The illusion of privacy: AI that spies on your conversations

The end of confidentiality in AI chats

Over the last two years, Artificial Intelligence assistants have gone from being technological curiosities to becoming personal diaries, work tools, and legal advisors. However, a recent study conducted by researchers from IMDEA Networks and the Carlos III University of Madrid has dismantled the perception of privacy surrounding these platforms. What began as a private interaction between a user and a machine has, in practice, transformed into an open window into the vast ecosystem of digital advertising tracking.

What is really happening?

The analysis, carried out in May 2026 on nine assistants (ChatGPT, Gemini, Claude, Grok, Perplexity, DeepSeek, Microsoft Copilot, Mistral, and Meta AI), shows that these tools do not operate in a vacuum. When interacting with them, users are actively or passively transmitting information to third parties. The study, accepted at the prestigious Privacy Enhancing Technologies Symposium (PETS), identified 124 third-party domains connected to these platforms, linked to 44 organizations. Of these, 34 belong directly to the advertising and tracking ecosystem, including giants like Google Ads, Meta, and TikTok.

This phenomenon is not new to the web, but its application in generative AI is qualitatively different. Historically, tracking was limited to browsing habits. Here, the object of tracking is semantic content: the ideas, work problems, or confidences that the user pours into the chat. The research revealed that six of the nine web versions analyzed and three of the eight Android applications expose critical interaction metadata.

The architecture of invisible tracking

The architecture of these applications has been designed by prioritizing analytics over privacy. The study details how assistants share the conversation URL and, in more serious cases, the chat title or direct snippets of messages. A paradigmatic case is that of Grok: according to the researchers, when sharing a conversation, platforms like TikTok receive screenshots, while Meta and TikTok access the user's last message along with persistent identifiers.

This practice, although often covered under terms of service, creates a surveillance infrastructure that links the user's identity with the generated content. Unlike traditional session cookies, contextual information is being sent here to third-party services that the user often does not even know are integrated. The integration of trackers is not a technical error, but a design decision that prioritizes the advertising business model over confidentiality.

The myth of cookies and the illusion of control

One of the most revealing findings of the study is the ineffectiveness of current consent mechanisms. The researchers concluded that, even after actively rejecting non-essential cookies in legal notices, 80.8% of third-party trackers remained active. This data is crucial: it highlights that consent management platforms (CMPs) are, in many cases, a technical facade incapable of stopping telemetry integrated directly into the applications' codebase.

Comparatively, this is reminiscent of the mobile app era of the early 2010s, where passive tracking was the norm. However, the current risk is greater due to the sensitive nature of the data. While previously it tracked what shoes you bought, now it tracks how you draft a dismissal letter or what business strategy you are designing.

Implications for the future of work

For the business environment, this finding is a turning point. The massive adoption of AI in the office has been dizzying, often outpacing corporate IT security policies (Shadow AI). If employees use these tools to summarize meeting minutes, analyze financial reports, or draft contract templates, they are, unintentionally, exposing intellectual property to external advertising networks.

The transition toward corporate AI requires, therefore, a rigorous audit and, preferably, migration toward private instances or locally deployed models (On-premise). Trust in commercial assistants must be re-evaluated: although AI companies claim that their models are not trained on user data, the study demonstrates that metadata leakage occurs long before training even begins. It is a fundamental lesson: in the AI economy, the user is not just the customer, but also the source of data that feeds an invisible advertising network.