You would not read your blood test results out loud in a supermarket. Millions of us do something similar every day: we type a private question into an AI assistant and assume the answer stays between us.
What the researchers actually did
The team from IMDEA Networks, a public research institute in Madrid, tested nine well known AI assistants: ChatGPT, Claude, Grok, Gemini, Copilot, Perplexity, DeepSeek, Meta AI and Mistral’s Le Chat. They used all nine websites and eight phone apps, in Spain, in May 2026. Their full paper is out now.
They asked the kind of questions people really ask, including medical ones, and recorded something we never see: every request the page sent to a company other than the assistant’s own. Those requests are called trackers, small invisible pieces of code that tell an outside company what you did.
What they found
Across the nine assistants the researchers counted 44 outside organisations receiving data, 34 of them advertising, tracking or analytics companies. Every assistant contacted at least one during an ordinary session.
Trackers are nothing new. What is new is what they were handed. Six of the nine websites and three of the eight apps passed on details of the conversation itself: the title the assistant writes for the chat, the chat’s web address, and in some cases the question you typed or a picture of the chat window.
Grok gave away the most: its chat title and the full link went to Meta, TikTok, X’s ad system, Google Ads, Google Search, DoubleClick and Google Tag Manager. Some of it travelled from xAI’s own computers to Meta and TikTok after the third message of a session, a route no ad blocker sees.
ChatGPT and Claude handed the chat’s unique identifier to Datadog, an analytics company; with it the conversation can be found again. Perplexity passed the typed question to a company called Wingify, and Gemini sent the chat’s title to Google Analytics.
A title sounds harmless. It gives the most away. It is the assistant’s own one-line summary of the whole conversation, something like “chest pain after running”. A title plus a link is a topic plus a door.
Why this matters to you
Chats with an AI assistant are among the most personal text we write: symptoms, money worries, family trouble. One title is a small thing; dozens gathered over months are a profile.
Combined with what those advertising networks already know about you, it answers questions you never agreed to be asked: how worried you are, what you might buy next, what you are afraid of losing.
There is a second problem. Several assistants make a chat readable through a link by anyone who has it, no login needed; Grok does this by default, with a setting to switch it off. If such a link reaches an advertising company, the conversation itself becomes reachable.
The researchers tested that. They slipped a hidden tracking link into their chats and waited: the European conversations were later opened from 70 internet addresses, in 48 networks, in 14 countries, two thirds of them in the United States.
What you can actually do
- When a site asks about cookies, choose the option that allows only what is necessary. It helps but does not cure: about eight in ten trackers were still running after a full refusal.
- Turn off public chat links. On Grok they are public by default, with a setting to restrict access; on Perplexity, set sharing to private. If you ever shared a chat, revoke it, chat by chat.
- Treat the chat box like a postcard, not a sealed letter. The subject of your conversation is not protected. Keep ID numbers, bank details and passwords out of it.
- Do not rely on private or incognito mode. It stops your own browser remembering pages; it does not stop the page reporting what you typed.
- Do not pay for privacy: free and paid accounts reached almost the same group of outside companies.
- Know the limits of an ad blocker: it can block what your browser sends, not what a company forwards from its own computers.
Common misunderstandings
Myth: I pay, so my chats stay private
The study found almost no difference between free and paid accounts in who received the data. The narrow exception: a paid ChatGPT account can hold a cookie choice that survives a new session.
Myth: Private or incognito mode hides me
Incognito mode keeps your history off your own laptop. It does nothing about the company at the other end. The researchers recorded ChatGPT passing on the chat’s identifier while private mode was in use.
Myth: An ad blocker takes care of this
An ad blocker stands at your door. It cannot see the parcel a company sends out of its own warehouse. Claude forwarded chat events from Anthropic’s own systems to eleven advertising platforms, including Meta, LinkedIn and TikTok.
What to watch for next
The researchers notified European data protection authorities in April 2026, and in June the Spanish authority asked its European counterparts to examine whether AI assistants let outsiders reach conversations. If it becomes a formal investigation, consent screens in Europe will change.
Two companies have moved already: OpenAI updated ChatGPT’s privacy policy in August 2026 to mention third-party trackers, while xAI had not answered the researchers. One limit: this is a snapshot of nine assistants from May 2026, showing only what leaves the browser or the app.
The one thing to remember
Assume the subject of the chat, not only your name, can be seen by companies you never chose. Keep using these assistants; keep your bank details, ID documents and medical file out of them.
Image credit: Man with smartphone and laptop by Alejandro Escamilla, published on Unsplash before 5 June 2017, via Wikimedia Commons, released under CC0 1.0 Public Domain Dedication (creativecommons.org/publicdomain/zero/1.0).