Do AI Chatbots Leak Your Chats to Ad Trackers?

People treat an AI chat the way they treat a private search or a note to themselves — they type things they'd never post publicly: symptoms, finances, relationship problems, work they haven't told their boss about. The implicit assumption is that the conversation stays between them and the AI. New research says that assumption is often wrong. When a team at IMDEA Networks instrumented nine of the most popular AI assistants and watched what left the browser, they found the same ad-tech plumbing that tracks you across the open web had quietly wired itself into the chat box. This is what they found — and why it matters far beyond the named apps.

What the IMDEA Networks study found

The study, titled "Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents," came from researchers at IMDEA Networks (with collaborators at UC3M and an independent contributor). They tested nine leading conversational-AI services in Spain in May 2026, using instrumented browsers (Chrome with developer tools) and an instrumented Android phone, varying the cookie choice, account tier, and whether a conversation was shared. The prompts were deliberately health-themed — a "persona-based" audit designed to see what happens to sensitive input.

The top-line findings:

• Every one of the nine services contacted at least one advertising or tracking company. Not a subset — all of them.
• Six of nine web clients passed conversation-related data to outside firms (and three of the Android apps did the same).
• Google was the most widespread recipient — its Ads and Tag Manager products appeared in the web clients of seven services, and Firebase appeared in all eight Android apps analysed.
• What left the browser included the content, not just the fact of a visit — conversation URLs, conversation IDs, auto-generated conversation names, user prompts, and in one case a screenshot, alongside the usual identifiers (cookies like _fbp and _ttp, hashed emails, mobile advertising IDs, Android IDs and geolocation).

As one of the researchers, Aniketh Girish, put it: "Most users have no way of knowing this is happening — there is nothing visible in the interface that would tell them." And on the policy gap, Guillermo Suárez-Tangil noted the privacy policies mention advertising partners but "never clearly state that actual user conversations are part of the information being shared."

Which chatbots leaked what, per the study

The researchers published service-by-service observations. A selection, as documented in the paper and its coverage — reported as findings, not accusations:

The single most common thread is Google's ad and tag infrastructure, which the study found across the majority of the web clients — the same Google Ads and Tag Manager you'd find on an e-commerce checkout, now sitting behind a conversation. The recipients list reads like a who's-who of ad-tech precisely because the chat clients were built with the same off-the-shelf tracking tags as any other web app.

Why the auto-generated chat title is the quiet killer

Of everything the study surfaced, the detail most worth understanding is the conversation name. Modern chat apps auto-generate a short title for each conversation so you can find it later — and that title is, by design, a compressed summary of what you discussed. When a title is forwarded to a tracker, the tracker doesn't need the full transcript; the summary is the sensitive data.

The study's own examples make the point sharper than any explanation:

• A question about Parkinson's produced the conversation name "Early-stage Parkinson's Symptoms."
• A salary-and-mortgage prompt produced "$85k NYC Salary: $280k–$350k Mortgage."

Imagine those two strings arriving at an advertising network, attached to a cookie and a hashed email that can be matched to a real person. One implies a health condition; the other, a precise financial profile. Neither required the tracker to read the conversation — the title handed over the conclusion. That's why "it's only the chat title, not the whole chat" is cold comfort: the title is often the most revealing line in the whole exchange.

The 77% that fired only after "accept" — and why that's the worst part

One statistic in the study deserves its own section, because it flips the usual defense on its head. The researchers found that 77.3% of web identifier transmissions happened only after non-essential cookies were accepted. At first glance that sounds reassuring — the tracking mostly waited for consent. Look again and it's the opposite of reassuring: it means the tracking is wired to the consent banner. These services aren't leaking by accident in spite of their consent setup; for the majority of transmissions, the consent "accept" is the switch that turns the conversation-sharing on.

That matters for two reasons. First, it confirms these are deliberate, consent-gated ad-tech integrations — the same category of marketing tags any website runs — not stray bugs. Second, it means the quality of that consent is doing enormous work. If a user clicks "accept" on a generic cookie banner without any idea that "accept" also means "share the content of my AI conversations with advertising networks," the consent is, at best, uninformed. The study's authors flagged exactly this: policies mention advertising partners but never say conversations are part of what's shared. A consent that doesn't name what's really being consented to is the thin ice the whole arrangement stands on.

What this actually means for your website

It's tempting to read this as a story about OpenAI, Anthropic and xAI — someone else's problem. It isn't, and here's the move that makes it yours: if the most resourced AI companies in the world, with large legal and privacy teams, shipped chat interfaces wired to ad trackers, the third-party chat widget you dropped onto your site is almost certainly doing the same thing — and that one is your legal responsibility, not theirs.

Think about what you've embedded. A support chatbot from a SaaS vendor. An AI assistant widget. A lead-gen conversational form. Each loads third-party script into your pages, each can carry its own analytics and ad tags, and each processes exactly the kind of content visitors type into a chat — names, order numbers, complaints, health or financial questions. The IMDEA findings are a template for what that widget may be doing on your domain:

• Forwarding conversation content or titles to the widget vendor and its downstream trackers.
• Loading ad/analytics tags (often Google's) that fire alongside the chat, sometimes before consent.
• Attaching identifiers — cookies, hashed emails, device IDs — that let a conversation be tied back to a real person.

The difference is accountability. You can't fix ChatGPT's data flows, but you absolutely can govern the chat widget on your own domain — whether it loads before consent, what it's allowed to transmit, and whether you can prove the visitor agreed first. That's the same prevention-first discipline that governs any tracker: block the widget until genuine consent, and keep the record. For the full legal framing of a chatbot you operate, see our guide to AI chatbot privacy compliance under CIPA, GDPR and the AI Act.

The legal exposure a leaking chat widget creates

A chat widget that forwards conversation data to third-party trackers sits squarely in the fact patterns regulators and plaintiffs are already pursuing. Three in particular:

• CIPA (US wiretapping). If a third-party vendor intercepts a visitor's conversation in real time without consent, that's the exact theory behind the current wave of California wiretapping suits — with statutory damages of $5,000 per violation under California Penal Code §637.2. A chat box is, legally, a two-way communication; routing it through a tracker is the interception plaintiffs plead.
• GDPR special-category data. The study used health prompts for a reason: conversation content routinely contains health, financial or other sensitive data. Forwarding that to advertising partners without a clear lawful basis — and without telling users conversations are shared — is precisely the gap the researchers flagged, and Spain's AEPD cited the work and moved to escalate it toward the EDPB.
• EU AI Act transparency. Separately, if visitors interact with an AI without being told it's AI, that's an Article 50 disclosure issue — a different duty that stacks on top of the data one.

The through-line is that none of these are satisfied by the chat vendor's own policy. They're satisfied by what happens on your domain: whether the widget is gated, what it transmits, and whether you obtained — and can prove — informed consent first. We cover how those duties interact in AI disclosure vs AI consent, and why AI processing needs its own consent category in AI as a consent category.

How to check your own chat widget

You can run a version of IMDEA's method yourself in a few minutes — no lab required.

If the widget fires before consent, or you can't get a straight answer on what it transmits, treat it like any other unconsented tracker: block it until the visitor opts in, and don't rely on the vendor's policy to cover your domain. To find chat and AI tools you may not even know are running, start with is your website using AI on visitors?