Skip to content

Back to the catalog

jorgegarciaherrero.compaper

A Privacy Analysis of Web and Mobile Conversational AI Agents [pdf]

A Proceedings on Privacy Enhancing Technologies paper by IMDEA Networks researchers systematically analyzes the web (via instrumented Chrome/CDP) and Android (via Androguard static analysis plus dynamic instrumentation on a Pixel 3a) clients of nine conversational AI services — ChatGPT, Claude, Grok, DeepSeek, Gemini, Perplexity, Microsoft Copilot, Mistral's Le Chat, and Meta AI. They find every service embeds at least one third-party advertising/tracking service (44 third parties total), that 6/9 web and 3/8 Android clients leak conversation titles, prompts, or screenshots to trackers alongside persistent identifiers, and that several providers expose entire conversations via publicly accessible permalinks lacking access controls. The paper evaluates how consent choices, subscription tiers, and access-control settings shape this exposure and analyzes the practices against GDPR and the ePrivacy Directive, following responsible disclosure to providers and EU DPAs.

TL;DR PETS paper finds every major conversational AI service (ChatGPT, Claude, Grok, Gemini, DeepSeek, Copilot, Mistral, Meta AI, Perplexity) embeds trackers that can receive prompts, titles and screenshots, with some exposing entire chats via unprotected public permalinks.
Open original ↗
Document

What it is

"Prompt like a Butterfly, Sting like a Tracker" is a Proceedings on Privacy Enhancing Technologies paper from IMDEA Networks researchers (Oliveira, Sanchez, De Santa Olalla Gómez, Serna, Jackevicius, Garcia-Herrero, Girish, Suarez-Tangil, Vallina-Rodriguez) analyzing third-party tracking in nine conversational AI services' web and Android clients.

How it works

The analysis uses Chrome 148 with DevTools/CDP to capture HAR traces (HTTP(S) requests, JS execution, cookies, storage access) on web clients, and Androguard static analysis plus dynamic instrumentation on an AOSP build running on a Pixel 3a (Android 12) for mobile clients. Experiments varied three conditions: subscription tier (guest/free/paid), cookie-consent state (ignore/reject/accept), and browser mode (default/incognito), run in Spain during May 2026. Services were selected via Tranco rank (web) and Google Play install counts (mobile), not market-share data. The paper's threat model (Figure 1) frames the first party's client and backend as separate disclosure points, with conversation artifacts (ConvId, ChatURL, SharedID, title, prompt, screenshot) flowing to embedded third-party SDKs alongside persistent identifiers (UserID, DeviceID, AnonID, OrganizationID, HEM).

Preconditions / Affected

Table 1 gives exact scope: ChatGPT (chatgpt.com / com.openai.chatgpt, Tranco #48, >1B installs), Claude (claude.ai / com.anthropic.claude, #617, >10M), Grok (grok.com / ai.x.grok, #956, >100M), DeepSeek (chat.deepseek.com / com.deepseek.chat, #1,196, >50M), Perplexity (#1,249, >100M), Gemini (gemini.google.com / com.google.android.apps.bard, #6,045, >1B), MS Copilot (copilot.com, #11,011, >50M), Mistral Le Chat (chat.mistral.ai, #12,039, >1M), Meta AI (meta.ai / com.facebook.stella, #13,701, >50M). All nine have web clients; eight (all but one unspecified) have Android clients analyzed.

Caveats

The paper notes it deliberately traded breadth for depth, selecting nine services by popularity proxies (Tranco rank, Play install counts) rather than verified market-share data, since reliable per-provider market share figures don't exist. The fetched text cuts off mid-methodology (§4.2 Website Analysis), before the consent/subscription-tier results, the specific per-service breakdown of the 6/9 web and 3/8 Android leak findings, or the legal analysis — those are in the existing summary but not detailed further in the retrieved text.

Organisations named here

  • Android Advertising ID
  • ePrivacy Directive
  • GDPR
  • hashed email address
  • Identifier for Advertisers

Technologies named here

  • Google Chrome DevTools
  • ChatGPT
  • Claude
  • Androguard
  • Grok
  • Instrumented AOSP
  • DeepSeek
  • Tranco rankings
  • Perplexity
  • Google Play installation counts
  • Gemini
  • MS Copilot
  • Mistral Le Chat
  • Meta AI
  • Android

Techniques named here

  • Conversation-derived artifact disclosure
  • Cookie-consent-gated tracker activation

Related in AI Security