Trackers ride along in every major AI chatbot: what an IMDEA study found flowing to ad networks

A conversation with an AI model feels like a closed room: no publication, no comment section, no audience. A study from the IMDEA Networks Institute describes something closer to a hallway with open doors. The researchers measured what nine of the best known AI services transmit over the network while you use them, and every one of the nine maintained connections to companies that the researchers classify as advertising or tracking services, 44 third-party organisations across the board. At several services the traffic included material taken directly from the conversation itself, from the share link of a chat down to its automatically generated title. This piece was prompted by the c't 3003 short from 08.10.2026 on trackers inside all nine major AI chatbots. What exactly gets transmitted, who receives it and whether a paid subscription changes any of it, this article works through on the basis of the study preprint and the reporting by heise online.

The IMDEA Networks Institute in Madrid recorded the network traffic produced when interacting with nine AI services: ChatGPT, Claude, Gemini, Grok, DeepSeek, Perplexity, Le Chat, Meta AI and Microsoft Copilot. The measurement campaign ran in May 2026 in Spain, on the web clients and, for eight of the nine providers, additionally through their Android apps. The test scenarios deliberately covered the full range of real world usage: as a guest, with a free account and with a paid subscription, each time with and without accepted cookies. The test conversations were invented health questions, for example about symptoms of early stage Parkinson disease. Those are exactly the kind of questions people actually type into chatbots, and exactly that material resurfaces later in the data flows. One caveat belongs up front: the study exists as an unreviewed preprint dated 16.09.2026, so the numbers come from a measurement campaign rather than a peer reviewed publication. The method is still easy to reason about, because it does nothing exotic, it simply records what a completely ordinary browser session leaves behind on the wire. A measurement like that is easy to repeat, and the direction of the finding lines up with independent reports, including the LiveRamp partnership through which ChatGPT interactions are prepared for advertising targeting, which heise online covered separately.

The headline result sounds restrained and is nonetheless a hard sentence for an industry that markets itself on trust: every one of the nine services communicated with at least one third party that the researchers classify as an advertising or tracking service. Across all services the researchers counted 44 organisations, with the exact set varying from test run to test run. Google trackers were the most widespread, appearing with every provider examined. Behind them follow Sentry, Meta, Datadog and Intercom, a mixture of the advertising ecosystem and ordinary product telemetry. The surprise entries are the interesting part: trackers belonging to TikTok, Apple and X turned up at individual services, companies that you would not instinctively associate with ad tracking inside an AI product. For the providers this means their privacy promises are not decided at the chat interface, they are decided by the whole supply chain of analytics, crash reporting and advertising tools that loads in the background. The chat is sold as a private room but travels over the same traffic infrastructure as any other website.

The real weight of the study sits not in the number 44 but in the payloads. On six of the nine web clients the researchers found data with a direct connection to a conversation: the URL of a chat, its identifier or its automatically generated title. Five of the nine providers share permalinks to full chat histories with data trackers when accessed through the browser. Where a chat, as with many providers, can be opened without access restrictions, a third party can follow that link and read the entire conversation. An automatically generated title sounds harmless until you consider what it reveals: one example from the study is a question about symptoms of early stage Parkinson disease, another a statement about an 85,000 dollar salary and the mortgage it might support in New York. About a third of the providers examined, precisely 33.3 percent, additionally transmit summaries of the conversations to their advertising partners, and in individual cases the user location is shared as well. The furthest reaching case, according to the analysis by c't 3003, was Grok: the last prompt and even a screenshot of the conversation reportedly ended up with TikTok. The researchers planted canary URLs in their test chats, decoy links that fire an alert the moment a third party retrieves them. At several providers those alarms triggered exactly when the chat was shared onward. At Grok the alarm kept firing several more times afterwards, which suggests outsiders accessed the chat repeatedly after the initial handoff. All of this travels attached to identifiers: Meta and TikTok cookies, hashed email addresses in the case of Perplexity, persistent user identifiers that keep running even in incognito mode. Through data brokers like LiveRamp and its RampID, such identifiers get merged across platforms into stable advertising profiles, and OpenAI uses the LiveRamp partnership, per heise reporting, to identify ChatGPT users for ad targeting.

There is one piece of good news: part of this data flow can be switched off. According to the study, rejecting non-essential cookies prevents 40 percent of the permalink disclosures. The bad news is the remaining arithmetic. In 60 percent of cases rejecting cookies changed nothing, and even the rejection scenario left 80.8 percent of the third party trackers active. Users who accept all cookies switch on additional trackers at some providers. The widespread assumption that a paid subscription buys privacy did not survive the measurement: free and premium customers were tracked by largely identical sets of third parties. That makes the finding equally uncomfortable for private and business users, because data discipline cannot reliably be purchased with money or with the right cookie banner choice. What remains is a sober inventory: structural control over these flows sits with the provider, not the user, and the cookie banner governs at best a small slice of the traffic generated by loading an AI website.

Anyone working with agents and long chat workflows pushes a steady stream of substance into such conversations: research findings, client names, drafts, sometimes credentials pasted as plain text notes. The study shows that an advertising and tracking layer runs behind the chat interface and that conversation material, titles, summaries and permalinks, can reach it. Chat sharing deserves particular attention, because permalinks are exactly what five of the nine services hand to trackers. A report link that an agent generates and sends to a team for review runs on the same mechanism. The identifier findings hit agent users twice: persistent identifiers that survive incognito mode tie work sessions to advertising profiles regardless of which browser window the research happened in. The value of the study is not any single scandal, it is the collapse of a working assumption many people carry: that an AI chat is a closed room. For day to day agent work the practical consequence is to treat the chat as a channel whose data flows you do not control.

The study is a preprint, unreviewed, and it carries the typical limits of a measurement campaign. The 44 third party organisations vary between test runs, so the exact count says more about the industry build pattern than about any single product. The measurement took place in Spain, and network traffic depends on the region: advertising tools are deployed per market, so a user in Germany will not see exactly the tracker set the test environment saw. The measurement covers web access and, for eight providers, the Android app, not the API, in other words precisely the channel most people chat through, but not the one agent infrastructure typically connects through. A measurement that shows data flows is not a measurement that proves economic harm, the evaluation sits between the two. That is exactly why the combination of traffic capture, canary URLs and the repeated external access at Grok is stronger than the raw number 44, because it shows the handoff does not stop at delivery.

An honest reading of this study starts with its limits: an unreviewed preprint, a measurement campaign in May 2026, provider counts that shift between runs. None of that retires the finding, because the direction matches the LiveRamp reporting and matches what any browser console shows when an AI service loads. For daily practice I draw three conclusions. First: no chat history is private while it runs through a web client that loads advertising trackers, so credentials, client data and health information do not belong there. Second: do not share permalinks containing sensitive content and audit existing shares, because that is the path through which third parties actually reach complete conversations. Third: decline the cookies where the option exists, but without illusions, because 80.8 percent of trackers stay active and a subscription demonstrably protects nobody. For agent workflows carrying real business value, the remaining route is an environment without advertising tracking, such as local models or contracts with verified data protection guarantees. The study does not measure those channels, so that is not a study result, it is a precaution rule. If an industry sells the chat as a private room while the traffic runs through the same ad networks as the rest of the web, that finding is not scaremongering, it is the receipt.

About the author: Marcel runs the HUNTER cyberdeck on a used Google Pixel 6a and writes about AI tooling, privacy and field operations with agents. This piece is based on the c't 3003 short from 08.10.2026, the IMDEA preprint dated 16.09.2026 and reporting by heise online. Last fact checked on 08.10.2026.