# Study finds chat data reaching trackers in several AI services
> A May 2026 study of nine conversational AI services found chat details reaching third-party trackers in specific tested flows. Consent and sharing settings changed some exposures, but did not erase every flow.
By BIGCHANGE.AI Editorial
Published: 2026-09-29T12:50:31.966Z
Updated: 2026-09-29T12:50:31.966Z
Canonical: https://bigchange.ai/blog/conversational-ai-apps-ad-trackers-privacy-study
AI-generated conceptual illustration by BIG CHANGE.
A systematic study of nine conversational AI services found third-party advertising and tracking services receiving conversation details, including chat URLs and titles, prompts, and a screenshot. The researchers tested web clients for all nine services and Android apps for eight in May 2026. Their results show how tracking can reach beyond ordinary browsing data, while also showing that exposure varied by service, platform, consent choice, and whether a conversation was shared.
## The big change
- **What changed:** The study measured third-party tracking across conversational AI websites and Android apps, including transfers of information derived from chats.
- **Why it matters:** In some tested flows, tracking services received material that described or reproduced parts of a conversation, sometimes alongside identifiers that could link activity to a user or device.
- **What users can check:** On the web, rejecting non-essential cookies reduced some transfers, but did not eliminate tracking across the sample. Review current privacy controls and sharing defaults for the service and app you use.
## What the researchers measured
The paper, “Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents,” is listed by the IMDEA Networks repository as refereed and in press for the Privacy Enhancing Technologies Symposium (PoPETs) 2027. The repository gives July 19, 2027 as its issue date; the deposited paper’s DOI is still a placeholder. The researchers conducted their experiments in Spain in May 2026, so the findings describe those tested versions and settings, not necessarily the services today.
The sample covered ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Mistral’s Le Chat, and Meta AI. The team recorded web traffic in Chrome and examined Android apps using static analysis and an instrumented Pixel 3a running Android 12. They tested guest, free, and premium accounts where available, and different web cookie-consent choices. On Android, they noted that apps generally did not present an equivalent cookie banner at launch. The researchers used accounts they controlled and prompts they wrote; BIG CHANGE did not repeat the tests.
Across the sample, the paper identifies 44 third-party organizations contacted through 124 distinct domains; it classifies 34 organizations as advertising and tracking services. Every AI service integrated at least one organization in that category. The researchers report that during ordinary interactions, six of nine web clients and three of eight Android clients sent conversation-derived artifacts to third parties. The types of information and recipients differed by service and platform.
On the web, five services sent conversation URLs or IDs to tracking services, and three sent automatically generated conversation titles. A title can reveal the topic of a chat even if the full text is absent. The paper also records a prompt sent by one web client and one by an Android client, plus a screenshot sent by one web client. In its separate test of shared conversations, the researchers observed Meta and TikTok receiving the latest prompt from a Grok share page; TikTok also received a screenshot. These are specific observed flows, not evidence that every chat or every user was exposed.
Some transfers appeared alongside identifiers. The paper describes web cookies and account or device identifiers, as well as Android advertising IDs and email-derived hashes sent to certain services. Such combinations can make it easier to associate activity across sessions. The researchers document the fields and destinations they observed; those network observations do not, by themselves, establish why a provider or recipient used each field.
## Consent and sharing changed some results
Rejecting non-essential cookies reduced some web tracking. Still, the researchers observed third-party data collection in four of the nine free-tier services under the reject-all setting. They found no clear difference between free and premium tiers in third-party data collection. Accepting non-essential cookies activated additional services in some web clients. The study did not find an equivalent web cookie-consent mechanism across Android apps, so those app measurements should not be read as a test of the same choice.
The team also examined links to shared conversations. Each service offered a way to create a public link when a user chose to share a chat. Separately, the paper reports that Grok’s free and premium conversation links were publicly accessible by default with an opt-out, while Perplexity guest conversations were public. A link that opens without authentication can expose its contents to whoever has it; a public sharing feature is distinct from an ad tracker receiving a chat field during an ordinary session.
To probe later access, the researchers embedded unique test URLs in prompts and uploaded files. They recorded 70 activations associated with Grok, from 70 IP addresses across 14 countries and 48 autonomous systems, hours to days after submission. The experiment indicates that submitted URLs were fetched by external infrastructure. It does not establish that a particular advertising company read the full conversation. The authors also caution that a lack of observed activations for other services would not prove that no access occurred.
## What users can take from it
For web users, rejecting non-essential cookies may limit some tracking, but the study found that this choice did not remove every third-party flow. Before using a sharing feature, check whether the link will be public and whether you can revoke access. Review the service’s current privacy settings and the permissions granted to its Android app; the study found platform-specific behavior and does not establish that one setting works across every service.
The paper’s scope is limited to nine popular consumer services, excludes enterprise and government tiers, and uses black-box measurements of selected interactions. Dynamic analysis can miss behavior, and the authors could not extract traces for Gemini’s Android app. The paper’s legal discussion identifies questions under EU privacy law but explicitly does not determine compliance. Its tests were conducted in May, so users should treat the results as a documented snapshot rather than a live audit.
This study answers a different question from BIG CHANGE’s [guide to first-party AI privacy settings](https://bigchange.ai/blog/ai-privacy-controls-training-memory-sharing) and its reporting on [a separate OpenAI incident involving 53 user images](https://bigchange.ai/blog/openai-agents-chatgpt-user-images-disclosure). Here, the contribution is a cross-service measurement of third-party data flows and how those flows changed across web, Android, consent, account tier, and sharing conditions.
## Sources & further reading
- [IMDEA Networks repository record and paper PDF](https://dspace.networks.imdea.org/handle/20.500.12761/2073?show=full). The repository supplies the paper’s title, refereed and in-press status, conference metadata, abstract, and open-access PDF. The measurements and limitations above come from the deposited paper, especially its methods (§4), tracking results (§5), privacy analysis (§6), and limitations (§8.1). Its future proceedings date and placeholder DOI mean this is an accepted/in-press paper, not a final published proceedings record.
- [BIG CHANGE: AI privacy settings](https://bigchange.ai/blog/ai-privacy-controls-training-memory-sharing). Background on first-party controls such as model-training choices, memory, and sharing; it does not audit third-party tracker traffic.
- [BIG CHANGE: OpenAI’s report of 53 images exposed in an agent incident](https://bigchange.ai/blog/openai-agents-chatgpt-user-images-disclosure). A separate incident, not part of this nine-service systematic study.
## Sources
- [IMDEA Networks repository record and paper PDF](https://dspace.networks.imdea.org/handle/20.500.12761/2073?show=full) — The repository supplies the paper’s title, refereed and in-press status, conference metadata, abstract, and open-access PDF. The measurements and limitations above come from the deposited paper, especially its methods (§4), tracking results (§5), privacy analysis (§6), and limitations (§8.1). Its future proceedings date and placeholder DOI mean this is an accepted/in-press paper, not a final published proceedings record.
- [BIG CHANGE: AI privacy settings](https://bigchange.ai/blog/ai-privacy-controls-training-memory-sharing) — Background on first-party controls such as model-training choices, memory, and sharing; it does not audit third-party tracker traffic.
- [BIG CHANGE: OpenAI’s report of 53 images exposed in an agent incident](https://bigchange.ai/blog/openai-agents-chatgpt-user-images-disclosure) — A separate incident, not part of this nine-service systematic study.
The BIG CHANGE newsletter
The big picture. At your pace.
Recent stories on AI and robotics, the shifts worth watching and practical ideas to use. Choose a daily briefing, weekly digest or monthly perspective.
Next scheduled send (UTC): . Your first edition arrives at the next scheduled send after you confirm.
Your privacy, your choice.
Necessary storage supports site security and remembers your choices. Optional Google Analytics stays off until you allow it. You can read every story with necessary storage only. Privacy details