There is something psychologically different about talking to an AI assistant. A search engine asks you to enter a few keywords and gives you a list of websites. A social network asks you to post something publicly. But an AI chatbot invites you to explain yourself. You can describe a health problem, ask about your finances, discuss a relationship, paste a confidential document or tell the system what you are planning to do next. The interface feels less like a website and more like a conversation.
That sense of privacy is precisely what makes a new study from researchers at the IMDEA Networks Institute so significant. Their investigation into nine conversational AI services and eight Android applications found that every service examined contacted at least one advertising or tracking service. More importantly, six of the nine web clients and three of the eight Android apps transmitted conversation-derived information to third parties, including chat URLs, automatically generated titles, prompts or screenshots. In some cases, those data were accompanied by persistent identifiers that could make it possible to associate the information with a particular user.
The researchers' point is not simply that AI companies collect data. Most users already assume that an online service stores some information about their activity. The more unsettling discovery is that the tracking machinery surrounding conversational AI can gain access to artifacts that describe the substance of a conversation. That creates a fundamentally different privacy problem from traditional web tracking.
The Tracker Does Not Need Your Entire Conversation
Imagine asking an AI assistant about the symptoms of an illness. The complete exchange might never be handed to an advertising company. But the system could automatically generate a conversation title such as "Early-stage Parkinson's Symptoms." If that title is then transmitted to a third-party analytics or advertising service together with an identifier, the third party does not need the entire conversation to learn something potentially sensitive about the user.
The same principle applies to financial questions. A conversation about a salary, mortgage or investment decision can generate a title that summarizes the subject of the discussion. The study documented examples in which automatically generated conversation names contained information about health conditions and financial circumstances. The researchers found that such conversation-derived information could be sent alongside identifiers, making it more meaningful than an anonymous piece of text floating through the internet.
This is what makes AI tracking different. Traditional advertising technology has spent decades learning what people read, where they shop and which websites they visit. Conversational AI can potentially expose something much more intimate: what people are worried about, what they are considering and what they are trying to understand.
The Web's Tracking Infrastructure Has Followed AI Into the Chat Window
The researchers found that conversational AI services are not isolated from the wider web ecosystem. They are built with many of the same technologies used by ordinary websites and mobile applications, including analytics systems, advertising services and third-party tracking infrastructure.
IMDEA's researchers identified third-party services associated with companies including Meta and Google among the systems involved in the tested environments. Their analysis also found that privacy controls did not always produce the level of isolation a user might expect. Rejecting non-essential cookies reduced some third-party activity, but trackers remained active in several products.
That matters because the conventional mental model of privacy is becoming increasingly outdated. Users are accustomed to thinking about cookies, browser history and advertising IDs. But an AI assistant introduces a new layer: semantic data. Instead of simply recording that someone visited a mortgage website, an AI system may know that the person is worried about their salary, considering a house in New York and wondering how much they can afford to borrow.
That information is far more difficult to reduce to a simple page-view category.
Sometimes the URL Is Enough
One of the study's most concerning findings involved conversation links. Some AI services use shareable or permanent URLs to represent conversations. In certain implementations, researchers found that those links could be exposed to third-party trackers.
The problem becomes more serious when access controls are weak. According to IMDEA, some services exposed conversation permalinks in ways that could allow anyone possessing the URL to access the underlying conversation. In its analysis, the researchers specifically highlighted Grok and Perplexity as examples where conversation URLs could reach third-party trackers, while some shared conversations could be accessed without strong authentication controls.
A URL may look harmless. It can be nothing more than a long sequence of letters and numbers. But if that URL points directly to a private conversation, the URL effectively becomes a key to the conversation.
That creates an uncomfortable privacy paradox. A user may never intentionally send their conversation to an advertising company. They may simply open an AI service, have a conversation and allow the page to load its normal analytics infrastructure. Yet the surrounding technology can potentially reveal the existence or identity of that conversation to another company.
Screenshots Make the Problem Even More Concrete
The study found an even more striking example in Grok's sharing environment. Researchers observed cases in which screenshots and other conversation-related information could be transmitted to third parties. According to reporting on the study, a shared Grok page sent a screenshot and the latest prompt to services including Google, Meta and TikTok in the tested scenario.
A screenshot is fundamentally different from a cookie.
A cookie might reveal that a browser belongs to a particular user. A screenshot can reveal what the user actually said.
That distinction matters because AI conversations often contain information that people would never intentionally publish. A user might paste an email, upload a contract, describe a medical problem or ask for help with a sensitive personal decision. If an image containing that conversation enters another company's infrastructure, the privacy issue is no longer theoretical metadata collection.
It is the potential exposure of the conversation itself.
AI Tracking Could Become More Valuable Than Web Tracking
The advertising industry has historically depended on behavioral signals. What websites do you visit? What products do you look at? Which advertisements do you click? Where are you located?
AI assistants could produce something more valuable: intent signals.
Someone searching for running shoes may or may not buy running shoes. Someone telling an AI assistant, "I have a marathon in six weeks and need shoes for a flat foot," has revealed considerably more. Someone searching for mortgages provides one signal. Someone asking an AI assistant to calculate whether their salary can support a $350,000 mortgage provides another.
The distinction is between behavior and intention.
A conventional tracker observes what you did. A conversational assistant can observe what you are considering doing.
That makes AI potentially one of the richest sources of behavioral intelligence ever created. It does not simply know which content attracted your attention. It can be told directly what you want, what you fear and what you plan to do.
The Mobile Problem Is Different, But No Less Important
The IMDEA research also examined Android applications because the privacy environment changes when an AI assistant moves from the browser into a mobile app. Apps operate within an ecosystem involving advertising identifiers, analytics libraries, permissions and platform-level tracking mechanisms.
The researchers found conversation-derived data reaching third parties in three of the eight Android applications they tested. The web and mobile results were not identical, which is itself important: privacy cannot be assessed simply by looking at the AI provider's website or reading its general privacy policy. The way information moves can depend on the particular client through which a user accesses the service.
This distinction will become even more important as AI assistants become embedded into operating systems. The next generation of AI may not live inside a browser tab at all. It could sit across your phone, computer and wearable devices, reading context and acting on your behalf.
At that point, the question will not be merely what a chatbot knows.
It will be what the entire agent ecosystem can observe.
The Agent Era Could Multiply the Privacy Surface
Today's chatbot largely waits for you to type a question. Tomorrow's AI agent may have permission to browse the web, read your email, access files, compare products, make reservations, fill out forms and communicate with other services.
That is a profound expansion of the privacy surface.
An AI agent helping someone book a flight might know their destination, travel dates, budget and passport information. An agent managing work might see internal documents and correspondence. An AI health assistant could have access to years of health information. An agent managing household finances could potentially understand income, debt, purchases and future plans.
The more useful the agent becomes, the more information it needs.
And the more information it needs, the more important it becomes to understand every company sitting between the user and the AI.
The traditional web privacy model was already complicated: user, website, analytics provider, advertising network and data broker. AI agents could add another layer in which the assistant itself continuously interprets the user's intentions and transforms them into structured actions and data.
Privacy Policies May Not Tell the Whole Story
Another important finding from the researchers concerns transparency. IMDEA said some privacy policies acknowledged advertising trackers or data sharing with business partners without clearly explaining that actual conversation-derived information could become part of those flows.
This creates a problem that goes beyond technical implementation.
Users can only make meaningful privacy decisions if they understand what is happening. A consent banner that says a website uses analytics cookies communicates one thing. It does not necessarily communicate that an AI-generated conversation title describing a medical concern, financial situation or personal problem could become visible to an external service.
The researchers therefore examined the issue through the lens of European privacy law, including the GDPR and ePrivacy Directive, and reported their findings through a responsible disclosure process involving affected providers and European data-protection authorities.
The legal questions will ultimately be decided by regulators and courts. But the technological question is already clear: AI has created new forms of data that existing privacy expectations were not designed around.
This Does Not Mean Every AI Company Is Selling Your Chats
There is an important distinction that should not be lost in the alarm.
The research does not establish that every third-party company receiving tracking data is reading users' complete conversations or selling those conversations to advertisers. The researchers documented data flows and potential exposure, not proof that every recipient exploited the information for advertising purposes.
That distinction matters because "AI companies are selling your private conversations" is a much stronger claim than the evidence supports.
The more defensible conclusion is more unsettling in a different way: AI conversations can enter tracking ecosystems in ways users may not expect, and some of the information exposed can be surprisingly revealing.
That is enough to justify scrutiny without overstating the evidence.
The Privacy Question AI Companies Need to Answer
The technology industry has spent years telling users that AI assistants are personal. They are positioned as companions, researchers, tutors, programmers and increasingly as agents capable of acting on our behalf.
If that is the future, privacy cannot be treated as a secondary feature.
An AI assistant should ideally make it clear when information leaves the service, which third parties receive it, what identifiers accompany it and whether those parties can reconstruct or access the underlying interaction. Shared conversations should require meaningful access controls rather than relying on the obscurity of a long URL. And users should not have to become network-security researchers to understand whether a private conversation is being exposed.
The burden should be on the platforms to make these boundaries understandable.
The Most Valuable Data May Be the Question You Asked
The internet's first privacy crisis was largely about what people did online. Search engines recorded queries. Social networks recorded relationships. Advertising networks followed users from site to site.
Conversational AI introduces something more intimate.
It records—or can potentially expose—what people say when they are trying to think.
That may ultimately be the most valuable behavioral data of all.
The irony is that AI's greatest advantage is also its greatest privacy challenge. The reason people find conversational systems useful is that they can explain themselves in ordinary language. They do not need to know the right keywords. They can describe a problem, reveal context and ask the machine to figure out what they mean.
That convenience produces incredibly rich data.
So the phrase "Prompt like a butterfly, sting like a tracker" captures something important about the next stage of digital privacy. The prompt may feel fleeting, private and conversational. But behind the elegant interface sits a complex network of servers, analytics tools, identifiers and third parties.
And in the age of AI, the thing being tracked may no longer be simply where you went.
It may be what you were thinking about when you got there.