Tracking Conversations: Measuring Content and Identity Exposure on AI Chatbots

TL;DR

This study systematically measures web tracking on 20 popular AI chatbots, revealing widespread sharing of conversation content and user identity with third parties, including some sharing plaintext chats and user identifiers.

Contribution

It provides the first comprehensive analysis of tracking practices on AI chatbots, highlighting privacy risks and exposure of sensitive information.

Findings

17 of 20 chatbots share information with third parties

3 chatbots share plaintext conversation snippets with Microsoft Clarity

15 chatbots share URLs or identifiers with advertising and analytics services

Abstract

AI chatbots are becoming a primary interface for seeking information. As their popularity grows, chatbot providers are starting to deploy advertising and analytics. Despite this, tracking on AI chatbots has not been systematically studied. We present a systematic measurement of web tracking on 20 popular AI chatbots. Under controlled settings using a sensitive prompt, we capture and compare network traffic in normal chats and, where supported, private chats. We search for exposure of two categories of information: content, including prompts, prompt-derived titles, chat URLs, and chat identifiers; and identity, including names, emails, account identifiers, first-party cookies, and explicit IP/User-Agent fields in payloads. We find that 17 of 20 chatbots share information with at least one third party. Three chatbots share plaintext conversation text, including both prompt and response snippets, with Microsoft Clarity through session replay. Fifteen chatbots share conversation URLs or chat identifiers with third-party advertising, analytics, or social endpoints. Several chatbots expose user identity through support widgets, analytics, advertising, and session replay tags; in some cases, hashed emails are shared.