IMDEA Networks 论文：九款对话式 AI 服务向第三方泄露对话标题、提示词与截图

AI HOT 精选

AI HOT 精选2026年9月29日

IMDEA Networks 论文：九款对话式 AI 服务向第三方泄露对话标题、提示词与截图

6.9内容质量

TL;DR · AI 摘要

IMDEA Networks è®ºæï¼ä¹æ¬¾å¯¹è¯å¼ AI æå¡åç¬¬ä¸æ¹æ³é²å¯¹è¯æ é¢ãæç¤ºè¯ä¸æªå¾ Â· AIHOT Hacker New...

核心要点

主题聚焦：IMDEA Networks 论文：九款对话式 AI 服务向第三方泄露对话标题、提示词与截图
来源：AI HOT 精选，建议结合原文判断细节。
AI 分析暂不可用，本条为保底评分与摘要。

#AI#编程#前端#后端#云计算

打开原文

Hacker Newsï¼AI çå¸

Â·

damaru2

2026-09-29 17:03

4 å°æ¶å

ç²¾é

AI è¯å

77

AI companies leak data to advertisers [pdf]

AI å¯¼è¯»

IMDEA Networks çæºæå¯¹ ChatGPTãClaudeãGrokãDeepSeekãGeminiãPerplexityãCopilotãMistral å Meta AI ä¹æ¬¾å¯¹è¯å¼ AI æå¡åäºç³»ç»æ§éç§åæã

æ¨èçç±

æ£æ Â· AI ç¿»è¯

è¯æå°ä¸å®æ´ï¼å®æ´å å®¹è¯·åæ¢å°åæã

Guilherme Oliveira

IMDEA Networks

Miguel Sanchez

Juan Manuel De Santa Olalla GÃ³mez

Roi S. Serna

IMDEA Networks/UC3M

Tautvydas Jackevicius

Jorge Garcia-Herrero

Independent

Aniketh Girish

Guillermo Suarez-Tangil

Narseo Vallina-Rodriguez

æè¦

å ³é®è¯

å¯¹è¯å¼ AIãLLMãéç§ãç§»å¨ç«¯ãç½é¡µãè¿½è¸ªå¨

æ¬ä½åæ ¹æ® Creative Commons Attribution 4.0 International License ææãè¦æ¥çè¯¥è®¸å¯è¯çå¯æ¬ï¼è¯·è®¿é® https://creativecommons.org/licenses/by/4.0/ æè´ä¿¡ Creative Commons, PO Box 1866, Mountain View, CA 94042, USAã Proceedings on Privacy Enhancing Technologies YYYY(X), 1â18 Â© YYYY çæå½ææè /ä½è ææãhttps://doi.org/XXXXXXX.XXXXXXX

1 å¼è¨

1Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

2 èæ¯

2.1 å¯¹è¯å¼æºè½ä½

2.2 ç§»å¨ç«¯åç½é¡µè¿½è¸ª

1åå¸çµåé®ä»¶å°åï¼HEMï¼æ¯ä»ç¨æ·çµåé®ä»¶å°åæ´¾ççååæ è¯ç¬¦ï¼å¯å¨ä¸ä¼ è¾ææçµåé®ä»¶å°åçæ åµä¸å®ç°è·¨æå¡èº«ä»½å¹é [25]ã2

åè´è¶ä¸æ ·æç¤ºï¼åè¿½è¸ªå¨ä¸æ ·èäººï¼å¯¹ç½é¡µåç§»å¨ç«¯å¯¹è¯å¼ AI ä»£ççéç§åæ éç§å¢å¼ºææ¯è®ºæé YYYY(X) 12345 CA CA

ç½é¡µ Android åç«¯

ç¨æ· ç¨æ·æ è¯ç¬¦

ATS æå¡å¨

å®¢æ·ç«¯ æå¡å¨ç«¯

å¯¹è¯å¼ AI æå¡

æç¤º ååº ä»£ç å¯¹è¯ æ è¯ç¬¦ èå¤©å å®¹ åµå ¥ç ç¬¬ä¸æ¹ SDK å¯¹è¯äº§ç© UserIDã DeviceIDã AnonIDã OrganizationIDã HEM ConvIdã ChatURLã SharedIDã ShareURL æ é¢ãæç¤ºã æªå¾

å¾ 1ï¼éç§é£é©ã

3 å¯¹è¯å¼ AI æå¡ä¸çéç§é£é©

è®¢é å±çº§ å±çº§ï¼è®¿å®¢Â·å è´¹Â·ä»è´¹ï¼ åæï¼å¿½ç¥Â·æç»Â·æ¥åï¼ æ¨¡å¼ï¼é»è®¤Â·éèº«ï¼ ç¬¬ä¸æ¹ åæ éç§ åæ Â§4.2 éæï¼Androguard å¨æï¼ææ¡© AOSP Â§4.3 Â§6 Â§5 Â§4.1 Â§4.5 Â§4.4 ç¬¬ä¸æ¹ åç±» ç¬¬ä¸æ¹ ç¬¬ä¸æ¹ eTLD+1 3P API ATS Javascript Cookies HTTP/S è¯·æ± 9 é¡¹æå¡ å·²é å¯¹è¯å¼ AI æå¡éæ© 1 ææ¡©ä¸é»ç åææ¹æ³ 2 å®éªæ¡ä»¶ä¸è¾å ¥ 3 å¯¹è¯ä¸ æç¤ºè¾å ¥ ææä¿¡æ¯ ææ£æâXâç AI ä¿¡æ¯ .... åæ 4 ä¸æ³é² å¯¹è¯ äº§ç© ç½ç«åæ Chrome 148 + DevTools (CDP) Android åºç¨åæ Pixel 3a / Android 12 æ°æ®æµ MS Copilot Le Chat Meta AI

å¾ 2ï¼æ¹æ³æ¦è¿°ã

4 æ¹æ³

4.1 å¯¹è¯å¼ AI æå¡éæ©

3 éç§å¢å¼ºææ¯ä¼è®®è®ºæé YYYY(X) Oliveira ç

è¡¨ 1ï¼æ¬ç ç©¶åæçç½é¡µç«¯åç§»å¨ç«¯å¯¹è¯å¼ AI æå¡ï¼æ Tranco æåååæåºï¼2026 å¹´ 5 æï¼ã

æå¡æä¾å ç½ç«åå Android å å Tranco æå Play ååºå®è£ é ChatGPT OpenAI chatgpt.com com.openai.chatgpt 48 >1B Claude Anthropic claude.ai com.anthropic.claude 617 >10M Grok xAI grok.com ai.x.grok 956 >100M DeepSeek DeepSeek chat.deepseek.com com.deepseek.chat 1,196 >50M Perplexity Perplexity AI perplexity.ai ai.perplexity.app.android 1,249 >100M Gemini Google gemini.google.com com.google.android.apps.bard 6,045 >1B MS Copilot Microsoft copilot.com com.microsoft.copilot 11,011 >50M Mistral (Le Chat) Mistral AI chat.mistral.ai ai.mistral.chat 12,039 >1M Meta AI Meta meta.ai com.facebook.stella 13,701 >50M

è¿äºæå¡å¨ 2026 å¹´ 5 æç Tranco 2 ä¸ä»ä½åå 14K æå¡ãå ¶ä¸ä¸ä¸ªè¿å ¥å 1Kï¼ChatGPTï¼å 48ï¼ãClaudeï¼å 617ï¼å Grokï¼å 956ï¼ãå¨ç§»å¨ç«¯ï¼å®ä»¬çææç§»å¨åºç¨ç´¯è®¡å®è£ éåè³å°ä¸º 1Mï¼å ¶ä¸ä¸¤ä¸ªï¼Gemini å ChatGPTï¼çç´¯è®¡å®è£ éè¶ è¿ 1Bã

4.2 ç½ç«åæ

2https://tranco-list.eu/list/3Q25L/1000000

4.3 Android åºç¨åæ

éæåæãæä»¬ä½¿ç¨ Androguard [16] åç¼è¯æ¯ä¸ªåºç¨ç APKãæä»¬è§£æ AndroidManifest.xml ä»¥æä¸¾ä¸è¿½è¸ªç¸å ³çå·²å£°ææææéï¼ä¾å¦ AD_IDãREAD_PHONE_STATEãACCESS_FINE_LOCATIONï¼ãæä»¬éè¿æåå å½åç©ºé´ï¼å¹¶æç §å åå·¥ä½å®è·µ [24, 28, 64] å°åºç¨çå åï¼ä¾å¦ com.company.appï¼æ å°å°å ¶å¯¹åºç eTLD+1ï¼company.comï¼ï¼æ¥è¯å«åµå ¥çç¬¬ä¸æ¹ SDKãæææä¸åºç¨ eTLD+1 ä¸å¹é çå åæèç³»ååè¢«è§ä¸ºç¬¬ä¸æ¹ç»ä»¶ [48, 53]ãç¶åï¼æä»¬ä½¿ç¨å ¬å¼ SDK ææ¡£åå åå·¥ä½æ å° [28, 45]ï¼ä»¥å Â§4.2 ä¸æè¿°çç¬¬ä¸æ¹åç±»æ¹æ³ï¼æå¨å¹é è¿äºå åååã

å¨æåæãæä»¬å¨æè½½ Android 12 æå»ºçå·²ææ¡© Google Pixel 3a ä¸æ§è¡æ¯ä¸ªåºç¨ï¼è¯¥æå»ºå¯éæå°çæ§å¯¹åæéä¿æ¤ API çè¿è¡æ¶è®¿é®ãæä»¶ I/O æä½ä»¥åææåºç«ç½ç»æµéï¼ä½¿ç¨ mitmproxy [10] å Frida [46] å¯å®ç°åçè¦çãæä»¬å¨ç³»ç»å±é¢è§å¯å¯¹ TLS å¥æ¥åçè¯»åï¼ä»èæ éè¯ä¹¦æ³¨å ¥å³å¯è¿è¡æµéæ£æ¥ï¼ä¸ä¸ä¼ä¸æ TLS æ¡æï¼å æ¬å¨è¯ä¹¦åºå®åºç¨ä¸ [44, 47]ãææ¡©è¿½è¸ªå¯¹ææèµæºçè®¿é®ï¼å æ¬è®¾å¤ IDï¼AAIDãAndroid IDãIMEIãGSF IDãBoot IDï¼ãç¡¬ä»¶ IDï¼WiFi MAC å°åï¼ãç½ç»æ«ææ°æ®ï¼WiFi SSIDãBSSIDï¼ä»¥åè´¦æ·å ³è IDï¼ä¾å¦çµåé®ä»¶å°åï¼ã3 ä¸ºè¡¥å éæ

3æ¯å°è®¾å¤é½é ç½®äºåå IDï¼çµåé®ä»¶å°åãçµè¯å·ç ï¼ï¼ç¨äºå¨æ¯ä¸ªå¹³å°ä¸æ³¨åæµè¯è´¦æ·ãç±äºæ¯å°è®¾å¤ç ID å¼å·²ç¥ï¼4åè´è¶ä¸æ ·æç¤ºï¼åè¿½è¸ªå¨ä¸æ ·èäººï¼Web åç§»å¨å¯¹è¯å¼ AI ä»£ççéç§åæ éç§å¢å¼ºææ¯ä¼è®®è®ºæé YYYY(X)

4.4 åæè¡¨ååè®¢é å±çº§

4.5 å¯¹è¯ä¸æç¤ºè¾å ¥

æä»¬å¯ä»¥èªå¨å¨æè·çæµéä¸æç´¢ç´æ¥åºç°åå ¶å¸¸è§åå¸åæ¢ï¼MD5ãSHA-1ãSHA-256ï¼ã

# æå¡ ææå¡åå ç»ç»/äº§å Web ç§»å¨ç«¯ â©âª ChatGPT Claude Copilot DeepSeek Gemini Grok Meta AI Mistral Perplexity Google 8879G#H# Firebase 0808H#H#H#H#H#H#H#H# Search 8228G#G#G#G#G#G# Ads 7007G#G#G#G#G#G#G# Tag Manager 7007G#G#G#G#G#G#G# Accounts 5005G#G#G#G#G# Sentry 2424H#H# Datadog 3223G# Intercom 2103H#G#G# Meta 3113G#G#

5 ç¬¬ä¸æ¹æå¡åæ

5.1 Webä¸ç§»å¨ç«¯è·è¸ª

5Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al. Grok Claude Perplexity Copilot ChatGPT Mistral DeepSeek Gemini Meta AI Google Search Google Ads Google Tag Manager Google Accounts Datadog Meta Google User Content Intercom Sentry Apple Google Analytics Google APIs Doubleclick Dub Auth0 Inc. Appsflyer OneTrust ShuMei Sift Singular Sprig Stape Stripe TikTok Twitter Ads Twitter Analytics

(a) Webå®¢æ·ç«¯ãPerplexity ChatGPT Claude Copilot Mistral Grok DeepSeek Meta AI Google Firebase Sentry Google APIs RevenueCat Datadog Google Search Adjust Auth0 Inc. Appsflyer Fengkong Braze Meta Intercom OneTrust Sift Science Singular Stripe Twilio Segment Wingify (b) Androidå®¢æ·ç«¯ã

æ¥æç¹å«å¹¿æ³çè¶³è¿¹ï¼äº§åæ¶µçå¹¿åä¸åæï¼ä¾å¦ Google Ads å Google Tag Managerï¼ãæç´¢ãèº«ä»½éªè¯ï¼ä¾å¦ accounts.google.comï¼ãå¹³å° APIï¼ä¾å¦ googleapis.com ä¸çåååï¼ï¼ä»¥å Firebase çç§»å¨ç«¯ä¸ç¨çé¥æµæå¡ãæä»¬çåæè¿æç¤ºäºä¸ DeepSeek ç¸å ³çé²ä¸ºäººç¥çä¸å½è¿½è¸ªæå¡çåå¨ï¼å æ¬é£æ§äºï¼ç§»å¨ç«¯ï¼fp-it.fengkongcloud.comï¼åæ°ç¾ï¼Web ç«¯ï¼fp--it-acc.portal101.cnï¼ãè¿äºæå¡å¨å¦æ¯æç®ä¸é²æè®°è½½ï¼ä¹æªåºç°å¨ WhoTracks.Me çä¸»æµè¿½è¸ªå¨æ°æ®åºä¸ãç¶èï¼å ¬å¼æ¥åå°å®ä»¬ä¸è®¾å¤æçº¹è¯å«åé£é©è¯åææ¯èç³»èµ·æ¥ [41]ã

åºç¨å æµè§ãç§»å¨å®¢æ·ç«¯èç³»çææä¸åç«¯ç¹ä¸æ 71% æºèª WebViewï¼åºç¨å æµè§ï¼ï¼èéåçåèç ã4 å¯¹ WebView çä¾èµç¨åº¦å¨ä¸ååºç¨é´å·®å¼å¾å¤§ï¼ä» Grok ä¸ 98% çç«¯ç¹ï¼å° Perplexity ä¸ç 91%ï¼åå° ChatGPT ä¸ç 71%ãç¸æ¯ä¹ä¸ï¼CopilotãMistral å Meta çå¤§é¨åæµéæºèªåçä»£ç ãè½ç¶ WebView ä¾¿äºå° Web å å®¹éæå°åçåºç¨ä¸å¹¶ç®åå¼åï¼ä½å®ä»¬ä¹ä½¿ç§»å¨åºç¨å è½å¤ä½¿ç¨åºäº Web çè¿½è¸ªæ¹æ³ [64]ãä¾å¦ï¼å¨ Grok ä¸ï¼æä»¬è§å¯å° Google AdsãGoogle Tag ManagerãTikTok AnalyticsãX/Twitter Analytics å Meta Pixel çå å®¹å¨ WebView ä¸å è½½ã

5.2 åæä¸è®¢é å±çº§çå½±å

4æä»¬å°æ¯ä¸ªåºç«æµéå½å äºçæå®ç Android UIDï¼å¹¶å°å ¶åç±»ä¸ºæºèªå©æçåçå ãCustom Tabs æ WebView è¿ç¨ã

(ii) æç»éå¿ è¦ Cookieï¼reject allï¼ï¼ä»¥å (iii) æ¥åææ Cookieï¼accept allï¼ãæä»¬çç»æè¡¨æï¼åææºå¶å¨ä¸åæä¾åä¹é´å·®å¼å¾å¤§ãä¸äºæå¡å è®¸ç¨æ·å¨ä¸ååºæç¡®éæ©çæ åµä¸ç»§ç»äº¤äºï¼ä¾å¦ PerplexityãClaude å Grokï¼ï¼èå¦ä¸äºåè¦æ±ç¨æ·å¨è®¿é®å¹³å°åååºåæéæ©ï¼ä¾å¦ Gemini å Meta AIï¼ãå¦å¾ 4 æç¤ºï¼Mistral è¦æ±ç¨æ·å¨äº¤äºåå®å ¨æ¥åå ¶ ToS åéç§æ¿çãå æ¤ï¼ææè¿æ¥é½è¢«æ è®°ä¸º accept allãéå½ C æä¾äºè§å¯å°çåæè¡¨åç¤ºä¾ãå³ä½¿ç¨æ·æç»éå¿ è¦ Cookieï¼å³ reject all

6åè´è¶ä¸æ ·æç¤ºï¼åè·è¸ªå¨ä¸æ ·èäººï¼Web åç§»å¨å¯¹è¯å¼ AI ä»£ççéç§åæ éç§å¢å¼ºææ¯ä¼è®®è®ºæé YYYY(X)

è¡¨ 3ï¼è·¨ Web å Android å®¢æ·ç«¯çæä¾åä¸ ATS ä¹é´çå¯¹è¯äº§ç©æ³æ¼ãç±å¯¹è¯å ±äº«æä½äº§ççå ±äº« URLãæç¤ºåæªå¾çä¼ æå¨ Â§6.4 ä¸ç ç©¶ã æä¾åæ°é ATS æ°é æ³æ¼çäº§ç© Web Android Web Android

å¯¹è¯ URL 5 0 9 0å¯¹è¯ ID 2 2 1 1ç¨æ·æç¤º 1 1 2 1å¯¹è¯æ é¢ 3 0 9 0å¯¹è¯æªå¾ 1 0 1 0å ±äº«å¯¹è¯ URL 5 0 9 0å ±äº«å¯¹è¯ ID 0 1 0 1

å¯¹è¯ ID åå ±äº«å¯¹è¯ ID è®¡æ°ä» æ¶µçæ è¯ç¬¦å¨æ²¡æå®æ´ URL çæ åµä¸æ³æ¼çæ åµã

Web ä¸é¢ç½®çè·è¸ªé¢ãè§å¯å°çç½ç»æµéä» æè·å¨ç¹å®å¨ææµè¯æé´æ¿æ´»çç¬¬ä¸æ¹åéãç¶èï¼å¯¹äºåºäº Web çå®¢æ·ç«¯ï¼æ¯ä¸ªæå¡ååºçå å®¹å®å ¨çç¥ï¼CSPï¼ååºå¤´ï¼ä¾å¦ script-srcãconnect-srcãimg-src å frame-srcï¼åä¸¾äºé¡µé¢è¢«ææèç³»æå è½½èµæºçå ¶ä»å¤é¨æºï¼ä»èæç¤ºäºå¯è½å¨æµè¯æé´å¤äºä¼ç ææªè§¦åçæ½å¨å ³ç³»ï¼ä¾å¦ç±äºåºåå·®å¼ææ§è¡ä¸ä¸æãCSP å¤´ä¸å å«çææ®éçç¬¬ä¸æ¹æå¡å±äº Google Tag Managerï¼googletagmanager.comï¼ãGoogle Analyticsï¼google-analytics.comï¼å Google Adsï¼googleadservices.com å doubleclick.netï¼ãç¶èï¼å¦è¡¨ 8 æç¤ºï¼CSP çç¥éå¸¸å æ¬å¹¿åè¡ä¸ä¸çå ¶ä»ç¥ååä¸è ï¼ä¾å¦ TikTok å Metaã

6 éç§åæ

6.1 å¯¹è¯äº§ç©çä¼ æ

5ä¾å¦ï¼å¨ Grok çå¯¹è¯ URL ä¸ï¼https://grok.com/c/0b3cc700-5a98-40f0-8e39-7311df76a700?rid=7b3e3eb2-0930-4490-b0ec-9f52fb3839c4ï¼è·¯å¾æ®µ

6.2 å°å¯¹è¯å ³èå°ç¨æ·èº«ä»½

ä»¥ååæ°å¯ä¸æ è¯è¯¥å¯¹è¯ãç¶èï¼é»è®¤æ åµä¸ï¼ä»»ä½ç¥éè¯¥ URL çè¡ä¸ºè åå¯å ¬å¼è¯»åè¯¥ URLï¼æä»¬å°å¨ Â§6.3 ä¸è¿ä¸æ¥éè¿°ã7

Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira ç

å¯¹è¯äº§ç© ç¨æ·èº«ä»½ è´¦æ·å±çº§ LLM æå¡å¹³å° è¿½è¸ªå¨ æ°¸ä¹ é¾æ¥ å å®¹ ç¨æ· PII Cookie / SessionId è®¿å®¢ å è´¹ é«çº§ ChatGPT ÃHDatadog ConvId 4âUserId 4, DeviceId 4SessionId 4ppp Claude ÃHDatadog ConvId , ShareId âAnonId 4, UserId 4ââpp Perplexity ÃHWingify âPrompt ââpââChatGPT ÃÂDatadog ConvId 4, ChatUrl âUserId 4, AnonId 4SessionId 4Ã¦Ã¦Ã¦ Claude ÃÂDatadog ConvId 4âUserId 4, AnonId 4, OrganizationId 4SessionId 4âÃ¥Ã¥ Claude ÃÂIntercom ConvId, ChatUrl âUserId 4, Email 4, OrganizationId 4, User Hash 4intercom-device-id 4âÃ¦Ã¦ Claude Ã¦ÂDatadog ShareId, ShareUrl âAnonId SessionId Ã¥ââGemini ÃÂGoogle Analytics âTitle âcid 4âÃ¦Ã¦ Gemini Ã¦ÂGoogle Search ShareId, ShareUrl âââÃ¦ââGrok ÃÂDoubleClick ConvId, ChatUrl Title 4âem 4âÃ¥Ã¥ Grok ÃÂGoogle Ads ConvId, ChatUrl Title 4âem 4âÃ¥Ã¥ Grok ÃÂGoogle Search ConvId, ChatUrl Title 4âem 4âÃ¥Ã¥ Grok ÃÂGoogle Tag Manager ConvId, ChatUrl Title 4â_fbp 4, _ttp 4, _dcid 4âÃ¥Ã¥ Grok ÃÂMeta ConvId, ChatUrl Title â_fbp 4âÃ¥Ã¥ Grok ÃÂTikTok ConvId, ChatUrl Title 4â_ttp 4âÃ¥Ã¥ Grok ÃÂTwitter Analytics ConvId, ChatUrl Title 4â_twpid 4âÃ¥Ã¥ Grok Ã¦ÂAppsflyer ShareId, ShareUrl âââÃ¥ââGrok Ã¦ÂDoubleClick ShareId, ShareUrl Title ââÃ¥ââGrok Ã¦ÂGoogle Search ShareId, ShareUrl Title ââÃ¥ââGrok Ã¦ÂGoogle Tag Manager ShareId, ShareUrl Title â_dcid Ã¥ââGrok Ã¦ÂMeta ShareId, ShareUrl Title, Prompt â_fbp Ã¥ââGrok Ã¦ÂTikTok ShareId, ShareUrl Title, Prompt, Screenshot â_ttp Ã¥ââGrok Ã¦ÂTwitter Analytics ShareId, ShareUrl Title â_twpid Ã¥ââMistral ÃÂIntercom ConvId, ChatUrl Title UserId 4, Email 4, OrganizationId 4, User Hash 4intercom-device-id 4, intercom-id 4âÃ¥Ã¥ Mistral Ã¦ÂIntercom ShareId, ShareUrl Title âintercom-device-id, intercom-id Ã¥ââPerplexity ÃÂDatadog ConvId 4, ChatUrl 4âUserId 4, AnonId 4, Email 4SessionId 4Ã¦Ã¦Ã¦ Perplexity Ã¦ÂDatadog ShareId, ShareUrl âAnonId âÃ¦ââ

ä» å¨æ¥åéå¿ è¦ Cookie åæ«é²ï¼Ã¦ å¨æ¥ååæç» Cookie è®¾ç½®ä¸åæ«é²ï¼p æ Cookie åææºå¶ãPrompt å Screenshot æå¯¹è¯ä¸æè¿ä¸æ¬¡äº¤äºãå¨ç§»å¨å¹³å°ä¸ï¼æ«é²ä¸ Cookie åæè®¾ç½®æ å ³ã

äº§å å¹³å° # ATSes % å ¨é¨æ¥å

ChatGPT Web 1 0% Android 1 âClaude Web 2 50% Android 1 âGemini Web 1 0% Grok Web 7 100% Mistral Web 1 100% Perplexity Web 1 0%

â¢ Web cookies and Tracking Pixels. Cookies and impression pixels remain the dominant web tracking mechanism. We ob-serve third-party cookies in 4 conversational AI services from 9 third parties, including Meta, TikTok, Twitter Analytics, and Intercom. Of those, 8 distinct cookies (e.g., _fbp , _ttp , _twpid )are transmitted alongside conversational artifacts. In the case of Grok Web, Meta Pixel alone collects the conversation ID, the chat title, the full conversation URL, the share ID, and the share URL, each linked to the userâs Meta identity by the synced _fbp

cookie. Meta documents the use of Pixel events for audience measurement and attribution, potentially aggregating them to usersâ Meta accounts when one exists [38, 62].

â¢ Email Hashes. Although often presented as privacy-preserving representations, hashed email addresses (HEMs) act as stable ID because third parties can independently compute identical hashes for known email addresses and use them for identity resolution, as pointed out by the USA Federal Trade Commission [25, 49]. Our results show that Perplexity transmits userâs HEMs to the marketing and analytics company Singular.

â¢ Service Usernames and Account IDs. Four providers addition-ally transmit usersâ usernames or account IDs on the AI services alongside conversational artifacts. Additionally, three providers share stable hash-based IDs to third parties like Intercom. Al-though we cannot determine the exact inputs used to generate these values, they remain consistent across sessions for the same account and therefore appear to function as persistent pseudony-mous IDs. For example, Mistral and Claude transmit such IDs to Intercom, while Grok sends a similar one to DoubleClick, Google Ads, and Google Search. These IDs may facilitate user identifica-tion and linkage across sessions even when direct account IDs are not disclosed.

â¢ Cookie Syncing. We observe instances of cookie syncing [1] and server-side tracking [26] only when users accept non-essential cookies. Claude uses Segment Analytics proxied through a first-party domain (a-cdn.anthropic.com), loading a Conversion API configuration that forwards user events server-to-server from its infrastructure to eleven trackers (e.g., Facebook, LinkedIn, TikTok, Reddit, and Google Enhanced Conversions). This for-warding evades ad blockers and carries two shared IDs per event, which could enable data bridging across advertising platforms to

8Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents Proceedings on Privacy Enhancing Technologies YYYY(X)

a single session. Similarly, Grok embeds a Google Tag Manager container configured to route events through a server-side GTM instance (sGTM). A custom event transmits the conversation URL and chat topic title server-to-server to Meta Conversions API and TikTok Events API through the sGTM container, invisible to browsers and unblockable by ad blockers. The same payload carries both Metaâs _fbp and TikTokâs _ttp cookies, enabling ID bridging between Facebook and TikTok under a single identity.

â¢ è´¦æ·å ³èæ è¯ç¬¦åçµåé®ä»¶å°åãåä¸ªç§»å¨å®¢æ·ç«¯åç¬¬ä¸æ¹æ«é²è´¦æ·å ³èæ è¯ç¬¦ãä¸¤ä¸ªä¼ è¾çµåé®ä»¶å°åï¼Perplexity ä¼ è¾ç» RevenueCatï¼Grok ä¼ è¾ç» TikTok å Twitter Analyticsãæ¤å¤ï¼Grok å° HEM ä¼ è¾ç» TikTok å Twitter Analyticsã

â¢ SDK ç¹å® IDãAdjustãAuth0ãBrazeãDatadogãRevenueCatãSentryãSift Science å Singular çæèªå·±çä¸æ ID ç¨äºç¨æ·è¯å«ãä¼è¯ç®¡çãå½å ååæãå¨å¤§å¤æ°æ åµä¸ï¼è¿äº SDK çæç ID ç¬ç«äºå¯¹è¯äº§ç©è¿è¡ä¼ è¾ãç¶èï¼Claude å°å¯¹è¯ ID è½¬åç» Datadogï¼åæ¶éå¸¦ Datadog çæç

âå ¬å¼ä¸æ æ³éåº å ¬å¼ä½å¯éåº G#ä» éææè #ä¸æ¯æ é¢å¤æ§å¶ï¼â ç½åå 4éèº«æ¨¡å¼ æä¾å è®¿å®¢ å è´¹ ä»è´¹ æ§å¶ ChatGPT G#G#4G#4 Claude #G#4G#4 Grok #44 Deepseek #G## Perplexity âG#4G#4â Gemini G#G#4G#4 Copilot G#G#4G#4 Mistral G#G#4G#4 Meta AI #G## è½ç¶ææåæµæå¡é½å ·å¤ä¸ææäººåäº«èå¤©å¹¶éåæ¤éæ¤è®¿é®æéçåè½ï¼ä½é¨åæä¾åè¿æä¾äºé¢å¤çè®¿é®æ§å¶æºå¶ï¼ä¾å¦å°ç¹å®ç¨æ·å å ¥ç½ååçè½åï¼â ï¼ãå½æä¾åæä¾éèº«èå¤©ï¼ä¸ä¿åå¨è´¦æ·åå²è®°å½ä¸ï¼æ¶ï¼æä»¬è¿ä¸æ¥ç¨4æ æ³¨ç¸åºå±çº§ã

6.3 å¯¹è¯æ°¸ä¹ é¾æ¥çå¯è®¿é®æ§

9Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

6.4 å¯¹è¯å ±äº«

6.5 å¯¹è¯è®¿é®è¯æ®

6è¿ä¸å³å®åºäºåæ¥å®éªãä¸äº LLM è¯å«åºä¸å·²ç¥ canary token ååç¸å ³ç URL å¹¶æç»è®¿é®ãä½¿ç¨éç¨ååçèªæç®¡é¨ç½²æ¯ä¸ºäºé¿å è¿ç§æ åµã

7 æ³å¾èæ¯

7.1 ePrivacy æä»¤

According to Article 5(3) of the ePrivacy Directive (" ePD ") [22], the use of cookies for analytical, advertising, or profiling purposes âa category that unequivocally includes Meta and TikTok tracking pixels or Google Analytics cookiesâ requires prior informed user consent. The EDPB has clarified in detail how the prohibition under Article 5(3) ePD equally extends to more modern and sophisticated technologies than cookies [21], such as (i) URL and pixel tracking, (ii) collecting unique and persistent IDs, (iii) instructing the browser (through client-side code) to send such information to a server-side API. Additionally, compliance with applicable consent requirements includes: prohibition of pre-ticked boxes, prohibition of cookie walls except for an equivalent alternative, parity between accept and reject controls, and prohibition of dark patterns leading the user to an unreflective or manipulated acceptance.

7.2 GDPR Regulation (EU) 2016/679

When AI service providers disclose chat information to third parties, both (i) the disclosure and (ii) any subsequent access by such third

10 Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents Proceedings on Privacy Enhancing Technologies YYYY(X)

parties constitute processing activities requiring their own specific transparent information and legal grounds, provided that they are not strictly necessary for the performance of the contract between the provider and the user, and that they exceed the userâs legitimate expectations. Therefore, according to the GDPR [23], conversational AI services are legally obliged essentially: (1) To inform about their processing in a clear and under-standable manner. The userâs legitimate expectations would hardly include the possibility that their conversations could be accessible to third parties such as Meta or Google. Ope-nAI, Anthropic, Perplexity and xAI use generic and ambiguous expressions to refer to the userâs âuser promptsâ without specif-ically citing them when informing about third-party access: "user content " (OpenAI), â conversations â (Anthropic), â service interaction info â (Perplexity) and â user info â (xAI). Not only the EDPB, but also the CJEU in Meta Platforms Ireland (C-757/22, paragraph 54) [13] imposes literally on the data controller the obligation to inform the data subject linking for each partic-ular processing operation (i) the breakdown of personal data processed, (ii) its purpose, and (iii) the legal basis claimed. It is significant that even when OpenAI provides this information in such a structured and linked manner, it does not reference the practices observed in this study. (2) To have a legal basis for processing. The same applies to third parties accessing this data for their own purposes. This basis cannot be, as said, the âperformance of the contractâ between the user and the AI provider. It is highly debatable whether training the service with user interactions is âobjectively neces-saryâ for the provision of the service. We must bear in mind the constant assurances from dominant companies such as OpenAI or Anthropic regarding their policy of not training models on user interactions within the enterprise tier. What is not done with corporate users can hardly be âobjectively necessaryâ for the same processing in the free tier. It seems even more difficult to legitimize as ânecessary for the provision of the serviceâ the access to third parties to the ti-tle and/or URL of the chats together with persistent IDs and tracking pixels for purposes unrelated to the operation of the tool, using adtech-specific mechanisms. The EDPB clarified this point in its binding decision 3/2022 against Meta IE (paragraph 118) [20] by indicating that if such processing was necessary, the contract terms should provide ( mutatis mutandis ) (i) the obligation of the provider to give third parties access to infor-mation about the chats, and (ii) contractual penalties in case of non-compliance with such âobligationâ, elements that do not appear in the terms and conditions. This processing could only be carried out through explicit consent (as advocated by the EDPB) or legitimate interest. Even assuming the applicability of the legitimate interest, in the cases analyzed, the mandatory prior information on (i) processing and (ii) the possibility of exercising a right of opposition is conspicuously absent. Additionally, this data processing should be covered by some exception to the prohibition of processing special data cate-gories. It is a known and widespread practice among users (and encouraged by providers) that users make inquiries about their health, psychological state, intimate matters, etc, making the results of this study even more concerning. The longitudinal processing of these conversations over a significant period al-lows the inference of all kinds of special data categories even if not specifically protected (economic capacity, appetite for financial risk, vulnerability to compulsive purchasing).

Doctrine âSRB / Scania.â The âsilver bulletâ used by online ser-vices in this type of scenario is typically one of the following: (a)

anonymization or (b) pseudonymization under conditions that prevent the data recipient from re-identifying users without dispro-portionate efforts in terms of time, material resources, or personnel (SRB/Scania doctrine). The first thing to clarify is that these argu-ments would only serve (assuming hypothetically that they applied) to remedy the lack of a legal basis: the obligation to inform users about third-party access in the terms imposed by the CJEU in "EDPS vs SRB" (C-413/23 P, paragraph 110) [14] could have been breached. (1) Anonymization . The robustness and effectiveness of any ano-nymization process can only be assessed on a case-by-case basis, and it would be necessary to see the actual definition of anonymization and whether what has been done is sufficient. (2) Pseudonymization / SRB-Scania doctrine . It is highly un-likely that large platforms like Meta or Google could benefit from this doctrine, given their vast personal databases and their business model, which consists precisely and unequivocally of combining different data sources to better personalize targeted advertising. It should not be forgotten that the âinsignificant risk of re-identification of the data subjectsâ must be assessed in light of the âcontext, purpose, and effectsâ CJEU Gesamtverband Scania (C-319/22, paragraph 70) [12] of the processing carried out by the party accessing the pseudonymized data.

8 Discussion

Our findings reveal that conversational AI services expose sub-stantially richer and sensitive information than conventional web and mobile services to tracking firms. Beyond collecting persistent IDs, several providers disseminate conversation-derived artifacts that encode the content, topic, or context of user interactions to third-party tracking services. When combined with stable IDs and permissive access-control mechanisms, these disclosures create new opportunities for third parties to associate sensitive conversational data with long-term user profiles and, in some cases, directly access the referenced conversation content. Therefore, our study raises broader questions about the exposure of conversational data, the effectiveness of existing privacy controls, and the accountability mechanisms governing these disclosures.

Conversation artifact leakage to the tracking ecosystem. Our results show that conversational AI has inherited the advertising and analytics infrastructure of the web and mobile platforms, bring-ing conversation data into existing tracking pipelines. Across 6 of 9 web services and 3 of 8 mobile apps, third parties receive conversa-tion artifacts like prompts, titles, and conversation permalinks (Â§6.1). These disclosures often occur alongside persistent IDs, including synced advertising cookies and HEMs (Â§6.2), making conversations linkable to long-term and cross-platform user profiles. Beyond the privacy implications, several third-party organizations, including Google and Meta, are embedded in competing AI products, raising

11 Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

questions about the collection of conversational data, including model responses, by direct competitors.

Privacy controls offer limited protection. The privacy controls available to users have limited impact on the underlying data flows. Even when non-essential cookies are rejected, 80.8% of third-party trackers remain active. Subscription tier is similarly ineffective, with free and premium accounts interacting with largely identical third parties. More fundamentally, the strongest controls are also least accessible to the users most exposed to tracking. On the web, only ChatGPTâs paid tier supports persistent consent preferences, yet roughly 95% of ChatGPT users remain on free tiers [51], and OpenAI has announced advertising for free and low-cost users [52]. On mobile, no equivalent to web cookie-consent mechanisms exist despite exposing similar tracking infrastructure as discussed in Â§5.

Scope and generalizability. While our evaluation focuses on leading consumer-facing services, the leakage vectors we observe stem from embedding standard web and mobile trackers directly into conversational interfaces. Consequently, these concerns extend beyond consumer B2C services to the broader ecosystem of LLM-powered web applications, custom customer-support chatbots, and third-party AI wrappers that rely on identical web and mobile analytics pipelines.

Exposure translates into access and liability. Beyond trans-mission, we also find evidence that the disclosed content is subse-quently retrieved. Our canary-token experiments indicate that at least some shared conversation artifacts are subsequently accessed. We observe repeated retrievals of conversations shared through Grok from infrastructure distributed across 14 countries, with 65.7% of accesses originating in the United States despite the conversa-tions being conducted in the EU (Â§6.5), adding data-sovereignty considerations to the underlying privacy concerns. However, the significance of the exposure does not depend on whether subse-quent access is directly observed. Conversational metadata reaches trackers through structured URL parameters and permissive sharing defaults (Â§6.3), reflecting deliberate design rather than incidental byproducts of page rendering. As the CJEU established in Fashion ID [11] (C-40/17, paragraph 78), enabling third-party access is itself a processing decision that triggers the providerâs obligations, re-gardless of whether the data is ultimately read (Â§7). The exposure, and the providerâs accountability for it, therefore arise from the design itself. Tooling and methodological constraints and research challenges, discussed next, limit our full visibility into this behav-ior and other server-side accesses. Addressing the challenges we faced is non-trivial, and we hope this work motivates the research community to tackle them.

8.1 Limitations

Our study covers nine conversational AI services, a subset of a broader, rapidly growing ecosystem. While selective in breadth, we focus on services with large active user bases. We exclude enterprise and governmental tiers, which providers market with distinct data-handling commitments whose validation we leave to future work. Our findings coverage is constrained to the limitations of black-box analysis techniques, including susceptibility to dynamic-analysis evasion, and we were unable to extract traces for Geminiâs mobile app. Furthermore, our evaluation focuses on discrete interaction sessions and does not capture cumulative privacy risks unique to long-lived conversations featuring persistent multi-turn memory. Nor does it cover unstudied scenarios such as native desktop clients, voice-first interfaces, or domain-specific vertical AI tools. The presence of a third party does not by itself imply that data is transmitted under all conditions only for advertising or tracking purposes, as some SDKs offer support for operational functions such as user attribution or in-app payments. Establishing processing pur-pose requires legal and contractual analysis beyond the scope of an empirical study. Large providers can also track users through their own first-party domains and server-side tracking, consistent with disclosures in their privacy policies, and our methodology can-not distinguish such tracking from functional traffic. We therefore report the presence of well-known first-party-tracking enablers such as Google Tag Manager. Finally, we measure from a fixed set of vantage points and user profiles, and practices in other geogra-phies, account states, or user contexts may differ. Moreover, as the ecosystem is rapidly evolving and subject to frequent updates, our findings represent a point-in-time lower bound on the extent of third-party integration and PII leakage in these services.

8.2 Mitigation

To mitigate some of these risks, both web browsers and mobile operating systems provide users with privacy and tracking controls. Privacy-enhancing browsers such as Brave block ads, analytics, and tracking resources at the network level by default [60]. How-ever, these could be defeated by advanced server-side and first-party tracking techniques. Similarly, mobile operating systems implement permission models that control app access to sensitive resources such as location, contacts, microphones, cameras, and MAIDs. Plat-forms such as iOS and Android also provide mechanisms to limit ad personalization and tracking through features such as App Tracking Transparency (ATT), advertising ID reset capabilities, and privacy dashboards that expose portions of application data access behavior. Building on these foundations, recent research explores auto-mated permission management to give users meaningful control over agent data access [68], an approach that consumer AI ser-vices could adopt to extend existing user controls over third-party trackers. A complementary direction may enforce website-provided policies through targeted sandboxing of browser-using agents [37], complementing user-facing permission controls with system-level confinement. Providers are also better positioned to act, for instance by not exposing conversation permalinks publicly by default and by withholding automatically generated titles and permalinks from third parties. Some providers have begun to expose dedicated con-trols. OpenAI, for example, recently introduced marketing-cookie controls [65], although the same update also permits using cookies to promote its products on other sites. From a user perspective, available mitigations include rejecting non-essential cookies and disabling chat sharing where platforms offer such controls. Never-theless, these measures remain partial and platform-dependent.

9 Related Work

A growing body of research focused on auditing the security of LLMs and their agentic extensions, uncovering vulnerabilities across

12 Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents Proceedings on Privacy Enhancing Technologies YYYY(X)

model training, information flows, tool integrations, and interac-tions with external services [8, 36, 56, 66, 69]. Our study focuses on privacy risks of generative AI in user-facing systems and fol-lows the dissemination of conversational data itself alongside user identifiers, including prompts, conversation titles, or chat IDs. Prior work relevant to this setting falls into three areas:

Third-party LLM Apps. An emerging app ecosystem layered atop foundation models exposes external services to the model via struc-tured tool interfaces. OpenAIâs GPTs and Anthropicâs MCP-based connectors are some of the few existing LLM app platforms. Prior work characterizes LLM apps as prompt-based wrappers combined with custom data-processing API integrations [31], examining their privacy posture without focusing on third-party integration [6]. Subsequent work audits OpenAIâs GPT app ecosystem, analyzing the natural-language specifications of GPT Actions to assess the data collection practices they declare [67]. Our work takes a more fundamental scope, studying the native AI layer of consumer ser-vices, which sits at the core of LLM app marketplaces.

Browser Agents and Extensions. Commercial agentic systems such as ChatGPT Atlas, Perplexity Comet, and AI-powered browser extensions like Sider and Monica act as external agents that drive the browser on behalf of their users. Prior studies enumerate the privacy risks of browser agents driving web sessions [55, 60], and audit popular GenAI browser extensions to measure data collection, processing, and sharing practices, as well as user profiling along demographic and interest attributes [61]. A complementary line of work characterizes browser and behavioral fingerprints of browsing agents [63], and evaluates same-origin policy enforcement across agentic browsers [54]. In contrast, we study assistants embedded directly in first-party services rather than installed as extensions, reaching a far broader user base by default. For instance, ChatGPT exceeds 1B installs just on the Play Store (cf. Table 1), compared to 5M for Monica, the most popular extension studied in [61].

First-Party Website and Mobile Services. A central contribution of our work is systematically studying and characterizing data leak-age from LLM services embedded in first-party websites and mobile applications, including conversational artifacts. Prior studies have examined third-party tracking in web-based AI services [32], pri-marily focusing on identifying trackers and characterizing their conventional data collection practices. Yet this work does not fully characterize the privacy risks arising from the generation, disclo-sure, and accessibility of conversation-derived information across both web and mobile AI services, covering their consent mecha-nisms and the impact of subscription tiers on trackerâs behavior. By jointly analyzing both web and mobile clients, conversation-derived artifacts, identity-linkage mechanisms, consent configurations, sub-scription tiers, and access-control policies, our work provides the first comprehensive assessment of privacy risks in mainstream conversational AI services. To probe these risks we adopt persona-based auditing with sensitive attributes, an established paradigm to uncover deep ad-targeting behavior [39].

10 Conclusions

This paper presented the first systematic measurement of third-party tracking in consumer conversational AI, analyzing nine promi-nent assistants across web and mobile clients under different con-sent states and subscription tiers. We showed that the tracking infrastructure of the web and mobile ecosystemsâtracking pixels, SDKs, persistent identifiers, and server-side forwardingâhas been carried into conversational AI, exposing conversation artifacts such as prompts, generated titles, and permalinks to third parties with advertising-based business models. These disclosures frequently occur alongside persistent identifiers, including advertising IDs, hashed email addresses, and tracking cookies, enabling conversa-tions to be linked to long-term user profiles. We further found that cookie consent and subscription tier provide limited protection, while permissive sharing defaults leave conversation permalinks publicly accessible. Using canary tokens, we confirmed that shared conversations are subsequently accessed from distributed third-party infrastructure. Together, these findings highlight tensions between current practices and obligations under the GDPR and ePrivacy Directive, exposing broader shortcomings in consent, ac-cess control, and transparency mechanisms and underscoring the need for stronger safeguards and accountability for conversational data flows.

Acknowledgments

This research was co-funded by RED2024-154240-T (EMACS) and by the European Union and the European Cybersecurity Compe-tence Centre under grant agreement No. 101309318 (REAL-PETS). G. Oliveira, JM. Santa Olalla GÃ³mez, and T. Jackevicius acknowl-edge the financial support received through the CYBERACTION-ING project, co-funded by the European Union under the Digital Europe Programme (Grant Agreement No. 101123445), which sup-ported this research carried out as part of the Masterâs Programme in International Cybersecurity and Cyberintelligence (MICAC). N. Vallina-Rodriguez and G. Suarez-Tangil have been appointed as 2019 RamÃ³n y Cajal fellows (RYC2020-030316-I and RYC2020-029401-I, respectively) funded by MICIU/AEI/10.13039/501100011033 and the ESF Investing in your future. G. Suarez-Tangil and M. Sanchezâs work was supported by a 2025 Leonardo Grant for Scientific Re-search and Cultural Creation from the BBVA Foundation (SHIFT, reference LEO25-1-19720). The opinions, findings, and conclusions or recommendations expressed are those of the authors and do not necessarily reflect those of any of the funding agencies. The BBVA Foundation accepts no responsibility for the opinions, statements, and contents included in the project and/or the results thereof, which are entirely the responsibility of the authors.

Ethical Considerations

This research involves observing privacy risks in widely used con-versational AI services, so we took care to act responsibly through-out the process. We did not exploit any vulnerability, access other usersâ conversations, or collect personal data from real users. All tests were carried out on accounts we owned only for research purposes, using a fixed prompt we authored ourselves, and traffic was captured locally through the browserâs developer tools.

13

Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

During our risk analysis, we determined that most of the issues reported in this study reflect intentional product-level practices rather than exploitable security vulnerabilities. Grok was the only service for which we identified a security concern that could be exploited by an external party, due to weak access controls on con-versation resources. This distinction guided our disclosure strategy. Our broader goal is to inform users, support regulatory oversight, and encourage providers to address the identified privacy risks and practices. Accordingly, we followed a responsible disclosure process for the exploitable security issue, providing xAI with an opportunity to investigate and remediate it prior to publication. We also notified relevant regulatory authorities of the broader privacy findings. The timeline of our disclosures was as follows:

â¢ 23 March 2026 â We first noticed tracker activity while analyz-ing the network traffic of Perplexity and Grok.

â¢ 6 April 2026 â We expanded the testing to cover major platforms in a systematic way, across different login states, cookie consent choices, account tiers, and privacy modes.

â¢ 13 April 2026 â We notified our findings to the relevant Data Protection Authorities (DPAs) in the European Union and UK.

â¢ 17 April 2026 â We notified xAI via their vulnerability disclosure email address about Grokâs conversation leaks due to their lack of access control mechanisms.

â¢ 4 May 2026 â We released part of our findings public on the project website, LeakyLM.

â¢ 27 May 2026 â The Spanish DPA, AEPD, cited our work request-ing to elevate the investigations for a plenary EDPB meeting to be held on June 6 2026 [3].

â¢ 15 Aug 2026 OpenAI updated ChatGPTâs privacy policy, ex-plicitly mentioning third-party trackers; but we cannot confirm whether this action was directly influenced by of our findings.

â¢ 10th Sept 2026 â Grok still uses publicly accessible permalinks. No official response has been received to date since our responsi-ble disclosure.

Open Science

To encourage reproducibility, we provide all research artifacts in https://github.com/guinucool/pbst2027.

AI Use

The authors used generative AI-based tools to revise the text, im-prove flow and clarity, correct typographical and grammatical er-rors, and create latex table structures. We have manually verified the integrity of this output. We do not use AI-based tools as part of our research methodology and data analysis pipeline, nor to generate figures. The literature review is of our own.

References

[1] Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan, and Claudia Diaz. 2014. The web never forgets: Persistent tracking mechanisms in the wild. In Conference on Computer and Communications Security (CCS) .[2] AdExchanger. 2026. Daily News Roundup: OpenAI, Advertising, and AI Com-merce. https://www.adexchanger.com/daily-news-roundup/tuesday-03032026/ Accessed: 2026-05-31. [3] AEPD. 2026. La Agencia promueve ante las autoridades europeas de protecciÃ³n de datos que se estudie si algunos sistemas de IA permiten a terceros acceder a las conversaciones. https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/ la-agencia-promueve-ante-las-autoridades-europeas-proteccion-estudie-ia. Ac-cessed: 2026-09-7. [4] Google Developers Blog. 2025. Under the Hood: Universal Commerce Pro-tocol (UCP). https://developers.googleblog.com/under-the-hood-universal-commerce-protocol-ucp/ Accessed: 2026-05-31. [5] Canary 2026. Canarytokens. https://canarytokens.org/. Accessed: 2026-05-27. [6] Juan-Carlos Carrillo, Jose Luis Martin-Navarro, Rongjun Ma, and Jose Such. 2026. Personal Data Flows and Privacy Policy Traceability in Third-party LLM Apps in the GPT Ecosystem. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[7] Certificate Transparency. 2026. crt.sh: Certificate Transparency Search. https: //crt.sh/. Accessed: 2026-05-29. [8] Jeffrey Yang Fan Chiang, Seungjae Lee, Jia-Bin Huang, Furong Huang, and Yizheng Chen. 2025. Why are web ai agents more vulnerable than standalone llms? a security analysis. arXiv preprint arXiv:2502.20383 (2025). [9] Cliqz GmbH and Ghostery GmbH. 2026. WhoTracks.Me. https://whotracks.me Accessed: 2026-05-24. [10] Aldo Cortesi, Maximilian Hils, Thomas Kriechbaumer, and contributors. 2010â. mitmproxy: A free and open source interactive HTTPS proxy. https://mitmproxy. org/ [11] Court of Justice of the European Union. 2019. Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV. https://eur-lex.europa.eu/legal-content/EN/TXT/ ?uri=CELEX:62017CJ0040 Case C-40/17, ECLI:EU:C:2019:629. [12] Court of Justice of the European Union. 2024. Gesamtverband Autoteile-Handel e.V. v Scania CV AB. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri= CELEX:62022CJ0319 Case C-319/22, ECLI:EU:C:2024:845. [13] Court of Justice of the European Union. 2024. Meta Platforms Ireland Ltd v Bundesverband der Verbraucherzentralen und VerbraucherverbÃ¤nde â Ver-braucherzentrale Bundesverband e.V. https://eur-lex.europa.eu/legal-content/ EN/TXT/?uri=CELEX:62022CJ0757 Case C-757/22, ECLI:EU:C:2024:598. [14] Court of Justice of the European Union. 2025. European Data Protec-tion Supervisor (EDPS) v Single Resolution Board (SRB). https://eur-lex. europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413 Case C-413/23 P, ECLI:EU:C:2025:645. [15] Criteo. 2025. Agentic Commerce Is Emerging, Just Not the Way Most People Expect. https://www.criteo.com/blog/agentic-commerce-is-emerging-just-not-the-way-most-people-expect/ Accessed: 2026-05-31. [16] Anthony Desnos, Geoffroy Gueguen, and Sebastian Bachmann. 2015. Androguard: Reverse engineering, malware and goodware analysis of android applications... and more (ninja!). https://androguard.github.io/androguard/. Accessed: 2026-05-25. [17] Yana Dimova, Gunes Acar, Lukasz Olejnik, Wouter Joosen, and Tom Van Goethem. 2021. The cname of the game: Large-scale analysis of dns-based tracking evasion. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[18] Android Official Documentation. 2025. Settings.Secure. https://developer.android. com/reference/android/provider/Settings.Secure#ANDROID_ID Accessed: 2026-05-31. [19] Peter Eckersley. 2010. How Unique Is Your Web Browser?. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[20] European Data Protection Board. 2022. Binding Decision 3/2022 on the dis-pute submitted by the Irish Supervisory Authority on Meta Platforms Ireland Limited and its Facebook service (Art. 65 GDPR) . Technical Report. European Data Protection Board. https://www.edpb.europa.eu/system/files/2023-01/edpb_ bindingdecision_202203_ie_sa_meta_facebookservice_redacted_en.pdf Adopted pursuant to Article 65 GDPR. [21] European Data Protection Board. 2024. Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive . Technical Report. European Data Protec-tion Board. https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_ 202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf [22] European Parliament and Council of the European Union. 2002. Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive). Official Journal of the European Union, L 201, 31 July 2002, pp. 37â47. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219 Article 5(3), as amended by Directive 2009/136/EC. [23] European Parliament and Council of the European Union. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Union, L 119, pp. 1â88. https://eur-lex.europa.eu/eli/reg/2016/679/oj [24] Ãlvaro Feal, Julien Gamba, Juan Tapiador, Primal Wijesekera, Joel Reardon, Serge Egelman, and Narseo Vallina-Rodriguez. 2021. Donât accept candy from strangers: An analysis of third-party mobile sdks. Data Protection and Privacy: Data Protection and Artificial Intelligence 13 (2021), 1. [25] Federal Trade Commission. 2024. No, hashing still doesnât make your data anonymous. https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/ no-hashing-still-doesnt-make-your-data-anonymous. Accessed: 2026-05-31. 14 Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents Proceedings on Privacy Enhancing Technologies YYYY(X)

[26] Imane Fouad, Cristiana Santos, and Pierre Laperdrix. 2024. The Devil is in the Details: Detection, Measurement and Lawfulness of Server-Side Tracking on the Web. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[27] Julien Gamba, Ãlvaro Feal, Eduardo Blazquez, Vinuri Bandara, Abbas Razagh-panah, Juan Tapiador, and Narseo Vallina-Rodriguez. 2023. Mules and permission laundering in android: Dissecting custom permissions in the wild. IEEE Transac-tions on Dependable and Secure Computing 21, 4 (2023), 1801â1816. [28] Aniketh Girish, Joel Reardon, Juan Tapiador, Srdjan Matic, and Narseo Vallina-Rodriguez. 2025. Your Signal, Their Data: An Empirical Privacy Analysis of Wireless-scanning SDKs in Android. In Proceedings on Privacy Enhancing Tech-nologies (PoPETs) .[29] Alejandro GÃ³mez-Boix, Pierre Laperdrix, and Benoit Baudry. 2018. Hiding in the crowd: an analysis of the effectiveness of browser fingerprinting at large scale. In Proceedings of the ACM Web Conference (WWW) .[30] Umar Iqbal, Steven Englehardt, and Zubair Shafiq. 2021. Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors. In IEEE Symposium on Security and Privacy (S&P) .[31] Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner. 2024. LLM platform security: Applying a systematic evaluation framework to OpenAIâs ChatGPT plugins. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society .[32] Muhammad Jazlan, Ethan Wang, Yash Vekaria, and Zubair Shafiq. 2026. Tracking Conversations: Measuring Content and Identity Exposure on AI Chatbots. arXiv preprint arXiv:2604.27438 (2026). [33] John Doe. 2026. Complaint for Damages and Demand for Jury Trial: Doe v. Perplexity AI, Inc. Complaint filed in the Superior Court of Califor-nia. https://cdn.arstechnica.net/wp-content/uploads/2026/04/Doe-v-Perplexity-Complaint-3-31-26.pdf Filed March 31, 2026. Available online. [34] Pierre Laperdrix, Gildas Avoine, Benoit Baudry, and Nick Nikiforakis. 2019. Morel-lian analysis for browsers: Making web authentication stronger with canvas fingerprinting. In Conference on Detection of Intrusions and Malware, and Vulner-ability Assessment (DIMVA) .[35] Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Ko-rczynski, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In Network and Distributed System Security Symposium (NDSS) .[36] Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2025. Safety Layers in Aligned Large Language Models: The Key to LLM Security. In International Conference on Learning Representations (ICLR) .[37] Luoxi Meng, Henry Feng, Ilia Shumailov, and Earlence Fernandes. 2025. cellmate: Sandboxing browser ai agents. arXiv preprint arXiv:2512.12594 (2025). [38] Meta for Developers. 2025. Meta Pixel Reference. https://web.archive.org/web/ 20250531104925/https://developers.facebook.com/docs/meta-pixel/reference/. [39] Maaz Bin Musa and Rishab Nithyanand. 2022. ATOM: Ad-network Tomography. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[40] Trung Tin Nguyen, Michael Backes, and Ben Stock. 2022. Freely given consent? studying consent notice of third-party tracking and its violations of gdpr in android apps. In Conference on Computer and Communications Security (CCS) .[41] NowSecure. 2025. NowSecure Uncovers Multiple Security and Privacy Flaws in DeepSeek iOS Mobile App. https://www.nowsecure.com/blog/2025/02/06/ nowsecure-uncovers-multiple-security-and-privacy-flaws-in-deepseek-ios-mobile-app/. Accessed: 2026-05-28. [42] OpenAI. 2022. Introducing ChatGPT. https://openai.com/blog/chatgpt Accessed: 2026-05-31. [43] OpenAI. 2025. How people are using ChatGPT. https://openai.com/index/how-people-are-using-chatgpt. Accessed: 2026-09-8. [44] Amogh Pradeep, Muhammad Talha Paracha, Protick Bhowmick, Ali Dava-nian, Abbas Razaghpanah, Taejoong Chung, Martina Lindorfer, Narseo Vallina-Rodriguez, Dave Levin, and David Choffnes. 2022. A comparative analysis of certificate pinning in Android & iOS. In Proceedings of the Internet Measurement Conference (IMC) .[45] Exodus Privacy. 2024. Homepage. https://exodus-privacy.eu.org/en/. Accessed: 2026-05-31. [46] Ole AndrÃ© Vadla RavnÃ¥s and contributors. 2014. Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. https://frida. re/ [47] Abbas Razaghpanah, Arian Akhavan Niaki, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Johanna Amann, and Phillipa Gill. 2017. Studying TLS usage in An-droid apps. In Conference on emerging Networking EXperiments and Technologies (CoNEXT) .[48] Abbas Razaghpanah, Rishab Nithyanand, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Mark Allman, Christian Kreibich, Phillipa Gill, et al. 2018. Apps, trackers, privacy, and regulators: A global study of the mobile tracking ecosystem. In Network and Distributed System Security Symposium (NDSS) .[49] Joel Reardon, Kenneth A. Bamberger, and Serge Egelman. 2024. Anonymity, Consent, and Other Noble Lies: An Empirical Study of the Data Econ-omy. https://ibl.law.uiowa.edu/anonymity-consent-and-other-noble-lies-empirical-study-data-economy. Accessed: 2026-05-31. [50] Joel Reardon, Ãlvaro Feal, Primal Wijesekera, Amit Elazari Bar On, Narseo Vallina-Rodriguez, and Serge Egelman. 2019. 50 ways to leak your data: An exploration of appsâ circumvention of the android permissions system. In Proceedings of the USENIX Security Symposium .[51] Reuters. 2025. OpenAI Projected at Least 220 Million People Will Pay for ChatGPT by 2030, The Information Reports. Reuters. https://www.reuters.com/technology/openai-projected-least-220-million-people-will-pay-chatgpt-by-2030-information-2025-11-26/ Accessed: 2026-05-31. [52] Reuters. 2026. OpenAI to introduce ads to all ChatGPT free and Go users in US. https://www.reuters.com/business/media-telecom/openai-expand-ads-chatgpt-all-free-low-cost-users-information-reports-2026-03-21/ [53] Irwin Reyes, Primal Wijesekera, Joel Reardon, Amit Elazari Bar On, Abbas Raza-ghpanah, Narseo Vallina-Rodriguez, Serge Egelman, et al. 2018. âWonât somebody think of the children?â examining COPPA compliance at scale. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[54] Franziska Roesner and David Kohlbrenner. 2026. Agentic Browsers and the Same-Origin Policy. In International Conference on Learning Representations (ICLR) .[55] Jaechul Roh, Eugene Bagdasarian, Hamed Haddadi, and Ali Shahin Shamsabadi. 2026. SPILLage: Agentic Oversharing on the Web. arXiv preprint arXiv:2602.13516

(2026). [56] Avishag Shapira, Parth Atulbhai Gandhi, Edan Habler, and Asaf Shabtai. 2025. Mind the web: The security of web use agents. arXiv preprint arXiv:2506.07153

(2025). [57] Singular. [n. d.]. Android SDK: Setting a User ID. Singular Developer Documen-tation. https://support.singular.net/hc/en-us/articles/35636052267803-Android-SDK-Setting-a-User-ID Accessed: 2026-05-31. [58] Thinkst Applied Research. 2026. Dockerized Canarytokens. https://github.com/ thinkst/canarytokens-docker. Accessed: 2026-05-27. [59] uBlock Origin Team. 2026. uBlock Origin. https://ublockorigin.com Accessed: 2026-05-24. [60] Alisha Ukani, Hamed Haddadi, Ali Shahin Shamsabadi, and Peter Snyder. 2025. Privacy Practices of Browser Agents. arXiv preprint arXiv:2512.07725 (2025). [61] Yash Vekaria, Aurelio Loris Canino, Jonathan Levitsky, Alex Ciechonski, Patricia Callejo, Anna Maria Mandalari, and Zubair Shafiq. 2025. Big Help or Big Brother? Auditing Tracking, Profiling, and Personalization in Generative {AI } Assistants. In Proceedings of the USENIX Security Symposium .[62] Tim Vlummens, Aniketh Girish, Nipuna Weerasekara, Frederik Zuiderveen Bor-gesius, Gunes Acar, and Narseo Vallina-Rodriguez. 2026. Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost. In Proceedings of the USENIX Security Symposium .[63] Ethan Wang, Zubair Shafiq, and Yash Vekaria. 2026. FP-Agent: Fingerprinting AI Browsing Agents. arXiv preprint arXiv:2605.01247 (2026). [64] Nipuna Weerasekara, JosÃ© Miguel Moreno, Srdjan Matic, Joel Reardon, Juan Tapi-ador, Narseo Vallina-RodrÃguez, et al. 2025. Tracking without borders: Studying the role of webviews in bridging mobile and web tracking. In Proceedings on Privacy Enhancing Technologies (PoPETs) .[65] Wired. 2026. OpenAI Enables Cookies by Default for Free ChatGPT Users. https://www.wired.com/story/openai-enables-cookies-by-default-for-free-chatgpt-users/ Accessed: 2026-05-31. [66] Fangzhou Wu, Ning Zhang, Somesh Jha, Patrick McDaniel, and Chaowei Xiao. 2024. A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems. arXiv:2402.18649 [cs.CR] https://arxiv.org/abs/2402.18649 [67] Yuhao Wu, Evin Jaff, Ke Yang, Ning Zhang, and Umar Iqbal. 2025. An in-depth investigation of data collection in llm app ecosystems. In Proceedings of the Internet Measurement Conference (IMC) .[68] Yuhao Wu, Ke Yang, Franziska Roesner, Tadayoshi Kohno, Ning Zhang, and Umar Iqbal. 2025. Towards Automating Data Access Permissions in AI Agents. arXiv:2511.17959 [cs.CR] https://arxiv.org/abs/2511.17959 [69] Zhonghao Zhan, Huichi Zhou, Zhenhao Li, Peiyuan Jing, Krinos Li, and Hamed Haddadi. 2026. How Adversarial Environments Mislead Agentic AI? arXiv preprint arXiv:2604.18874 (2026). 15 Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

A Conversation Titles

This section provides illustrative examples of how different AI ser-vices automatically synthesize user intent to generate chat session titles. As shown in Table 7, the web implementations of ChatGPT, Claude, and Grok result in different outcomes regarding brevity, cap-italization, and information density when condensing user prompts.

Table 7: Examples of automatically generated conversation titles derived from concise user prompts in the web imple-mentations of ChatGPT, Claude and Grok.

Prompt LLM Generated Title

What are the symptoms of early-stage Parkinsonâs disease?

ChatGPT Early-stage Parkinsonâs Symptoms Claude Early-stage Parkinsonâs dis-ease symptoms Grok Early Parkinsonâs Disease Symptoms

My salary is $85k. How much mortgage can I afford in NYC?

ChatGPT Mortgage Affordability in NYC Claude Mortgage affordability on $85k salary in NYC Grok $85k NYC Salary: $280k-$350k Mortgage

B CSP Relationships

We detail the observed CSP relationships identified across the ana-lyzed ecosystem. Specifically, Table 8 shows the number of different conversational AI providers that integrate these trackers into their CSP policies, highlighting the most prevalent third-party advertis-ing and analytics domains.

Table 8: Observed CSP relationships.

Organization Domain(s) # Providers Google Tag Manager googletagmanager.com 6Google Analytics google-analytics.com 5Google Ads googleadservices.com 4Google DoubleClick doubleclick.net 3Meta Pixel / Conversions API connect.facebook.net, 4facebook.net TikTok Analytics analytics.tiktok.com 2Reddit Ads / Analytics pixel-config.reddit.com, 2redditstatic.com Microsoft Bing bat.bing.com, bing.com 2Intercom intercom.io, intercomcdn.com 2

C Consent Implementations

To provide context on Privacy policies and the differences in im-plementation between providers, Figures 4, 5, 6 show snapshots of what cookie consent banners looked like at the time of capture.

Figure 4: Mistral web consent banner.

Figure 5: ChatGPT web consent banner.

Figure 6: Gemini web consent banner.

D Sample data sent

We list representative samples of data transmitted during interac-tions in Figures 7, 8, 9, 10, 11. The examples illustrate the informa-tion observed in requests sent to analytics, telemetry, and advertis-ing endpoints, including conversation identifiers, titles, prompts, URLs, user identifiers, and tracking pixels. Sensitive values have been redacted for readability and privacy.

16

Prompt like a Butterfly, Sting like a Tracker: A Privacy Analysis of Web and Mobile Conversational AI Agents Proceedings on Privacy Enhancing Technologies YYYY(X)

TikTok Pixel --- POST analytics . tiktok . com / api / v2 / pixel / act " user ":{" anonymous_id ": "< _ttp >", ...} , " page ":{ " url ": " https :// grok . com /c/< convUUID >? rid =..." , ... }, " meta ":{" title ": "< convTitle >", ...} Meta Pixel PageView --- GET www . facebook . com / tr /?... ev = PageView dl = https :// grok . com /c/< convUUID >? rid =... fbp = < _fbp > pmd [ title ] = < convTitle > Meta Pixel SubscribedButtonClick ( share ) --- GET www . facebook . com / tr /?... ev = SubscribedButtonClick dl = https :// grok . com /c/< convUUID >? rid =... cd [ buttonText ] = Share cd [ pageFeatures ] = {" title ":" < convTitle > "} fbp = < _fbp > sGTM relay --- POST sgtm - prod -985009374134. us - central1 . run . app / data ? event = sent_3_chat_messages " page_location ": " https :// grok . com /c/< convUUID >? rid =..." , " page_referrer ": " https :// accounts .x. ai /" , " page_title ": "< convTitle >", " common_cookie ": {" _fbp ": "< _fbp >", " _ttp ": "< _ttp >" }, " _dcid_temp ": "< _dcid >" Twitter Pixel --- GET analytics . twitter . com /1/ i/ adsct ?... pt = < convTitle > tw_document_href = https :// grok . com /c/< convUUID >? rid =... twpid = < _twpid > Google Ads --- GET www . googleadservices . com / pagead / conversion /... url = https :// grok . com /c/< convUUID >? rid =... ref = https :// accounts .x. ai / tiba = < convTitle > em = tv .1~ em .< userHash >

Figure 7: A single Grok conversation propagates to seven advertising and analytics trackers. Every recipient receives the same conversation identifier and the automatically gen-erated title. Meta ( _fbp ), TikTok ( _ttp ), and Twitter ( _twpid )cookies are synced across the flowsâthe Meta and TikTok cookies also travel server-to-server through the sGTM re-lay, invisible to ad blockersâand Google Ads additionally receives hashed user information ( em ).

GET region1 . google - analytics . com /g/ collect ?... cid = < cid > dl = https :// gemini . google - b197145817 . com / app / dt = < convTitle >

Figure 8: Google Analytics collects conversation Title from Gemini.

POST browser - intake - us5 - datadoghq . com / api / v2 / spans " resource ": "/ organizations /{ organization }/ chat_conversations /{ chat }/ share " " http . url ": " https :// claude . ai / api / organizations /< orgUUID >/ chat_conversations /< convUUID >/ share ", " usr ": {" id ": "< userUUID >", " account_uuid ": "< userUUID >", " organization_id ": "< orgUUID >", " subscription_level ": " free " }, " session ": { " id ": "< sessionUUID >" }, " view ": { " id ": "< viewUUID >" }, " user_action ": { " id ": "< actionUUID >" }, " device ": { " model ": " AOSP on sargo ", " ram_mb ": 3577 }, " os ": { " name ": " Android ", " version ": "12" }

Figure 9: Datadog span emitted by the Claude mobile app for a conversation-share action. The Anthropic organization, conversation, and share UUIDs travel in the resource URL alongside account identifiers; further session, view, and per-action UUIDs let the recipient stitch every gesture into the same authenticated profile. The share resource is created without explicit user interaction.

POST browser - intake - us5 - datadoghq . com / api / v2 / rum ?dd - api -key =... {" type ": " long_task ", " application ":{" id ":" < applicationUUID > "} , " view ": {" url ":" https :// claude . ai / share /{ id }" , ...} , " session ":{" id ":" < sessionUUID > " ," type ":" user "} , " usr ": {" anonymous_id ":" < anonUUID > " ,...} , " long_task ":{ " scripts ":[{ " source_url ":" https :// claude . ai / share /< shareUUID >", " invoker ": " https :// claude . ai / share /< shareUUID >" }] }, ... }

Figure 10: Datadog RUM beacon emitted by the Claude web

client. The shared-conversation permalink is reported as the long-task script source and invoker, alongside application and session identifiers.

17 Proceedings on Privacy Enhancing Technologies YYYY(X) Oliveira et al.

TikTok Pixel ---POST analytics . tiktok . com / api / v2 / pixel / act " page ":{ " url ": " https :// grok . com / share /< shareUUID >? rid =..." , ... }, " open_graph ":{ " og : image ": " https :// grok . com / share /< shareUUID >/ opengraph - image /< shareUUID >", " og : image : alt ": "< convScreenshotPreview >", ... }, " meta ":{ " title ": "< convTitle >", " meta : description ": "< UserPrompt >" }Meta Pixel PageView ---GET www . facebook . com / tr /?... ev =PageView dl =https :// grok . com / share /< shareUUID >? rid =... fbp =< _fbp > pmd [ title ] =< convTitle > pmd [ description ] =< UserPrompt >

Figure 11: A shared Grok conversation propagates extra infor-mation about the conversation to Meta and TikTok advertis-ing and analytics trackers. Both recipients receives the same shared conversation identifier, the automatically generated title and the last user prompt. Meta ( _fbp ) and TikTok ( _ttp )cookies are synced across the flows. Additionally, TikTok receives a screenshot of the most recent part of the conversa-tion, as shown in Figure 12.

E Conversation Screenshots Leakage

We captured Grokâs screenshot as transmitted to TikTok when a shared conversation is accessed, as shown in Figure 11. The screen-shot captures a leaked user conversation in Grok, as it is illustrated in Figure 12.

Figure 12: An example of the exact screenshot that gets sent to TikTok by Grok on shared interactions.

æ¥æºï¼ Hacker Newsï¼AI çå¸ Â· jorgegarciaherrero.com

#

è®ºæ/ç ç©¶

å®å ¨/å¯¹é½

OpenAI

Google

Anthropic

IMDEA Networks 论文：九款对话式 AI 服务向第三方泄露对话标题、提示词与截图

TL;DR · AI 摘要

核心要点

IMDEA Networks è®ºæï¼ä¹æ¬¾å¯¹è¯å¼ AI æå¡åç¬¬ä¸æ¹æ³é²å¯¹è¯æ é¢ãæç¤ºè¯ä¸æªå¾ Â· AIHOT

IMDEA Networks è®ºæï¼ä¹æ¬¾å¯¹è¯å¼ AI æå¡åç¬¬ä¸æ¹æ³é²å¯¹è¯æ é¢ãæç¤ºè¯ä¸æªå¾

åè´è¶ä¸æ ·æç¤ºï¼åè¿½è¸ªå¨ä¸æ ·èäººï¼å¯¹ç½é¡µåç§»å¨ç«¯å¯¹è¯å¼ AI ä»£ççéç§åæ

Guilherme Oliveira

Miguel Sanchez

Juan Manuel De Santa Olalla GÃ³mez

Roi S. Serna

Tautvydas Jackevicius

Jorge Garcia-Herrero

Aniketh Girish

Guillermo Suarez-Tangil

Narseo Vallina-Rodriguez

æè¦

å ³é®è¯

1 å¼è¨

2 èæ¯

2.1 å¯¹è¯å¼æºè½ä½

2.2 ç§»å¨ç«¯åç½é¡µè¿½è¸ª

3 å¯¹è¯å¼ AI æå¡ä¸­çéç§é£é©

4 æ¹æ³

4.1 å¯¹è¯å¼ AI æå¡éæ©

4.2 ç½ç«åæ

4.3 Android åºç¨åæ

4.4 åæè¡¨ååè®¢é å±çº§

4.5 å¯¹è¯ä¸æç¤ºè¾å ¥

5 ç¬¬ä¸æ¹æå¡åæ

5.1 Webä¸ç§»å¨ç«¯è·è¸ª

5.2 åæä¸è®¢é å±çº§çå½±å

6 éç§åæ

6.1 å¯¹è¯äº§ç©çä¼ æ­

6.2 å°å¯¹è¯å ³èå°ç¨æ·èº«ä»½

6.3 å¯¹è¯æ°¸ä¹ é¾æ¥çå¯è®¿é®æ§

6.4 å¯¹è¯å ±äº«

6.5 å¯¹è¯è®¿é®è¯æ®

7 æ³å¾èæ¯

7.1 ePrivacy æä»¤

7.2 GDPR Regulation (EU) 2016/679

8 Discussion

8.1 Limitations

8.2 Mitigation

9 Related Work

10 Conclusions

Acknowledgments

Ethical Considerations

Open Science

AI Use

References

A Conversation Titles

B CSP Relationships

C Consent Implementations

D Sample data sent

E Conversation Screenshots Leakage

IMDEA Networks è®ºæï¼ä¹æ¬¾å¯¹è¯å¼ AI æå¡åç¬¬ä¸æ¹æ³é²å¯¹è¯æ é¢ãæç¤ºè¯ä¸æªå¾ Â· AIHOT

IMDEA Networks è®ºæï¼ä¹æ¬¾å¯¹è¯å¼ AI æå¡åç¬¬ä¸æ¹æ³é²å¯¹è¯æ é¢ãæç¤ºè¯ä¸æªå¾

åè´è¶ä¸æ ·æç¤ºï¼åè¿½è¸ªå¨ä¸æ ·èäººï¼å¯¹ç½é¡µåç§»å¨ç«¯å¯¹è¯å¼ AI ä»£ççéç§åæ

æè¦

å ³é®è¯

1 å¼è¨

2 èæ¯

2.1 å¯¹è¯å¼æºè½ä½

2.2 ç§»å¨ç«¯åç½é¡µè¿½è¸ª

3 å¯¹è¯å¼ AI æå¡ä¸çéç§é£é©

4 æ¹æ³

4.1 å¯¹è¯å¼ AI æå¡éæ©

4.2 ç½ç«åæ

4.3 Android åºç¨åæ

4.4 åæè¡¨ååè®¢é å±çº§

4.5 å¯¹è¯ä¸æç¤ºè¾å ¥

5 ç¬¬ä¸æ¹æå¡åæ

5.1 Webä¸ç§»å¨ç«¯è·è¸ª

5.2 åæä¸è®¢é å±çº§çå½±å

6 éç§åæ

6.1 å¯¹è¯äº§ç©çä¼ æ

6.2 å°å¯¹è¯å ³èå°ç¨æ·èº«ä»½

6.3 å¯¹è¯æ°¸ä¹ é¾æ¥çå¯è®¿é®æ§

6.4 å¯¹è¯å ±äº«

6.5 å¯¹è¯è®¿é®è¯æ®

7 æ³å¾èæ¯

7.1 ePrivacy æä»¤