Who ran the study, and what it covers
The work comes from IMDEA Networks and Universidad Carlos III de Madrid. Notebookcheck reports that the team examined nine assistants in the browser and eight as Android apps, with tests run in Spain in May 2026. The nine were ChatGPT, Claude, Grok, DeepSeek, Gemini, Perplexity, Copilot, Mistral's Le Chat and Meta AI. Gemini's Android app was not analyzed.
Per the IMDEA repository, the paper is a systematic analysis combining static and dynamic analysis. It looks at third-party advertising and tracking services, how consent choices and subscription tiers change exposure, and how access controls affect it. It was accepted at the Privacy Enhancing Technologies Symposium. The repository lists a July 2027 date, so the paper is accepted but not yet formally published. Treat the results as a preview.
Two limits from the research matter here:
- The researchers measured what leaves a browser or phone. They did not establish what the recipients did with the data.
- The study does not rule on whether any law was broken.
What "leak" means in this study
The study counted 44 recipient organizations, and every service contacted at least one advertising or analytics company. The pieces that left the chat varied a lot:
- Conversation links: the most common item. Notebookcheck says five web versions passed them on, including ChatGPT, Claude and Grok. On some services, anyone holding the link can open the whole conversation.
- Chat titles: Grok, Gemini and Le Chat passed these on. The AI writes them from your first question, so a title about a salary and a mortgage says exactly that.
- Prompts and screenshots: Grok's shared pages sent the latest prompt to Meta and TikTok, and a screenshot to TikTok; Google received the shared conversation URL and title only. Perplexity's Android app sent typed text to a testing service called Wingify.
- Identifiers: this data usually travelled with account-linked identifiers such as a hashed email address. That lets a recipient link a profile across services.
A tracker receiving a link or a title is not the same as a tracker receiving a full transcript. The researchers say they have no proof anyone read the conversations. Aniketh Girish of the IMDEA team told Notebookcheck that users have no visible way to know this is happening.
The three headline services
ChatGPT. InsertFuture reports that each conversation's ID goes to Datadog, an error-monitoring service. It says the study counts this as tracking because the ID points to a person, but does not claim the data ends up in ads. The same outlet says the ID still reached Datadog during a Temporary Chat. OpenAI told Genbeta, per InsertFuture, that it uses the analytics to understand traffic and fix errors. Both write-ups say OpenAI has mentioned third-party trackers in its privacy policy since mid-August. The authors can't say their work prompted that.
Claude. Claude's site passed chat links to third parties. InsertFuture says Claude and Mistral send the chat link and the user's email to Intercom, their support tool. Rejecting cookies on Claude stopped the Meta pixel. It also stopped server-side forwarding to about 11 services through Anthropic's own servers.
Grok. Grok went furthest. InsertFuture says its website sent links and titles to seven third parties, including Meta, TikTok and Google Ads. These transmissions happened only after the user accepted non-essential cookies. In the researchers' test, Grok conversations were open by default to anyone with the link. Planted links were opened 70 times from machines in 14 countries, some days later. That shows the links were fetched. It does not show 70 people read them. Claude, Copilot, DeepSeek and Le Chat each fetched the planted links only once, right after submission.
Where Copilot fits
Notebookcheck says Perplexity, Grok and Microsoft Copilot sent the Android advertising ID to third parties. Ad networks use this ID to connect activity across many apps. InsertFuture says the study found no conversation content leaving DeepSeek, Copilot or Meta AI, though all three contact advertising services or send phone identifiers. A WindowsForum thread on the same research says consumer Copilot contacted Google Ads after cookie rejection and sent the advertising ID to Adjust. Both details check out against the paper itself: Copilot is among the services the study found connecting to Google Ads with non-essential cookies rejected, and the paper names Adjust as the third party receiving the Android advertising ID from Copilot.
InsertFuture also reports that Microsoft disputes the study's conclusions and says it found no violation of applicable law. That is a company statement relayed through Genbeta's reporting, not something I verified independently.
For anyone running Copilot, this is a modest finding. It is an app-level identifier issue, not exposed chats. The tests were run from Spain on the builds available in May 2026, so they don't prove every version, region or device behaves the same way. Still, enterprise admins who allow consumer AI apps on managed Android devices should know the apps talk to ad-tech services. That belongs in any mobile AI acceptable-use review.
Cookie rejection helps, but only partly
- Notebookcheck says about three quarters of the identifiers reached third parties only after the user clicked "Accept all." InsertFuture puts the figure at 77.3% of web identifier transmissions.
- Even after a click on "Reject," 80.8% of trackers stayed active. Four of the nine free services kept collecting data, and six still contacted Google Ads.
- Paid plans did little about the trackers themselves. The researchers did find the strongest privacy controls in paid tiers.
- A browser ad blocker can't stop server-side forwarding, because that traffic never passes through your computer.
So declining cookies is worth doing, but it is not a cure.
Practical cleanup steps
The menu paths below come from Notebookcheck's reporting. Interfaces change, so confirm them on your own version.
- Decline non-essential cookies wherever a banner offers the choice.
- Delete shared links you no longer need. Notebookcheck says anyone with the link can read the content on every major service. Deleting a link only blocks new visits. Copies and screenshots others made remain.
- ChatGPT: Settings, Data controls, Shared links. You can delete one link or all of them.
- Claude: Settings, Privacy, "Shared chats," or set the chat back to Private in its Share menu.
- Gemini: the sharing page at gemini.google.com/sharing.
- Grok: the share-links page at grok.com/share-links.
- Perplexity: the researchers recommend setting threads to Private.
- Delete your Android advertising ID. On Android 12 and later, Notebookcheck gives the path Settings, Privacy, Ads, then "Delete advertising ID." Apps then see only a string of zeros. InsertFuture adds a caveat. Grok and Perplexity send the ID with account or install numbers that never change, so a reset ID can be linked back to the old one.
- Keep sensitive topics out of consumer chats if service-side tracking is unacceptable to you. Opting out of AI training only covers part of the picture. Where the conversation itself ends up matters just as much.
Regulators and providers
Notebookcheck reports that the researchers sent their findings to European data protection authorities in April. Spain's AEPD raised the issue at the European Data Protection Board in June. The team sees two GDPR problems. Privacy policies mention advertising partners without clearly saying conversation data goes along. The researchers also can't see a legal basis for that sharing. According to the authors, no provider had responded officially to their responsible disclosure as of the paper's September 2026 finalization; Microsoft's statement above came through press inquiries in mid-October, after the paper was complete.
Some changes have happened. Perplexity removed the Meta pixel in April, probably because of a US class action. Grok was still handing out publicly accessible links in September, according to Notebookcheck.
What to make of it
The study is strong on measurement and carefully hedged on consequences. The headlines are stronger than the evidence about Microsoft, and the paper's title is more fun than most privacy papers. This is a snapshot from Spain in May, and providers dispute parts of it. Even so, it shows that consumer chatbots are ordinary web and mobile products with ordinary tracking code. For Windows and Android users, the useful response is hygiene: clear old shared links, decline optional cookies, and reset the advertising ID. Assume a chat you share may be fetched by systems you never intended to include.
Correction (October 19, 2026): Three corrections from a re-check against the study paper itself. First, Grok's shared pages sent the latest prompt to Meta and TikTok and a screenshot to TikTok only; Google received the shared conversation URL and title, not the prompt or screenshot. Second, the detail about consumer Copilot contacting Google Ads after cookie rejection and sending the advertising ID to Adjust is confirmed in the paper (its sections 5.2 and 6.2.2), not unconfirmed. Third, the authors' statement that no provider had responded officially dates from the paper's September 2026 finalization; Microsoft's dispute statement came through press inquiries in mid-October.