Chatbots and Trackers: What Advertisers Learn From AI Conversations

When you ask a chatbot a question, you are not only talking to the chatbot. Researchers at IMDEA Networks, a research institute in Madrid, examined nine of the best-known AI assistants for data flows to third parties and found that six web versions sent conversation information to outside services, including advertising and analytics companies such as Google, Meta and TikTok. The full study has been available since late September, and Germany’s consumer testing organization Stiftung Warentest picked it up on October 17 with concrete protection tips. For users, this is mainly a practical question: what does a chat reveal about them, and what can they do about it?

Key takeaways

• The researchers tested ChatGPT, Claude, Copilot, DeepSeek, Gemini, Grok, Mistral’s Le Chat, Meta AI and Perplexity, each in the browser and as an Android app.
• Six of nine web versions and three of eight Android apps passed conversation information to third parties, such as chat links, auto-generated chat titles, prompts or screenshots.
• Grok went furthest: for shared chats, Meta and TikTok received the latest prompt, according to the study, and TikTok also received a screenshot.
• Rejecting cookies helps only to a limited extent, and the Android apps offer no such choice at all.
• The researchers have no evidence that advertising companies actually read the conversations. The risk lies in the possibility.

What the researchers measured

The work comes from the group around Aniketh Girish, Guillermo Suárez-Tangil and Narseo Vallina-Rodríguez. A first version under the project name LeakyLM appeared on May 4, 2026, and covered four services. The expanded study covers nine providers and is a preprint, meaning it has not yet gone through the usual peer review. The researchers recorded which network requests browsers and apps send during real conversations and what those requests contain. In total, the study counted 124 domains from 44 organizations that received data from the chatbot websites and apps.

One point matters for context: the trackers sit on the AI providers’ own websites and apps. Not every third party is an advertising company. Services such as Datadog or Intercom monitor technical performance or run customer support. The researchers themselves stress that the mere presence of a third party does not prove that data is used for advertising.

Which data goes where

The most sensitive data type looks harmless: the address of a conversation. If a chat is publicly accessible, for example because it was shared, the link is equivalent to the conversation itself. The chat titles that assistants generate automatically from the first question are similarly revealing. A title like “rash on a toddler” gives away the topic without a single prompt being sent along.

According to the study, Gemini, Grok and Mistral sent chat titles to third parties, Gemini via Google Analytics. Google told the German digital rights outlet netzpolitik.org that the service is used for technical monitoring of Gemini and that the company complies with European data protection rules. ChatGPT, Claude, Grok, Mistral and Perplexity transmitted chat links. For ChatGPT and Claude, the conversation identifier went to the monitoring service Datadog, among others.

For Claude, the researchers had already found a peculiarity in the May version: if users accept cookies, Anthropic forwards their data server-side to eleven platforms, including Meta, Google, LinkedIn, TikTok and Reddit. Because this runs through Anthropic’s own servers, a browser ad blocker cannot intercept it. At the same time, Stiftung Warentest says Claude was the only service where paid and free accounts differed in their data flows.

Grok performed worst. Titles and links went to Meta, TikTok, Google and X’s analytics service. To check whether anyone actually opens shared links, the researchers planted bait links in Grok chats. These were accessed 70 times from 70 different IP addresses in 14 countries, sometimes days after they were created. Who exactly was behind those requests cannot be determined from the data.

Why the cookie banner offers little protection

Some of the transfers do depend on the cookie choice: according to the study, 77.3 percent of identifier transmissions on the web happened only after non-essential cookies were accepted. Rejecting them is therefore worthwhile. But it is no guarantee. After rejection, 80.8 percent of the observed third-party trackers remained active, according to netzpolitik.org, and Stiftung Warentest reports that Perplexity, DeepSeek, Gemini, Copilot, ChatGPT and Claude still connected to Google Ads. The Android apps have no cookie prompt; installing the app means accepting the terms.

The researchers notified data protection authorities in the EU and the UK on April 13, 2026. At the end of May, Spain’s data protection authority AEPD asked for the case to be discussed by the European Data Protection Board. No outcome has been made public. Perplexity had already removed the Meta Pixel on April 3, and xAI had not responded to the researchers by the time of publication. Legally, this connects to a line a German court has just drawn: as in the Cologne ruling on Snapchat’s My AI, the question is whether conversation content may flow into advertising systems without explicit consent.

What users can do

The good news: a few simple steps block a large share of these data flows. Stiftung Warentest recommends allowing only essential cookies in the cookie banner and opening chatbots in a private browser window. Browsers with built-in tracking protection such as Brave or Firefox, as well as extensions like uBlock Origin, also catch many requests, though not server-side forwarding.

• Use a separate email address for chatbots instead of your main one.
• Use the temporary or incognito mode if the service offers one.
• Share chats by link only when necessary, and delete the link afterward.
• Do not enter health data, financial details or contract numbers, or redact them first.
• On an iPhone, turn off tracking under “Privacy & Security”; on Android, reset or delete the advertising ID regularly.

Anyone who wants to ask sensitive questions also has an alternative without third parties: local models, for example via Ollama on your own computer, send no conversation data to outside servers. They are not as strong as the big cloud services in every discipline, but they are good enough for many everyday questions.

Analysis: chat history becomes an advertising signal

The study reveals less a scandal at individual providers than a structural problem. AI assistants are built with the same marketing and analytics tools as any other website, except that their pages carry far more intimate content than an online store. A chat title is a more precise signal of interest than any search term. As long as providers do not deliberately separate their trackers from conversation data, it is up to users to shield their chats. More clarity will likely have to come from the data protection authorities, which have known about the case since the spring.