Researchers: Chatbots pass conversation data to advertising and analytics firms

When you chat with an AI chatbot, information about the conversation can end up with advertising and analytics firms. That is the finding of a study by researchers at the IMDEA Networks Institute, who examined ChatGPT, Claude, Grok and Perplexity in a project called LeakyLM. The results were published on May 4, 2026.

The researchers found at least 13 third-party trackers across the four services. A tracker is a small piece of code that sends information about your behavior to another company. According to the researchers, none of them was disclosed to users in plain language before the results came out.

What was passed on?

According to the institute, the chatbots send conversation titles, conversation web addresses (so-called permalinks) and metadata, along with cookies and identifiers. The researchers assess that combinations of cookies, hashed email addresses and server-side techniques can be used to profile and recognize users over time.

The researchers point to these findings:

- Grok: Guest conversations are publicly accessible by default. Google Analytics and DoubleClick receive conversation URLs and titles. TikTok receives hashed emails and verbatim conversation content via metadata. - Claude: Intercom receives email addresses and conversation URLs unconditionally. Anthropic's servers forward data to eleven advertising platforms, including Meta, LinkedIn, TikTok and Google. - ChatGPT: Google Analytics receives conversation URLs and page titles for free logged-in users, regardless of whether they accept or decline cookies. - Perplexity: Datadog receives email addresses and conversation URLs, and Singular receives email hashes and metadata. Guests' permalinks were accessible without logging in.

Decrypt reports that Claude's forwarding happens through Anthropic's own servers and not through the browser, so an ad blocker does not stop it.

Important caveats

The researchers have no evidence that the trackers actually read the conversations. But when links are spread, others can in principle read them, and the researchers call this a potential risk. The results are preliminary and are based on the researchers' own tests, particularly with free and logged-in users and health-related questions.

Narseo Vallina Rodríguez of IMDEA Networks says that weak or missing access controls mean that, in some cases, a link to a conversation can in itself grant access. Aniketh Girish, also of IMDEA, says that most users cannot know this is happening, because nothing is visible in the interface.

The companies' response

The researchers discovered the issue on March 23, 2026, and reported it to data protection authorities on April 13. xAI was notified on April 17. At the time of publication, xAI had not responded, and according to Decrypt, none of the companies had responded. Perplexity removed its Meta Pixel on April 3, 2026, which the researchers believe was likely connected to a concurrent US class action lawsuit and not to their research.

It is unclear what the companies have changed since, so conditions may be different today. Decrypt reports that declining cookies switches off Claude's Meta Pixel and limits the exposure in ChatGPT.