Research: AI Providers Share Conversation Titles, Prompts, and Screenshots With Ad Networks
A research paper published in September 2026 by IMDEA Networks researchers documents systematic data leakage from AI chat providers to advertising networks and third-party trackers.
The paper, titled “Prompt like a butterfly, sting like a tracker,” finds that multiple providers disclose sensitive conversation-derived artifacts — including titles, prompts, and screenshots — to third parties, often alongside persistent user identifiers that enable user attribution across sessions. Among the specific findings: Grok transmits screenshots to TikTok. The authors also find that some providers publicly expose conversation permalinks without access controls, allowing any tracker that obtains the link to read the entire conversation history.
What the Paper Found
The two categories of leakage operate through different mechanisms and carry different risk profiles.
The first is active transmission: conversation metadata sent directly to third-party domains during or after a session, paired with identifiers stable enough to build user profiles over time. This is the standard advertising-industry model applied to a data type — AI conversations — that users typically assume stays with the provider.
The second is passive exposure: shareable conversation URLs generated without authentication gates. Once a user or the platform shares such a link — through analytics telemetry, social media preview cards, browser prefetch, or link-shortening services — the full conversation becomes accessible to any party that captures the URL. The HN discussion flagged this specific pattern as already documented for multiple major AI platforms, including Perplexity and a prior incident in which Claude artifacts were indexed by Google at scale.
Why This Matters Now
AI chat usage has scaled to hundreds of millions of daily active users. The sessions often contain sensitive material: legal questions, medical symptoms, financial planning, work documents pasted in for summarisation. The implicit assumption of most users is that conversations stay private by default. The paper’s findings challenge that assumption with evidence from live provider behaviour.
The tracking model the paper documents is not a hypothetical attack vector — it mirrors standard practice from the web advertising industry, now applied to an interface that handles materially more sensitive data than the browsing sessions where that model was built.
The Access Control Problem
The permalink exposure issue is structurally different from intentional data sharing. Providers often allow conversation sharing for legitimate use — collaboration, citation, documentation. The failure is in treating a UUID-based URL as a privacy control. UUID-based links create the appearance of privacy without the substance: any system that touches the URL in transit can read what it points to.
Prior incidents — Claude artifacts indexed by search engines, Perplexity past-search URLs accessible without authentication — suggest this is an industry-wide design pattern rather than an isolated implementation bug.
Regulatory Position
The EU AI Act does not directly address the advertising data use of AI conversation content, and most national AI governance frameworks are silent on real-time telemetry from consumer AI applications. The paper’s publication comes as the EU prepares implementation guidance on AI system transparency requirements, with conversation data handling likely to become an active compliance question for providers operating in European markets.
No AI provider has publicly responded to the paper’s findings as of publication.