ChatGPT, Claude, Grok: Your chats end up with trackers

Chatting with an AI assistant feels like a private conversation. With most services, though, third parties are listening in, at least around the edges. Researchers at the IMDEA Networks Institute in Madrid examined nine assistants in the browser and eight of them as Android apps, including ChatGPT, Claude, Gemini, Grok and Perplexity. Every service contacted at least one advertising or analytics company, and the team counted 44 companies on the receiving end. Six of the nine web versions and three of the eight apps also sent parts of the conversations, such as the link to a chat, its title or even the text a user typed. The tests ran in Spain in May 2026. The paper has been accepted at the Privacy Enhancing Technologies Symposium and is due to be published in July 2027.

What actually reaches the trackers

The link to a conversation was the most common leak, coming from five web versions, among them ChatGPT, Claude and Grok. That sounds harmless, but it isn't always. Depending on the service, anyone with that link can open the whole conversation. Grok, Gemini and Mistral's Le Chat passed on chat titles, which the AI generates from your first question. Grok went furthest. On shared pages, it sent a screenshot and the latest prompt to Google, Meta and TikTok along with the link and title. Perplexity's Android app sent the text users typed to a testing service called Wingify.

A title alone can say a lot. If you ask about your salary and a matching mortgage, the chat title will say exactly that. In the study, this kind of data usually traveled with identifiers tied to your account, such as a hashed email address, which makes it possible to link a profile across several services. "Most users have no way of knowing this is happening, there is nothing visible in the interface that would tell them," said Aniketh Girish of the IMDEA team.

The researchers stress that they have no evidence the recipients read the conversations. A test with planted links shows how far a link can travel, though. On Grok, those links were opened 70 times from machines in 14 countries, in some cases days later. Claude, Copilot, DeepSeek and Le Chat each fetched them only once, right after submission. In July, Claude conversations that showed up in Google search made it clear that shared chats don't always stay private.

Rejecting cookies helps, but only partly

Rejecting cookies is the first step, and it does help. In the study, about three quarters of the identifiers only reached third parties after a click on "Accept all." On Claude, for example, rejecting stopped the Meta pixel and server-side forwarding to about 11 services through Anthropic's own servers. A browser ad blocker can't stop that kind of forwarding, because it never passes through your computer. Rejecting is still not a complete fix. After a click on "Reject," 80.8% of trackers stayed active, and four of the nine free services kept collecting data. Six of the nine services still contacted Google Ads. A paid plan does little about the trackers themselves, although the researchers found the strongest privacy controls in paid plans rather than in the free tiers most people use.

On phones, the advertising ID comes into play. Perplexity, Grok and Microsoft Copilot sent it to third parties. Ad networks use this identifier to connect your activity across many apps. On Android 12 and later, you can delete it under Settings, Privacy, Ads, then "Delete advertising ID." Apps then only see a string of zeros. DeepSeek and Meta AI did not share conversation content with outside trackers in the study. DeepSeek does use Chinese fingerprinting services, however. Meta AI sends the Android ID to Meta's own servers.

Clean up your shared chats

Shared conversations are where you can do the most, because with every major service, anyone who has the link can read the content. ChatGPT lists all shared links under Settings, Data controls, Shared links, where you can delete one or all of them. Claude keeps them under Settings, Privacy, in the "Shared chats" section, or you can set a chat back to Private in its Share menu. Google lists your Gemini links at gemini.google.com/sharing, and xAI lists Grok links at grok.com/share-links. For Perplexity, the researchers recommend setting threads to Private in the sharing settings. Deleting a link only blocks new visits, however. Copies and screenshots that others have already made remain.

So far, the study has done little to move the providers. The researchers sent their findings to European data protection authorities in April, and the Spanish authority AEPD raised the issue at the European Data Protection Board in June. The team sees two problems under the GDPR. Privacy policies mention advertising partners but don't clearly say that conversation data goes along, and the researchers can't see a legal basis for that sharing. According to the authors, none of the providers has responded officially. Perplexity removed the Meta pixel back in April, probably because of a class action in the US. OpenAI has mentioned third-party trackers in its privacy policy since mid-August. Grok was still handing out publicly accessible links in September. If you ask about sensitive matters such as health or money, the AI training you can opt out of at the major providers is only part of the picture. Where the conversation itself ends up matters just as much, all the more now that OpenAI is bringing ads to ChatGPT.

I write about IT security and artificial intelligence. Cybersecurity is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I have worked hands-on with AI for years, most recently with a focus on AI agents and their use in everyday work, and I test tools and models myself rather than just reading about them.