them to 31 European markets on August 24. That is OpenAI's own system, inside the app, and OpenAI says advertisers never receive conversations.
The study looks at a different channel, outside companies' code loaded on the site or in the app, which runs whether or not there are ads. That is why it also shows up in Claude and Gemini, which have no ads, and why paying does not help, since paid accounts contacted almost the same third parties as free ones. On Datadog, OpenAI says, according to Genbeta, that it uses the analytics to understand traffic and fix errors, not for advertising or advertisers.
What changed since May
What is new in October is the reviewed paper, which covers nine services instead of four, adds the Android apps and counts 124 third-party domains owned by 44 organizations. Google says the report misreads how its products work and notes that Gemini has no ads. Microsoft says it found no violation of applicable law.
The May findings had already reached regulators. On May 27, Spain's data protection agency, the AEPD, asked the European Data Protection Board to circulate the study to every European regulator.
Some companies have made changes. Perplexity stopped sending conversation links to trackers such as Meta's on April 3, days after a class action was filed against it in the US. On August 15, OpenAI added third-party trackers to ChatGPT's privacy policy, though the authors cannot say their work prompted it. As of September 10, Grok's links were still open and xAI, warned in April, had not replied.
What you can do now, and its limits
Declining non-essential cookies, where a banner offers that choice, makes the biggest dent, and ignoring the banner had the same effect. In the study, 77.3% of web identifier transmissions to third parties happened only after cookies were accepted, and in Claude, declining kept Meta's tracker off and stopped events from being forwarded to 11 ad platforms. Even so, with cookies declined, 80.8% of trackers stayed active.
On all nine services, sharing a chat turns it into a page anyone can open without logging in, and those pages carried trackers from nine companies. Revoke shared links you no longer need, as we explain in our guide to removing shared Claude chats. On Grok, also switch off the public access that comes turned on by default.
Temporary modes do not stop this. On ChatGPT, the conversation ID still reached Datadog in a Temporary Chat, which skips your history but loads the same code in the page.
A browser that blocks trackers out of the box, such as Brave, cuts many of these connections, but it cannot touch data sent from the company's own servers. That covers Claude's event forwarding from an Anthropic domain and Grok's transmissions to Meta and TikTok through an intermediate server.
Phone apps have no cookie banner, because you must accept their terms to use them. Android lets you reset your advertising ID, but Grok and Perplexity send it with account or install numbers that never change, so the new ID can be linked back to the old one.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?