Do AI chatbots share your data with trackers? What a study of nine assistants found

The Morse teamPublished October 27, 20268 min read

Yes. As of October 2026, most popular AI chatbots do share some of your data with trackers, according to a study by researchers at IMDEA Networks in Madrid. It found third-party advertising or tracking services in all nine assistants it tested, and pieces of the conversations themselves (chat links, chat IDs, auto-written titles, prompts, and screenshots) reaching third parties from 6 of the 9 web versions and 3 of the 8 Android apps (IMDEA Networks paper). With cookies rejected, 80.8% of the trackers stayed active.

We read the paper, "Prompt like a Butterfly, Sting like a Tracker," on IMDEA's own repository on October 23, 2026, along with the researchers' project page, IMDEA's press release, the Spanish data protection agency's notice, and the cookie and privacy pages of OpenAI, Anthropic, xAI, Mistral, and DeepSeek. Every cell in the table below comes from the paper. Three of the nine, DeepSeek, Copilot, and Meta AI, sent no conversation data to third parties in its tests, and ChatGPT and Claude keep a chat's link readable only by its owner.

What did the IMDEA study test?

Nine assistants chosen for popularity, used by hand in Chrome and on an Android phone in Spain in May 2026, as a guest, on a free account, and on a paid one where offered, with cookies rejected and accepted. The prompts played someone asking about a medical condition, and the researchers also opened share links. They counted 44 third-party organizations, 34 of them advertising and tracking services, led by Google, Sentry, Meta, Datadog, and Intercom. A company's own ad and analytics endpoints count as third parties, so Google Analytics on Gemini counts.

Which AI chatbots send your conversations to trackers?

On the web, ChatGPT, Claude, Gemini, Grok, Le Chat, and Perplexity. On Android, ChatGPT, Claude, and Perplexity. The table lists what left each one in normal and shared chats.

A title summarizes what you asked. In the paper's example, Grok titled "My salary is $85k. How much mortgage can I afford in NYC?" as "$85k NYC Salary: $280k-$350k Mortgage," and that title went to seven ad and analytics services once cookies were accepted.

When was the IMDEA study published?

In two steps, which is why reports disagree. The researchers posted findings on four assistants (ChatGPT, Claude, Grok, and Perplexity) on their LeakyLM page on May 4, 2026, and IMDEA's press release followed on May 6. The nine-assistant paper came later: its PDF was generated on September 18, 2026, and IMDEA's repository added it on September 22. It's formatted for Proceedings on Privacy Enhancing Technologies 2027, issue 1, still with a placeholder DOI, and the repository dates it July 19, 2027, the opening day of PETS 2027. We found no arXiv version on October 23, 2026.

"Big Help or Big Brother?", a title sometimes attached to this work, is a different study of AI browser extensions from August 2025 (UC3M e-Archivo). A separate UC Davis preprint of April 30, 2026 found 17 of 20 chatbots sharing information with at least one third party (arXiv).

Does rejecting cookies stop AI chatbot trackers?

Only partly. Rejecting stopped all of Grok's flows and all of Claude's but Intercom. ChatGPT, Gemini, and Perplexity kept sending, and six of the nine still contacted Google Ads (paper, section 5.2).

The companies' cookie pages show why. OpenAI's cookie policy, updated October 22, 2026, lists Datadog's cookie as necessary, for "Error reporting." Anthropic's cookie page lists Intercom's device-ID cookie among necessary cookies, which "cannot be refused."

Incognito chats didn't stop Grok's seven flows or ChatGPT's Datadog flow either. The Android apps showed no cookie banner at all.

Can trackers read your AI chats?

Nobody has shown that they do. The researchers wrote that "we do not yet have evidence that conversations are read by trackers" (LeakyLM). The paper adds that a tracker's presence doesn't prove an advertising purpose, that it couldn't see tracking done on companies' own servers, and that its results are a lower bound from one country and one kind of prompt.

A link can be enough to read a chat, though. Grok's chats were public by default, with an opt-out, and still were on September 10, 2026, by the paper's account. Perplexity's guest chats were always public. When the researchers planted unique links inside Grok conversations, something fetched them 70 times from 70 IP addresses in 14 countries, hours to days later. The paper doesn't say who.

What do AI companies say they share with advertisers?

They describe partners in general terms, without mentioning chats. OpenAI's privacy policy, updated September 10, 2026, says "Some of these partners may receive information through cookies and similar technologies," and its cookie policy lists marketing cookies from Meta, TikTok, Google, LinkedIn, Reddit, Bing, and Snapchat. Anthropic lists Facebook's _fbp cookie for "Targeted Marketing" and says in its privacy policy that it honors global privacy controls. Mistral says it hasn't engaged in "targeted advertising" in the past year (Mistral), and DeepSeek says "WE DO NOT ENGAGE IN TARGETED ADVERTISING" (DeepSeek). Grok's cookie policy is covered in is Grok private, and Perplexity's in is Perplexity private.

Google told netzpolitik.org, in an article published October 13, 2026, that Google Analytics helps it monitor Gemini's performance and spot faults. xAI, Mistral, and Perplexity didn't answer that outlet, and the paper says xAI hadn't replied to the researchers by September 10. Spain's AEPD asked European regulators to take up the findings on May 27, 2026.

How do you stop AI chatbots from sharing your data with trackers?

You can cut it down with settings and habits, though nothing on your side reaches the flows that run server to server.

• Reject non-essential cookies. On grok.com, open Settings, then Data Controls, and choose Manage under Cookie Settings (xAI). On claude.ai, use Your privacy choices in the Learn More menu (Anthropic). In ChatGPT, use the marketing privacy control in your account settings (OpenAI). Turn on Global Privacy Control too.
• Don't make share links, and remove old ones. Shared pages were open to nine third parties. Grok lists yours at grok.com/share-links, each with a Remove button; how to delete Grok history covers the rest.
• Don't count on guest or incognito use, for the reasons above.
• Block trackers in your browser. The paper notes Brave blocks ad and analytics requests by default.
• On Android, delete your advertising ID: Settings, Privacy, Ads, Delete Advertising ID (Google). Grok and Perplexity sent it alongside IDs that survive a reset.
• Keep your first message plain, since the title is written from it.

How Morse keeps ad trackers out of your chats

Grok's chat titles reached TikTok and Meta, and Gemini's reached Google Analytics, through ad and analytics code loaded on the page beside your conversation. Morse runs no advertising trackers or third-party analytics and shows no ads, so there's no Meta Pixel or Google Analytics tag on the page to receive a chat's title or link (privacy policy). Morse's servers don't keep messages or log their content. You pick a privacy mode for each chat:

• Anonymous, to keep using GPT, Claude, and Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider may keep it for a limited time to check for abuse under its own policy, so leave out names you'd rather keep to yourself. Our guide to using ChatGPT anonymously explains the trade.
• Private, for open models and Grok on hosts that agreed to keep nothing. Morse has zero data retention agreements with its inference, search, and other providers, and where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. New chats start here.
• E2EE, for the questions you'd least want summarized in a title. Your browser checks the enclave's hardware attestation, then encrypts the message so only that enclave can read it, and our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed.

In every mode, your history stays encrypted in your browser, locked when you sign out and opened with two keys, one of which never leaves your device. Morse doesn't train AI on your content or sell your data. Clearing your browser deletes your chats for good, and Morse can't recover them, so keep a copy of anything you need.

Try a chat from the Morse home page without an account, or start free with no card needed. End-to-end encrypted chats come with Pro, at $19 a month.