A Privacy Analysis of Web and Mobile Conversational AI Agents [pdf]
A systematic privacy analysis of nine major conversational AI services reveals that most leak conversation artifacts, prompts, and user identifiers to third-party trackers.
read it The paper provides concrete empirical data on how major conversational AI platforms leak sensitive user prompts and identifiers to third-party ad networks.
summary
Researchers evaluated nine prominent web and mobile conversational AI services and found that every single one integrates third-party tracking or advertising services. Using static and dynamic analysis, the study uncovered that multiple platforms disclose sensitive conversation-derived artifacts—including titles, prompts, URLs, and screenshots—alongside persistent user identifiers. Additionally, several providers expose entire chat histories via public permalinks lacking access controls, raising severe compliance issues under EU data protection law. These findings highlight a novel attack surface where AI-mediated interactions are absorbed into the traditional ad-tracking ecosystem.
key points
- All nine analyzed conversational AI services integrate at least one third-party tracking or advertising service across their web or Android clients.
- Six of nine web clients and three of eight Android clients leak conversation-derived artifacts like titles, prompts, and screenshots to third parties alongside user identifiers.
- Several providers expose conversation permalinks publicly without access controls, enabling external trackers or unauthorized actors to read entire chat histories.
who should read it
Security engineers, privacy researchers, and technical users evaluating the confidentiality of cloud-based AI assistants.
discussion skeptical
consensus
Commenters express little surprise at the findings, arguing that data monetization is an inevitable outcome of cloud AI services and positioning local open-weight models as the only reliable safeguard.
pushback
A minority debate whether leaking user data to ad-tech networks is an intentional strategy or simply sloppy engineering resulting from rapid scaling.
My least favorite trend I’ve noticed with so many AI chat services is they seem to equate a UUID in the url with privacy.
Perplexity does this. Visiting a past perplexity search url exposes your full conversation.
It points out how platforms mistakenly rely on obscure UUIDs in URLs instead of proper access controls, making conversation histories vulnerable via browser histories.
Generated by an LLM from the article and thread. Check the sources before relying on it.