Security researchers uncovered a troubling pattern across major AI chatbots. ChatGPT, Claude, Grok, and Perplexity all transmit user conversation data to third-party ad trackers operated by Meta, TikTok, Google, and others, even when users explicitly reject tracking cookies.
The study reveals that these platforms embed tracking pixels and scripts that capture chat content before it reaches company servers. This happens regardless of privacy settings or cookie consent choices. Meta's Conversions API receives the most data flows, followed by Google's tracking infrastructure. TikTok, LinkedIn, and Snapchat also receive signals from user interactions on these chatbot platforms.
ChatGPT exhibits the most aggressive tracking behavior. The platform sends data to Google Analytics, Segment, and Clarity analytics tools. Users selecting "no" to cookies still see tracking pixels fire. Claude and Perplexity show similar patterns, though with different tracker combinations. Grok's tracking is lighter but still present.
The mechanisms operate through browser-based tracking technology that fires before encryption takes effect. Client-side scripts send identifiers tied to user conversations. Some platforms claim they anonymize this data, but researchers note that conversation content itself often contains personally identifiable information. Anonymization claims lack verification.
This matters because chat histories contain sensitive personal data. Users may share medical information, financial details, or private thoughts they assume remain confidential. Ad platforms receiving this data can build detailed behavioral profiles for targeting purposes.
OpenAI, Anthropic, and other chatbot operators acknowledge the tracking occurs but argue it serves analytics and fraud detection. Their privacy policies bury disclosure of these third-party data flows in dense legal text. Users rarely understand what data leaves their browsers.
Regulators in Europe and California have begun scrutinizing these practices. GDPR compliance questions loom over companies that send EU user data to US ad networks without explicit consent. The FTC has opened investigations into tech companies' opaque data practices.
Users can reduce exposure by disabling JavaScript, using privacy-focused browsers, or switching to platforms with stricter data policies. However,