Quick Take
- The audit: Stony Brook University researchers tested 42 AI chat platforms in May 2026, 25 general-purpose assistants and 17 specialized health, legal and education bots.
- The leak: 21 platforms sent conversation titles to third-party trackers, and 9 sent users’ verbatim prompts. On almost every leaking platform the user’s email address went out as well.
- Who receives it: More than 70% of tracker traffic went to four companies: Google, Microsoft, ByteDance and Meta. The paper is accepted at IEEE Symposium on Security and Privacy 2027.
People tell AI chatbots things they would never type into a search engine. A new measurement study by Paschalis Bekos, Billy Tsouvalas, Nick Nikiforakis and Michalis Polychronakis of Stony Brook University, “Penny for Your Prompts”, shows that on many platforms this context does not stay between user and chatbot. Advertising and analytics scripts embedded in the chat interfaces pick up conversation titles and prompts and send them to third parties, often together with an identifier that links them to a real person.
What the study shows
The team used an instrumented browser with consent banners accepted, logged in with dedicated test accounts and submitted test prompts from a US East vantage point between May 6 and 20, 2026. They then searched all outgoing network traffic for the prompt text, the generated conversation title and the account email address, including encoded and hashed forms.
- Heavy tracking per prompt: General-purpose platforms triggered 540 network requests per prompt on average, 118 (22%) of them to trackers. The sessions reached 153 unique tracker domains, 13 per session.
- Prompts in the clear: Four general-purpose platforms leaked raw prompts. You.com sent the prompt in 92 requests per prompt to Google, partly because it sat in the page URL; Writesonic sent it to three different endpoints.
- Linkable to a person: 11 of the 13 leaking general-purpose platforms also exposed the user’s email address. On 8 of them, the same company received both, sometimes in the very same request, as with Writesonic and You.com.
- Specialized bots are worse: Health, legal and education platforms averaged 353 requests per prompt, with 39.7% going to trackers. 8 of 17 leaked conversation titles and 5 leaked verbatim prompts; all 8 also sent the email address.
- Sensitive examples: Health chatbots leaked verbatim prompts such as “I’ve been feeling really anxious and having trouble sleeping lately”, and legal bots sent prompts discussing a user’s immigration status. Conversation content always went out in plaintext; education and legal platforms mostly hashed the email (SHA-256), while the leaking health platform sent it unencrypted. The legal chatbot AI Lawyer sent the conversation title and the email to Meta and ByteDance in the same request.
| Tracker company | Share of tracker requests |
|---|---|
| 41.8% | |
| Microsoft | 12.2% |
| ByteDance | 8.6% |
| Meta | 8.3% |
Why it matters: chat logs as ad signals
- Not a hack, but default tooling: The leaks come from ordinary marketing and analytics tags. On 8 of 9 platforms analyzed in detail, scripts read the browser’s page title, which many chat apps set to the conversation title. Meta’s pixel queried the title on 5 platforms; Microsoft Clarity’s session recording captured on-page text including the raw prompt.
- Contradicting privacy policies: Several platforms state in their policies that they do not sell or share conversation data for advertising, while their pages send that data to ad networks.
- Big names affected, then fixed: During the study period, ChatGPT and Grok also had trackers collecting conversational context. Both removed them, which the authors verified before submission.
- Disclosure: The authors notified all affected platforms. Manus, Kimi, QuillBot and SciSpace forwarded the reports, Genspark and Chaton acknowledged them and TheLawGPT fixed the issue.
Method in brief
Sample: 42 web chat platforms with free accounts, general-purpose ones selected from SimilarWeb’s popularity ranking; general-purpose platforms were tested with a Gmail and a non-Gmail account. Instrumentation: the instrumented browser VisibleV8 logged network traffic and every JavaScript API access. Third-party domains were mapped to their parent companies and checked against the Disconnect and DuckDuckGo Tracker Radar lists. Detection: searches for prompt, title and email in raw, URL-encoded and hashed form. Attribution: separate sessions for five interactions (prompt submission, chat navigation, chat deletion, scrolling, button click) to isolate what triggers a leak. Review: accepted at IEEE S&P 2027 with artifact badges for availability, functionality and reproducibility; the artifact is on Zenodo.
What remains open
- A snapshot: One vantage point in the US, two weeks in May 2026 and a limited number of sessions per platform. Tracker setups change often, as the ChatGPT and Grok fixes show.
- Consent accepted: All tests accepted cookie banners. Users who reject tracking may see less leakage, which the study did not measure.
- Web only: Mobile apps, desktop clients and paid tiers were not tested.
- What trackers do with it: The study shows data arriving at third parties, not how it is stored, combined or used for ad targeting.
Context: privacy beyond model training
Debates about chatbot privacy have mostly focused on whether providers train models on user conversations. This study points to a more mundane channel that web privacy researchers know from health and tax websites: third-party pixels on the page itself. With AI assistants now handling medical and legal questions, the same tags carry far more sensitive content. More research on how AI affects users and markets is collected under Society & Economy.
What it means for users and platform operators
- For users: Rejecting non-essential cookies, using tracker blockers and avoiding names or identifying details in prompts reduce exposure. Assume the conversation title may be visible to third parties.
- For operators: Do not put conversation titles or prompts in page titles or URLs, disable autocapture and session replay on chat views, and audit which tags run on authenticated pages.
- For health and legal services: Treat chat pages like patient portals: no advertising pixels at all.
- For regulators: The gap between stated privacy policies and observed data flows is measurable and reproducible.
Coverage of the major assistants is on the OpenAI, ChatGPT and Grok hubs.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This article is based on the full text of “Penny for Your Prompts: A Measurement Study of Contextual Leakage in AI Chat Platforms” (arXiv:2610.37467v1, submitted October 27, 2026), including the appendices and the IEEE S&P meta-review. All numbers come from the paper; i10X did not repeat the measurements. The chart and table were created by i10X from figures reported in the paper. AI tools assisted with research and drafting; the selection, fact-checking and final editing were done by the i10X editorial team.
i10x Perspective
The finding is less about AI than about the web’s advertising plumbing meeting a new kind of content. A conversation title such as a health question is a far richer signal than a page view, and the scripts that collect it were never designed with that in mind. The quick fixes by ChatGPT and Grok show the problem is solvable. For specialized health and legal chatbots, removing ad trackers from chat pages should be the minimum standard.
