A Privacy Analysis of Web and Mobile Conversational AI Agents [pdf]
Points and comments are a snapshot, not live.
Conversational AI services expose sensitive conversation artifacts to third-party trackers.
A systematic privacy analysis of nine conversational AI services (web and Android) reveals that all integrate at least one third-party advertising or tracking service. Six of nine web clients and three of eight Android clients disclose conversation URLs, titles, prompts, and screenshots to third parties, often alongside persistent user identifiers. Some providers expose conversation permalinks without access controls, allowing trackers to read entire conversations. The study identifies 44 third-party organizations and shows that consent choices directly influence tracking exposure.
What commenters are saying
Commenters express strong disapproval, calling the practices a privacy breach and noting GDPR implications. Several highlight the severity of screenshots and exposed permalinks as attack surfaces. Some debate whether disclosures are accidental or deliberate, with one commenter noting companies' T&Cs contain weasel words. A few compare the practice to security-by-obscurity anti-patterns. There is skepticism about AI companies' operational competence, with mentions of vibe coding and rushed implementations.