A privacy audit of 9 conversational AI services finds conversation titles, prompts, and screenshots sent to ad trackers

AI companies leak data to advertisers [pdf]

Researchers at IMDEA Networks audited nine conversational AI services, including ChatGPT, Gemini, and Claude. Every service embedded at least one third-party ad or tracking service. 6/9 web clients and 3/8 Android clients disclosed conversation URLs, titles, prompts, or screenshots to third parties, often alongside persistent user identifiers. Some providers also exposed entire conversations via public permalinks with no access controls, letting trackers read full threads. Consent choices and subscription tiers directly shaped the tracking surface. The team completed responsible disclosure with affected providers and EU data protection authorities.

Why it matters: IMDEA's systematic privacy audit of 9 major conversational AI services finds all embed third-party trackers, with most leaking conversation titles, prompts, or screenshots alongside persistent user IDs. First academic work to systematically expose this, with concrete cross-pla...