A shopper opens an AI chatbot and types “pregnancy test near me.” Within seconds, that prompt and the assistant’s answer — pharmacy names included — arrive in readable plaintext at Microsoft Clarity, a session replay service, along with identifiers that advertising networks can use. Nobody hacked anything. This is just how the page was built. That scene comes from “Tracking Conversations: Measuring Content and Identity Exposure on AI Chatbots”, a University of California, Davis study published this spring — the first systematic measurement of web tracking on AI chatbot platforms. For anyone in commerce, the timing is uncomfortable: the chat window is becoming a primary shopping surface exactly as researchers demonstrate how leaky that surface can be.
This article walks through what the study found, how it collides with the ad ecosystem now being built inside AI assistants, and what it means practically for brands — including the ones running chatbots on their own storefronts.
What the researchers did, and what leaked
The UC Davis team (Muhammad Jazlan, Ethan Wang, Yash Vekaria, and Zubair Shafiq) tested 20 popular chatbot services, including ChatGPT, Gemini, Claude, Copilot, Perplexity, Grok, DeepSeek, Meta AI, and a dozen smaller players. The method was deliberately simple: fresh accounts, a single sensitive prompt (“pregnancy test near me”), and a full capture of every network request the page made — in normal mode and in private chat mode.
The headline numbers:
- 17 of 20 chatbots shared information with at least one third party
- 178 distinct chatbot-to-third-party domain pairs across 47 companies
- 3 services sent readable conversation text to Microsoft Clarity
- 12 of 20 contacted advertising services, across 73 chatbot-to-advertiser pairs
The exposure came in layers. At the worst end, Genspark, SeaArt, and ChatOn transmitted plaintext prompts and responses to Clarity — session replay tools record the rendered page, and on a chatbot page the rendered page is the conversation. Genspark also embedded the full prompt into Google Maps widget URLs. SeaArt contacted 13 separate ad platforms in one session, including Meta, Google, Amazon, TikTok, and Reddit.
A middle tier — 15 of the 20 services — shared conversation URLs or chat identifiers with analytics, advertising, or social endpoints. Not the words themselves, but durable pointers to the conversation, attached to cookies that ad networks recognize.
And identity leaked through side doors. Character.AI, Claude, and Mistral sent user email addresses, names, and internal IDs to Intercom, a support widget, without the user ever opening the widget. Meta’s _fbp cookie and Microsoft’s UET tags showed up attached to chatbot sessions on multiple services.
Three services contacted no third parties at all: Gemini, Meta AI, and Duck.ai. And one finding cuts the other way — private or temporary chat modes collapsed the 178 third-party pairs to 13, with zero content or identity exposure observed. The mitigation exists. It’s just off by default.
This lands in the middle of the AI advertising gold rush
The study would be a niche privacy story if chat were still a toy. It isn’t. AI referral traffic converts 42% better than non-AI traffic, OpenAI’s self-serve ads business went broadly live this month, and by industry tracking, ads now appear in roughly half of US ChatGPT replies on free tiers. The conversations people have with assistants — health, money, family, gifts — are the highest-intent commercial signal ever collected in one place.
Which is exactly why the data flows matter. OpenAI, to be clear, is not what the study caught: its stated policy is that conversations, memories, and chat history are never shared with advertisers, targeting signals stay inside ChatGPT, and advertisers get only aggregated metrics. But its April 30, 2026 US privacy policy update also formalized sharing limited identifiers — cookie IDs, device IDs — with marketing partners, and receiving purchase data back from advertisers for attribution. The walls hold the words in; the plumbing for measurement still runs through them.
The smaller services in the study didn’t build walls at all. That spread — from “sealed but measured” to “streamed to thirteen ad networks” — is the current state of the market.
The chat window is becoming the store. This study shows some of the stores came pre-wired with cameras.
Regulators noticed before the paper did. On January 22, 2026, Senator Ed Markey wrote to the CEOs of OpenAI, Anthropic, Google, Meta, Microsoft, Snap, and xAI demanding details on ad targeting and the handling of sensitive conversations, citing FTC warnings about “blurred advertising.” His Youth AI Privacy Act followed in March. The direction of travel is unmistakable: conversational data is about to be treated as a special category, the way health and financial data already are.
And there’s precedent for how fast conversational privacy can fail in public. In mid-2025, ChatGPT’s shared-conversation links were indexed by Google — roughly 4,500 conversations surfaced in search results and an estimated 100,000 were scraped or archived before OpenAI killed the feature. Names, resumes, and personal disclosures included. Every one of those was a user who thought they were having a private conversation.
Why a merchant should care about someone else’s tracking scripts
It’s tempting to file this under “platform problem.” Three reasons not to.
Trust is conversion infrastructure. The entire agentic commerce thesis rests on shoppers telling assistants things they’d never type into a search box — budgets, recipients, health contexts, sizes. That candor is why AI-referred visitors convert so well. Every tracking scandal teaches shoppers to say less, switch to private modes (which, per the study, users would be rational to do), or pay for ad-free tiers. A funnel built on candor erodes when candor gets punished.
Your ad dollars inherit the platform’s practices. As budgets move into conversational surfaces, “where does this platform send conversation data?” becomes a brand-safety question, the same way ad-fraud and content-adjacency questions matured for programmatic. The study hands media teams a due-diligence checklist: does the surface embed session replay? Does it fire ad pixels on conversation pages? Does its private mode actually stop the flow?
And the sharpest reason: you probably run a chatbot too. The mechanism behind the worst findings — session replay capturing the rendered conversation — applies to any site that embeds both a chat widget and a tool like Clarity, Hotjar, or FullStory. That describes a large share of e-commerce storefronts. If your product-advice bot discusses skin conditions, sizes, or gift recipients and your replay tool isn’t masking the chat container, you are the Genspark of your own domain. US plaintiffs’ firms have already spent years filing wiretapping claims over session replay alone; Zillow’s session-replay lawsuits predate chatbots entirely. Adding an AI conversation to the recorded page raises the stakes considerably.
The storefront chatbot audit: five checks
The researchers’ recommended mitigations for chatbot providers translate almost directly into a checklist for merchants running conversational features:
- Mask the chat DOM in session replay. Clarity, Hotjar, and FullStory all support element-level masking. The chat transcript container should be masked unconditionally — not just input fields.
- Strip conversation identifiers from URLs. If your chat creates shareable or stateful URLs, keep chat IDs out of anything that analytics tools collect as page paths, and out of page titles.
- Audit which tags fire on chat pages. Run the conversation flow with your browser’s network panel open, exactly as the researchers did. Every third-party request on a page where a customer is typing freely needs a justification.
- Keep identity out of analytics payloads. Names, emails, and user IDs do not belong in events sent to error trackers, A/B testing tools, or support widgets that the user hasn’t opened.
- Test your private/guest experience. The study’s most hopeful finding is that restraint is achievable: private modes dropped exposure to near zero. Gemini, Meta AI, and Duck.ai showed a mainstream chatbot can contact no third parties at all.
None of this is exotic engineering. It’s configuration — which is precisely the study’s point. The leaks weren’t sophisticated; the defaults were just never reviewed with a conversation on the page.
Frequently Asked Questions
Did the study catch ChatGPT sending conversations to advertisers?
No. The plaintext-conversation findings involved Genspark, SeaArt, and ChatOn transmitting to Microsoft Clarity. ChatGPT was among the 17 services with some third-party sharing (identifiers, analytics), but OpenAI’s stated policy is that conversation content, history, and memories are never shared with advertisers, and targeting signals stay inside ChatGPT.
What is session replay, and why is it the main culprit?
Session replay tools record the rendered page — clicks, scrolls, and visible content — so teams can watch playback of user sessions to debug UX. On a chatbot page the visible content is the conversation itself, so unless the chat container is explicitly masked, the recording contains both what the user typed and what the model answered.
Do private or temporary chat modes actually help?
In this study, dramatically: across the 20 services, private modes reduced third-party domain pairs from 178 to 13, and the researchers observed no content or identity exposure to third parties in private sessions. Private modes address tracking better than their marketing (which focuses on retention) suggests.
Is a merchant liable if its embedded chat widget leaks conversations?
The tracking scripts run on your domain under your tag configuration, and US session-replay wiretapping suits have targeted site owners, not just tool vendors. Treat an unmasked storefront chatbot plus session replay as a compliance exposure worth fixing this quarter; specifics vary by jurisdiction, so run it past counsel.
Building conversational commerce without the leaks? Run the free Readiness Audit to see how your store looks to AI agents, or talk to us about agent-ready architecture that treats customer conversations as the asset they are.
