In tests conducted in Spain in May 2026, researchers at IMDEA Networks found that all nine consumer AI chatbot services they examined contacted at least one third-party advertising or tracking service. Their preprint also reports that some web and Android clients sent conversation-related artifacts to third parties.
The tested services were ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Le Chat and Meta AI. Across the observed flows, the researchers mapped 124 third-party domains linked to 44 organizations, classifying 34 organizations as advertising or tracking service providers.
Conversation-related data appeared in some tested clients
The researchers found conversation-related artifact disclosures in six of nine web clients and three of eight Android clients. Examples included conversation identifiers and URLs, titles, prompts and screenshots. The Android count covers eight clients because the researchers could not extract traces from Gemini’s Android app.
| Client platform | Clients with conversation-related artifact disclosures | Clients tested |
| Web | 6 | 9 |
| Android | 3 | 8 |
For the narrower category of conversation URLs or identifiers, five web clients disclosed them to third parties during ordinary use. Three of those disclosures occurred by default; two followed acceptance of non-essential cookies. No Android client disclosed conversation URLs in the tested flows.
Routine tracking, shared links and later access
A user-created sharing link is a separate route from routine client traffic. In tests of sharing features across the services, generated conversation links could be viewed without authentication. Third-party elements on shared pages could also receive sharing-related information.
The researchers separately used canary URLs: unique test links that can register later requests. They recorded 70 later activations of Grok canary URLs, from 70 IP addresses in 14 countries. That result concerns requests to the study’s test links.
What cookie settings and account tiers changed
Rejecting non-essential cookies reduced some data flows, but 80.8% of third-party trackers remained active across the measured configurations. Avoiding unnecessary sensitive details in prompts and limiting public sharing where a service offers that control can reduce exposure; cookie rejection did not eliminate the tracking observed in these tests.
Free and premium consumer accounts had largely similar third-party tracking infrastructure in the tested configurations. In Claude’s Android client, Intercom and Sentry appeared in the free tier but not the premium tier. The study excluded enterprise and government tiers.
