IMDEA Networks researchers found conversation-related data disclosures in six of nine web clients and three of eight Android clients during tests in Spain in May 2026. The study examined nine AI services on the web and eight on Android, with results tied to the account settings and test conditions researchers used. The IMDEA Networks study
What the researchers observed
The study covered ChatGPT, Claude, Grok, DeepSeek, Perplexity, Gemini, Microsoft Copilot, Le Chat and Meta AI. Researchers examined conversation-derived details—including titles, prompts, screenshots, identifiers and conversation links—that some clients sent to third-party advertising and tracking services.
| Client type | Clients tested | Clients with observed conversation-data disclosures |
| Web | 9 | 6 |
| Android | 8 | 3 |
The ChatGPT tests, for example, recorded conversation identifiers sent to Datadog; some web test conditions also exposed a conversation URL. That is a finding about the tested clients and conditions, not a measure of everything OpenAI stores or how every ChatGPT session behaves.
Cookie rejection reduced some tracking, but not all
In web tests, researchers compared ignored, rejected and accepted choices for non-essential cookies. After researchers rejected those cookies, 80.8% of the observed third-party trackers remained active. Separately, trackers still collected data in four of the nine services. The first figure counts trackers; the second counts services.
Android apps generally did not offer an equivalent cookie-consent choice at launch. So the web and Android results reflect different opportunities to make a cookie choice, as well as different tested client samples.
Public links created another route to exposure
In the tested configurations, Grok web conversation permalinks in free and paid tiers were publicly accessible by default unless users opted out. Perplexity guest-tier conversation links were also publicly accessible. Researchers tested shared conversations in separate sessions without signing in. On Grok share pages, they observed a screenshot sent to TikTok and the latest prompt sent to Meta and TikTok.
These link-sharing findings concern specific settings and flows tested by the researchers. They show why a share link deserves particular care: a person opening a tested shared page did not need to authenticate.
What the canary links revealed
Researchers placed unique canary URLs in prompts and uploaded documents to detect later requests to those resources. For Grok-related resources, they recorded 70 activations from 70 IP addresses across 14 countries, with requests arriving from hours to days after submission. An activation records a request to a URL; it does not identify a person who read the conversation.
How to interpret the results
The tests took place in Spain in May 2026. Researchers entered predefined conversations manually and compared account tiers, login states, cookie choices and privacy settings. Web traffic was examined using Chrome 148.0.7778.167 Developer Tools; Android testing used a Google Pixel 3a running Android 12.
The study excluded enterprise and government tiers and did not cover every interaction path. Researchers also could not extract traces for Gemini’s Android app. The results are point-in-time observations that may differ with geography, account state and later service changes.
