Agentum Cloud
Agentum

Sourced writing from Agentum R&D

AI Employees, Safely · For business owners

What your staff type into AI chat apps can reach ad trackers

By Agentum R&D · 4 min read
Published · Updated

Short answer A 2026 study found that six of nine popular AI chat services' web versions sent conversation details, such as chat addresses or titles, to third parties. Rejecting cookies helped only partly and paid plans did not help. Keep customer details out of consumer AI chat apps.

Your receptionist pastes a customer's angry email into an AI chat app and asks for a polite reply. It takes ten seconds and the reply is good. The question is where details of that email went next.

In September 2026, researchers at IMDEA Networks released a study of nine popular AI chat services, including ChatGPT, Claude, Gemini, Copilot and GrokSource 1. Six of the nine web versions, and three of eight Android apps, sent conversation details to third-party services, often together with an ID that lets those services tie the chat to a userSource 1. On the web these were ChatGPT, Claude, Gemini, Grok, Mistral and PerplexitySource 1. Most often it was the chat's web address or ID, sometimes its AI-written title, and in a few cases the prompt itself or a screenshotSource 1.

Where details of a chat can travel. Staff paste customer details into an AI chat app; the app gives the chat a web address and an AI-written title; 6 of 9 web apps sent such details to third parties, often with an ID that can be tied to the user. Most tracking IDs were sent only after someone clicked Accept on cookies; 4 of 9 services still sent data after Reject. Paid plans behaved like free ones. In Grok, even unshared chats were open to anyone with the address.
From a 2026 study of nine AI chat services, tested in May 2026.

What the researchers found

The recipients ranged from monitoring and support tools such as Datadog and IntercomSource 1 to ad and tracking services such as Google Ads and TikTokSource 1. Grok sent chat details to the most ad and tracking services, seven, and only after someone accepted cookiesSource 1. The study is a preprint, not yet formally published; its tests ran in Spain in May 2026, and its authors call their numbers a lower bound at one point in timeSource 1. Three details matter most for a business:

  1. Cookie choices help, but not fully. Most tracking IDs were sent only after someone accepted non-essential cookiesSource 1; on Claude, rejecting them stopped Meta's tracking pixel and forwarding to eleven advertising platforms. But in four of the nine services, trackers still collected data with non-essential cookies rejectedSource 1.
  2. Paying did not help. The researchers saw no clear difference between free and paid accountsSource 1.
  3. Some chats were public without being shared. In Grok, an ordinary chat address could be read by anyone who knew itSource 1, and, once someone accepted cookies, those addresses went to seven ad and tracking servicesSource 1. The researchers report it was still so on 10 September 2026Source 1.

The authors judged most of what they found to be deliberate product design rather than security holes; the one exploitable weakness they reported was in GrokSource 1. Nothing has to break for details of a chat to reach an ad network. In the apps that leaked, it was how they were built.

Why it is your problem, not just the app's

When your staff paste a customer's name, email, order or health details into a consumer AI app, your business is still responsible for that data. The researchers analysed these practices under EU data-protection law and reported them to data protection authorities in the EU and UKSource 1. If you serve customers in the EU, or anywhere with a privacy law, ask a lawyer how this affects your obligations.

This is general information, not legal advice. Check with a lawyer for your situation.

Five steps for this week

  1. Write one rule for staff: no customer names, contact details, orders or health information in consumer AI chat apps. Paste the situation, not the person.
  2. Reject non-essential cookies in every AI app your team uses on the web. In the study, most tracking IDs went out only after someone clicked Accept. Phone apps have no such switch.
  3. Stop sharing chat links that contain anything about a customer, and delete the shared links you already made from the app's settings. If anyone uses Grok, switch its chats to private in settings, and sign in before using Perplexity: its guest chats are always publicSource 1.
  4. Ask your AI vendor in writing which third parties receive conversation data, on which plan. The study tested free, paid and guest use and left out enterprise plansSource 1, so ask about yours.
  5. Put customer work on a plan with a data processing agreement, such as an enterprise AI plan or your helpdesk's AI. The study did not test these, and its authors say the same concerns apply to support chatbots built on the same trackersSource 1, so ask the same question there too.
  1. Staff know not to paste customer details into AI chat apps
  2. Non-essential cookies rejected in every AI app on the web
  3. No shared chat links with customer details
  4. Your AI vendor has told you, in writing, who receives conversation data

Sources

  1. Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents (Oliveira et al., IMDEA Networks, preprint, Sep 2026). Retrieved . ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩

Published · Updated Report an error (support@agentum.cloud)