A Privacy Analysis of Web and Mobile Conversational AI Agents [pdf]

Original Article ↗ Hacker News Discussion ↗

Researchers have found that popular web and mobile AI chat services leak or share sensitive conversation data with third-party trackers, including full chat histories via publicly accessible URLs, screenshots, and auto-generated titles tied to user identifiers. Commenters argue over whether this is incompetence or a deliberate ad-tech business model, but broadly agree it creates serious privacy and regulatory risks, especially under frameworks like GDPR. Many see this as further evidence that cloud-based AI tools should not be trusted with private information and advocate for local or open-source models as safer alternatives.

Data exposure mechanisms

  • Several providers expose whole conversations via unauthenticated “share” permalinks; anyone with the URL (including trackers and crawlers) can read the full chat.
  • Screenshots of chats sent to social apps (e.g., during sharing flows) can leak visible conversation content to those apps.
  • Conversation-derived artifacts (titles, prompts, summaries) get tied to persistent identifiers or cookies, enabling attribution and highly sensitive profiling (e.g., inferred salary, location, mortgage).
  • Some web UIs send partial/unfinished prompts to servers as the user types; purpose is unclear (caching vs. behavioral tracking vs. bot detection).

Security model & implementation concerns

  • Heavy criticism of “security by obscurity”: long UUID URLs treated as private even though they end up in browser history, clipboards, previews, plugins, and URL shorteners.
  • Mobile and web apps embed common ad/analytics trackers (Google, TikTok, Meta, etc.) via CSP, enabling third parties to see prompt-derived metadata.
  • Chat UIs are described as “minefields” where one mistaken click can share or train on data.

Leak vs. sale vs. incompetence

  • Some frame this as intentional data selling/sharing, not “leaks,” pointing to terms allowing third-party access.
  • Others argue much of it is rushed, “vibecoded” incompetence and misconfigured tracking rather than sophisticated monetization.
  • Counterpoint: at this scale, “incompetence” still warrants full accountability; advanced incompetence can be indistinguishable from malice.

Legal and regulatory angles

  • Multiple comments suggest EU GDPR likely makes some of these practices unlawful.
  • In the US, people expect it to be technically “legal” but ethically dubious.

Business model & incentives

  • Discussion on whether AI companies will hoard data for their own ad targeting (like big social platforms) versus handing value to external ad networks.
  • Some see this as inevitable once ads enter chat products; others note companies are still burning cash and may be trading privacy for short-term revenue.

User reactions and mitigation

  • Many express lack of surprise and deep distrust: assume any cloud AI chat is logged and monetized.
  • Recommendations include:
    • Use local/open-weight models where possible.
    • Access frontier models via API through third-party clients or self-hosted UIs to avoid web/mobile tracking (with caveats that API behavior is opaque).
    • Avoid sharing links and screenshots; be cautious with permissions and marketing cookies.
  • Some propose adversarial tactics like seeding accounts with fake, conflicting chat histories, though this may trigger platform penalties.

Broader societal concerns

  • Fears that AI chat data creates far deeper behavioral and psychological profiles than older ad-tech.
  • Worry that such profiling could feed into real-world surveillance and control, beyond advertising alone.