You Turned Off Training. Your Prompt Still Walked Out the Door

What 42 chat platforms leaked in May 2026

Start with who counted. Bekos, Tsouvalas, Nikiforakis and Polychronakis, from Stony Brook University, audited 42 AI chat platforms with a web interface: 25 general-purpose assistants and 17 built for one field — education, health and legal advice. The measurement window ran from 6 to 20 May 2026, from a single US-East vantage point, with the cookie banner accepted, because that is what an ordinary visitor does.

The result is blunt. Of the 42, 21 sent the title of the conversation to a third-party tracker, and 9 sent the literal prompt the person had typed. In the general-purpose group alone, 13 of 25 leaked the title and 4 leaked the prompt text.

Scale matters more than the count of platforms. Each prompt typed into a general assistant produced 540 outbound requests, of which 118 — 22% — went to a domain on a known tracker list. Across the sessions they measured, the researchers logged 153 unique tracker domains, about 13 per session.

And the traffic is not spread thin. Google took more than 40% of tracker requests, Microsoft 12.2%, ByteDance 8.6% and Meta 8.3% — over 70% in the hands of four companies. The concentration is what makes this a decision a small firm can act on rather than a fog of risk.

The findings do not stand alone. A second team, Jazlan, Wang, Vekaria and Shafiq at UC Davis, measured 20 popular chatbots in normal sessions and found 47 distinct third-party owners and 178 distinct chatbot–third-party pairs. Seventeen of the 20 shared something with at least one third party during a single ordinary conversation, and three — Genspark, SeaArt and ChatOn — sent conversation text in clear to Microsoft Clarity, a session-replay tool.

Two details from the Stony Brook work keep this from reading as a vendor scandal. Some platforms were cleaner than the headline: Gemini, Meta AI and Duck.ai contacted no third party at all in the UC Davis sessions. And ChatGPT and Grok removed the trackers the researchers found during the study, before the paper was submitted: the count is a photograph of one fortnight, not a permanent property of any product.

What it does establish is a specific failure of expectation. You can read every privacy page, switch off model training, and still be running a tab that quietly ships the first thing you typed — often the customer's name, the part number or the job that prompted the question — to an advertising network you never chose.

The leak is not the training setting

Every guide to using AI at work, including the ones we write, tells you to turn off model training and to redact names before you paste. Both are good habits. Neither one closes the channel the Stony Brook team measured, because the data does not leave through the model — it leaves through the page around the model.

The mechanism is almost boring. The chat platform treats each conversation as a sub-page and writes a title for it, generated from your first prompt. Trackers running on that page read the title with a single DOM call: document.title on eight of nine platforms studied, or document.querySelector("title") in the case of the Meta Pixel. Microsoft Clarity goes further and walks the DOM reading text and input values. You.com puts the prompt into the page URL, where advertising parameters pick it up. None of this requires access to the model, the account or the API — only to the web page you are already looking at.

That is why the write-up in the paper points at a gap between the privacy policy and the plumbing. Several platforms state that data is not sold or shared for targeted advertising while advertising pixels are operating on the same page and collecting conversational context.

Identity travels with it. Of the 13 general-purpose platforms that leaked context, 11 also sent the registration email address, and on 8 of them a single company received both the email and the conversation context. On Writesonic and You.com the two travelled in the same request. Across the measurement, Google collected context from 8 platforms in 230 requests, Meta around 55. On the legal and health platforms the leak rate was higher, not lower: 39.7% of requests went to trackers, against 22% for general assistants.

The policies are not a reliable map. In the UC Davis study, 8 of the 20 privacy policies did not name a single one of the third parties that were observed receiving data; ChatOn, SeaArt and Genspark name some recipients but leave out the session-replay vendor entirely. If you read the policy to decide whether a tool is safe, you are reading a document that is, in a quarter of the cases measured, incomplete about where the traffic goes.

One thing worth keeping in proportion: this is a leak of context, meaning the title, the prompt, the URL, the account email. It is not, in the platforms measured, a recording of your whole conversation being uploaded — except in the three cases where session replay captured text in clear. The damage you are managing is the first line you typed, sitting in an ad network's logs alongside your email address, attached to a named business account.

What a ten-person firm exposes, in numbers

Abstract counts are easy to wave away. Put your own company in the arithmetic instead, and keep every assumption visible.

Assume a firm of ten people where four staff use an AI assistant for customer replies, quotes and product descriptions — six prompts each on a working day. That is 24 prompts a day, about 6,000 in a year at 250 working days. On a general-purpose platform measured in the study, each prompt generated 540 outbound requests, 118 of them to tracker domains. Do the multiplication: 2,832 tracker requests a day, roughly 708,000 a year, from four people doing their job.

Those are requests, not conversations, and you should say so when someone quotes it back at you. The second number is the one that stings. Of the 42 platforms audited, 21 pushed the conversation title out and 9 pushed the literal prompt. On You.com, the researchers counted 62 requests per prompt carrying the conversation title to Google and 92 carrying the prompt text itself. One question typed by one person, with the customer's name inside it, becomes 92 logged requests to a third party.

Now the counterfactual, because it is where the decision lives. If the same four people used the assistant's private or temporary mode, the UC Davis measurements found third-party pairs dropping from 178 to 13 and third-party owners from 47 to 3, with no content or identity exposure observed in any private session. Same platform, same model, same quality of answer. One toggle.

The trade-off is friction: no conversation history to scroll back through, no "that reply from last month" to reuse. For a firm that treats the assistant as a search box with better grammar, it costs nothing. For one that has built a library of prompts and saved threads, it removes a feature you rely on — which is why the next section is about choosing per person rather than switching everything.

Include the email address in the arithmetic too, since it is the part that turns an anonymous request into an identified one. On 8 of the 13 general-purpose platforms that leaked context, the same company received both the conversation context and the account email; on 2, they went out in a single request. If your team uses a shared info@ account for the assistant, every one of those requests points at the same mailbox.

Pick the access route on purpose

The useful question is not "which assistant is safe" — the answer changes with the version, the region and the fortnight. It is "which route into the assistant are we using, and for what kind of content". Four routes cover almost everything a small firm does, and they are not equally safe for the same task.

The fourth row is the one people reach for too fast. Running a model locally removes the web page, and with it this class of leak, but it does not remove the provider problem if you still paste the same text into a hosted service in the afternoon. Match the route to the content, not to your mood about vendors.

There is a sharper reason to prefer private mode over "just be careful". A separate analysis of web and mobile conversational agents by IMDEA Networks and co-authors found that some providers expose permanent conversation links with no access control, which turns a leaked URL into a readable transcript rather than a fragment. When the tracker's only artefact is a title, the exposure is small. When it is a permanent link, it is the conversation.

If you want the least work for the most reduction: put private mode on by default for everyone, and allow the ordinary signed-in chat only for text you would be comfortable seeing in a competitor's ad dashboard. That rule needs no technical knowledge to apply and survives every product update.

The Monday-morning version: five things to change

None of this takes a project. It takes one meeting and a few settings, and the order matters because the first two steps protect you even if the rest never happen.

1. Turn private or temporary mode on by default for every account that touches customer text. It is a switch inside the product, it costs nothing, and it is the single change with measured effect: third-party owners fell from 47 to 3 in the sessions where it was active.
2. Write one rule about content, not about tools: no customer names, no bank details, no health or ID numbers, no contracts, in any public chat window. Australia's privacy regulator recommends exactly this as good practice — organisations should not enter personal information, and especially sensitive information, into publicly available generative AI tools.
3. Look at what the page talks to, once. Open the assistant, open your browser's developer tools on the network tab, type one prompt, and read the domain list. Fifteen minutes, no expertise needed beyond recognising the name of an ad network, and it tells you more about your own tool than the privacy policy does.
4. Move the people who need history onto a tier that has business terms. OpenAI states that business and API data is not used for training by default, with AES-256 at rest, TLS 1.2+ in transit and zero data retention available for qualifying API organisations. Read that commitment for what it covers: the provider's handling of your data — not the pixels on a marketing page, and not the behaviour of a third-party plug-in you installed on top.
5. Put it in your records. If the assistant processes anything that identifies a person, the purpose has to be one you can defend: the organisation carries the burden of showing that the person would reasonably expect it. A line in the same document where you list your other processors is enough for most small firms.

That list is deliberately ordered from cheapest to hardest, and you can stop after step two and still be well ahead of most companies your size. Steps three to five are for the firm that has already decided the assistant is staying in the workflow, which is a different conversation from whether it should be.

One thing to avoid: banning the tools outright. The research does not show that chat assistants spread customer data everywhere — it shows that a specific, closed layer does, on about half the platforms, and that the fix sits inside the product. A ban drives the same usage onto personal phones and personal accounts, where none of these settings are under your control at all.

When you can ignore all of this

Plenty of small firms can read this, change nothing, and be fine. If the assistant is used for product descriptions, translations, code snippets, internal drafts and marketing copy — text with no person inside it — the leak is a title nobody can attach to a customer, and the practical harm round to zero. The same goes for a firm that already puts the assistant inside a paid tier with a private mode on and no third-party plug-ins on the page: the remaining exposure is between you and the provider, which is the exposure you signed up for.

There is also a limit to what the research supports, and it is worth stating plainly. Both audits measured free web accounts. Neither measured paid plans, desktop applications or mobile apps, so quoting these numbers at your paid tool is an extrapolation, not a finding. The single measurement point was in the US-East with the cookie banner accepted; the tracker set changes with the consent decision and the visitor's region. The Stony Brook count is a fortnight in May 2026, and deployment changes — two of the platforms removed their trackers while the study was still running.

What you should not do is treat a private mode as a privacy strategy. Private mode cut observed third-party contact almost to zero in the measurements, and it does nothing about the model provider, who still receives the text and whose retention rules are governed by your contract rather than by a toggle. Australia's regulator is direct about the consequence: once personal information has been entered into an AI system, it will be very hard to track or control how it is used, and potentially impossible to delete it.

So the line is easy to draw. Trackers are a hygiene problem with a cheap fix. Whether the text should have been in the tool at all is a decision you make before you type, and no setting makes it for you.

Frequently asked questions

Is it illegal to paste customer data into a chat assistant?

Not by itself, and the useful answer is narrower than "yes or no". What matters is the purpose you are using it for and whether the person would reasonably expect it — the standard behind rules such as the primary-purpose principle the OAIC applies to Australian organisations, which puts the burden of justifying the expectation on the organisation rather than on the customer. A draft reply to a customer who emailed you is defensible. Feeding a customer database into an assistant to write marketing segments is a different conversation. The IMDEA Networks analysis frames the tracker findings against the GDPR and the ePrivacy Directive rather than claiming the tools are unlawful.

Does a paid business plan fix this?

It fixes the part you cannot see from your side: on business tiers and the API, the provider commits to not training on your data by default, to encryption in transit and at rest, and in some cases to zero retention. It does not fix the page. The pixels in the paper were running on public web interfaces, and a subscription to a cheap tier does not necessarily remove them; the two audits measured free accounts specifically, so nobody has published numbers for the paid interface. Verify your own plan the same way as above: open the network tab, type one prompt, read the domains. And keep third-party plug-ins off the account, since a third-party integration moves your text under someone else's privacy terms.

Does private mode hide the conversation from the provider too?

No, and this trips people up. Private or temporary mode stops the conversation appearing in your history and, in the measured sessions, dropped third-party contact almost entirely — third-party owners from 47 to 3, and no content or identity exposure observed. The provider still processes the prompt to produce the answer, and whatever retention rules apply come from the contract, not from the toggle. Treat private mode as closing the advertising channel, not as making the text unseeable.

Do I have to tell customers their message went through an AI?

There is no single rule that applies to every country, and anyone who tells you otherwise is selling something. The practical test is expectation: if a customer emails a question and a person sends an AI-assisted reply, most privacy frameworks treat that as within the original purpose. If you are feeding their data into a tool that shares context with advertising networks, or using their messages for something other than answering them, you are outside what they would reasonably expect and you should say so in your privacy notice. Write the sentence now, while it is still a sentence, rather than after a customer asks.

Is the mobile app the same as the website?

Unknown, and the research does not settle it. Both audits measured web interfaces: the Stony Brook team tested 42 web platforms, the UC Davis team 20 chatbots in normal sessions, and the traceable mechanism — a title in the page, a script reading the DOM, a prompt in the URL — is a property of the web page. Whether a mobile app loads the same trackers requires a separate measurement, which nobody has published for this set of platforms. On a phone, the operating system's own privacy controls are the relevant lever, and they are a different topic.