Overview
- Researchers at the IMDEA Networks Institute tested nine web chat services and eight Android apps and found at least one external advertising or tracking provider in every service, totaling 44 distinct third parties.
- Six of nine web services and three of eight apps transmitted conversation links, titles, user inputs or screenshots to external companies, and three providers automatically sent generated chat summaries to partners.
- The team used Canary‑URL tokens to confirm external accesses and identified weak permalink controls in services including Grok and Perplexity that could let trackers retrieve full conversations.
- Rejecting optional cookies or using private/incognito modes did not reliably stop tracking, with the study reporting about 80.8% of third‑party trackers remained active when optional cookies were declined.
- Recipients named by the researchers include major ad and analytics ecosystems such as Google, Meta Pixel and TikTok plus monitoring firms like Sentry, Datadog and Intercom, raising risks that persistent identifiers and shared summaries could link sensitive topics across services and re‑identify users.