📌 Highlights
The paper's central claim is that ordinary third-party web tracking becomes a contextual privacy channel when deployed inside AI chat interfaces. Across 42 platforms, the authors report title leakage on 21 platforms and verbatim prompt leakage on nine; the strongest limitation is that the results are a time- and configuration-specific snapshot of free web interfaces measured from one US-East location.
- The study covers 25 general-purpose and 17 task-specific chatbots.
- Four general-purpose tracker owners receive more than 70% of tracker traffic; Google alone receives more than 40%.
- Among 13 general-purpose platforms leaking context, 11 also expose email and eight permit same-company identity correlation.
- Prompt submission and in-app navigation are the primary leakage vectors.
- Task-specific platforms leak medical, legal, and educational context despite their higher sensitivity.
🎯 Introduction
AI chatbot interactions differ from ordinary web activity because users routinely provide detailed, contextual information rather than short search keywords. Conversation histories and automatically generated titles can encode medical symptoms, legal circumstances, financial concerns, or personal disclosures. The paper frames this as a mismatch between chatbot semantics and traditional web-tracking assumptions: a page title or URL that would be innocuous on a conventional site may reveal user intent on a chatbot.
Prior studies examined third-party tracking on smaller chatbot samples or through single-prompt network capture, but the paper argues that those approaches miss interaction-dependent leakage such as titles generated after the first prompt, navigation-triggered page views, and task-specific chatbots in sensitive domains. The paper-level objective is therefore to measure leakage at scale while identifying both the causal user action and the JavaScript mechanism that extracted the data.
🔬 Methodology
The corpus contains 42 web-based platforms: 25 general-purpose chatbots selected from public popularity rankings and 17 task-specific systems spanning education, health, and legal assistance. Measurements were conducted from a US-East vantage point between May 6 and May 20, 2026. Sessions used clean browser instances, default platform configurations, accepted cookie or consent prompts, fixed generic and sensitive prompts, and—where supported—separate Gmail and custom-domain accounts.
Puppeteer captured full outbound traffic, including URLs, cookies, headers, and POST bodies. VisibleV8 supplied the causal layer by logging JavaScript property reads, DOM queries, function calls, and network operations. Five isolated scenarios were compared against a prompt-submission baseline: submission, navigation, deletion, scrolling, and unrelated button clicks. A request counted as leakage when a third-party eTLD+1 or same-vendor external domain received the seeded prompt, generated title, or identity data, after excluding infrastructure, CDN, consent, CAPTCHA, payment, and platform-owned domains.
The method also reconstructs the extraction path. The paper observes document.title reads on eight of nine platforms examined in the capture-mechanism analysis; Meta Pixel queries title elements on five platforms, Microsoft Clarity walks visible DOM content and form values on three platforms, and Manus exposes click-derived attributes through Amplitude or Sentry. You.com provides a distinct path by placing the prompt directly in the page URL.
page 3
page 6
📊 Experiments
The evaluation is a measurement corpus rather than a conventional ML benchmark. It covers 42 platforms and evaluates network exposure, contextual leakage, identity correlation, interaction triggers, and JavaScript capture mechanisms. Tracker ownership was consolidated across domains; 88.9% of domain assignments were confirmed by both Disconnect and DuckDuckGo Tracker Radar, and 97.2% by at least one source.
Within the 25 general-purpose platforms, 13 leak conversation titles and four leak raw prompts. You.com and Genspark send 62 and 40 title-bearing requests per prompt to Google, respectively, while You.com sends an average of 92 prompt-bearing requests to Google per submitted prompt. Google receives more than 40% of tracker traffic, followed by Microsoft at 12.2%, ByteDance at 8.6%, and Meta at 8.3%; together these four companies receive more than 70%. Figure 6 covers title leakage, Figure 7 covers raw-prompt leakage, and Figure 8 shows concentration of context-bearing requests by tracker owner.
Identity linkage is substantial. Of the 13 general-purpose platforms leaking context, 11 also send email to trackers and eight send both email and conversation context to the same company. For Writesonic and You.com, both signals appear on the same outbound request; for four other platforms, shared persistent identifiers connect separate requests. Google can re-identify users on at least four of those eight platforms. Writesonic sends both signals to six distinct companies.
Among 17 task-specific platforms, eight leak titles and five leak verbatim prompts. All eight context-leaking platforms also transmit email to a third party, and seven send both signals to one company. Category-level results vary: education platforms average roughly 367 tracker requests per platform with about 24% carrying user content, legal platforms average 317 requests with 9% carrying content, and health platforms average 124 requests with 3%. The paper notes that these category results are concentrated in individual platforms, with SciSpace responsible for roughly 80% of education leakage requests and AI Lawyer for nearly all legal leakage requests.
The interaction decomposition finds six platforms leaking context on prompt submission and all nine analyzed platforms exposing titles during navigation. Scroll and unrelated clicks generally re-fire existing tags, while deletion triggers additional leakage on only Writesonic. The supplied scenario table records these platform-by-interaction outcomes, and the capture-mechanism table maps observed leakage to browser APIs and trackers.
tab:scenario-leakage
Caption: Prompt or title leakage to third parties by interaction.
| Platform | Submit | Navigate | Delete | Scroll | Click |
|---|---|---|---|---|---|
| Zenochat | red!30 | red!30 | blue!20 55 | red!30 | red!30 |
| You.com | red!30 | red!30 | blue!20 55 | red!30 | red!30 |
| Quillbot | blue!20 55 | red!30 | blue!20 55 | blue!20 55 | blue!20 55 |
| Manus | blue!20 55 | red!30 | blue!20 55 | blue!20 55 | blue!20 55 |
| Kimi | red!30 | red!30 | blue!20 55 | red!30 | red!30 |
| DeepSeek | red!30 | red!30 | blue!20 55 | blue!20 55 | blue!20 55 |
| Genspark | red!30 | red!30 | blue!20 55 | red!30 | red!30 |
| Writesonic | red!30 | red!30 | red!30 | N/A | N/A |
| ChatOn | blue!20 55 | red!30 | blue!20 55 | N/A | N/A |
Why It Matters: This table supports the paper's causal conclusion that submission and navigation are the dominant leakage triggers, while scrolling and unrelated clicks generally re-fire existing trackers rather than introduce new destinations.
tab:capture-mechanisms
Caption: VV8 contextual capture mechanisms used by trackers on AI chat platforms.
| Capture Method | Operation Description | Trackers | Platforms |
|---|---|---|---|
| document.title (getter) | Property access on document.title | Google Analytics, Clarity, Naver, X/Twitter, Amplitude, Volcengine, TikTok Pixel | Zenochat, Writesonic, ChatOn, Genspark, Kimi, Manus, Quillbot, DeepSeek |
| document.querySelector("title") | DOM query for <title> element, then reads textContent | Meta Pixel, TikTok Pixel | Zenochat, Genspark, Manus, Quillbot, Writesonic |
| document.getElementsByTagName ("title") | DOM query for <title> element collection | Google Analytics | Zenochat |
| element.textContent / element.value | Walks DOM tree, reads all visible text and form values | Clarity | Zenochat, Writesonic, Quillbot |
| element.getAttribute + element.textContent | Reads HTML attributes and text of clicked/interacted DOM elements | Amplitude, Sentry | Manus |
| location.href | Reads page URL which contains prompt directly | Google Ads | You.com |
Why It Matters: The table connects leaked values to concrete browser APIs, giving engineers actionable audit points and showing that leakage can occur through standard analytics and session-replay behavior without a tracker explicitly targeting chatbot semantics.
fig:whole_string_title_leaks_chatbot_owner
Caption: Whole-string title leaks per generic chatbot, averaged per prompt.
Why It Matters: This figure identifies which general-purpose platforms transmit conversation titles and which tracker owners receive them, showing that title leakage is distributed across multiple platforms and destinations.
fig:whole_string_prompt_leaks_chatbot_owner
Caption: Whole-string prompt leaks per generic chatbot, averaged per prompt.
Why It Matters: This figure isolates the more severe case where the verbatim user prompt appears in tracker-bound requests, including the particularly high volume observed for You.com.
fig:whole_string_leaks_top_3p_domains_distinct_requests_grouped_by_owners
Caption: Distinct context-bearing (title or prompt) requests from generic chatbots to top tracker domains.
Why It Matters: The figure shows ecosystem-level concentration: Google receives 230 distinct context-bearing requests across eight chatbot platforms, while Meta receives about 55 across the same breadth.
fig:background-image
Caption: Overview of contextual leakage from an AI chatbot platform to a third-party tracker.
Why It Matters: The overview clarifies the identity-linkage threat: a tracker can first obtain an email and later receive a prompt-derived title or prompt, allowing conversational context to be associated with a user.
🔮 Conclusion
The paper concludes that contextual leakage is systemic across the measured chatbot ecosystem, not an isolated implementation error. Conventional analytics, advertising, and session-replay scripts can capture titles, prompts, and identity signals because chatbot interfaces render user-generated content into URLs and DOM structures traditionally treated as low-sensitivity page metadata.
The strongest practical finding is the combination of context and identity leakage: eight general-purpose platforms allow a single tracker owner to receive both conversation content and email, while seven task-specific platforms allow the same type of linkage. The authors therefore argue that third-party tracking on AI chatbot interfaces should be treated as a distinct privacy risk requiring platform-specific review.
🛠️ Future Research Improvements
A broader longitudinal study should repeat the measurements over time because tracker deployments and chatbot interfaces change. Repeated runs would also strengthen the Gmail-versus-non-Gmail comparison, which the paper treats as preliminary because it used one session per configuration.
Coverage should expand beyond free web interfaces to paid tiers, mobile and desktop applications, regional variants, and different consent states. Comparing logged-in and logged-out behavior would help separate platform defaults from account-specific tracking.
Future work should evaluate mitigations directly: strict third-party isolation, redaction of dynamic titles, URL hygiene, Content Security Policy changes, tracker allowlists, and browser-level defenses that prevent third-party scripts from reading conversation DOM content.
🏭 Potential Industry Use Scenarios
Chatbot builders can use the study's VV8-style workflow as a privacy regression harness for every release, testing whether prompts or generated titles appear in third-party requests after submission, navigation, deletion, scrolling, or unrelated clicks.
Health, legal, education, and mental-wellness products can apply the findings to vendor review and data-protection assessments. In these settings, even hashed email identifiers or low-volume leakage may carry substantial risk because the conversational content itself can reveal sensitive circumstances.
Analytics vendors and session-replay providers can use the capture-mechanism taxonomy to add chatbot-aware defaults, such as blocking title and message nodes, suppressing form values, and preventing prompt-bearing URLs from being collected. The paper provides evidence for these scenarios but does not evaluate the effectiveness or operational cost of specific mitigations.
💬 Critical Analysis
The study is technically strong in its combination of network observation and JavaScript-level causality. Network-only analysis can show that data arrived at a tracker but cannot reliably identify which interaction or DOM read caused it; VisibleV8 closes that gap and makes the mechanism concrete. The fixed prompts, clean browser state, scenario isolation, and manual interaction design also improve comparability across heterogeneous platforms.
The main interpretive caution is external validity. Results reflect free web interfaces, accepted consent, one geographic vantage point, and a narrow measurement window. The category-level task-specific findings are explicitly driven by the sampled platforms rather than representative estimates of all education, health, or legal chatbots. The tracker attribution process is well documented, but the paper's evidence does not establish how recipients would use the leaked data beyond the demonstrated technical ability to receive and potentially correlate it.
A second caution concerns severity measurement. The study demonstrates transmission and identity-linkage conditions, but it does not quantify downstream retention, human access, advertiser use, or legal consequences. It also distinguishes hashed from raw email exposure but does not experimentally measure re-identification success for every case. These are important follow-up questions for builders evaluating risk thresholds and remediation priorities.