AI Chatbots share sensitive user data with third-party advertisers

A study by the Spanish institute IMDEA Networks reveals that major AI conversational services, including ChatGPT, Gemini, Claude, and Grok, share user information with dozens of third-party companies to fuel the online advertising ecosystem.

The report, titled ‘Prompt like a Butterfly, Sting like a Tracker’, indicates that data sharing extends beyond simple metadata. Five of the nine services studied transmit permalinks to complete chat histories, potentially allowing third parties to access entire conversations. Additionally, automatically generated summaries of discussions—covering sensitive topics such as medical symptoms or financial inquiries—are shared alongside unique identifiers to build detailed health and financial profiles.

In the case of Grok, the study found that prompts and screenshots are sent directly to Meta and TikTok. Furthermore, the research suggests that standard privacy measures, such as refusing non-essential cookies, are largely ineffective, with 80.8% of trackers remaining active.

Separately, regarding Mistral AI’s Vibe services, data retention policies vary by product. While Mistral acts as the data controller under GDPR, prompts and generated responses are stored until the user manually deletes the conversation or account. While the API offers a zero-retention guarantee, this does not apply to the Vibe Chat interface.