AI browsers accused of harvesting sensitive data, according to new study
Researchers warn that AI-powered browsers track and share personal data, sometimes during private browsing, potentially breaching GDPR and US privacy regulations.
A new study from researchers in the UK and Italy found that popular AI-powered browsers collect and share sensitive personal data, often in ways that may breach privacy laws.
The team tested ten well-known AI assistants, including ChatGPT, Microsoft’s Copilot, Merlin AI, Sider, and TinaMind, using public websites and private portals like health and banking services.
All but Perplexity AI showed evidence of gathering private details, from medical records to social security numbers, and transmitting them to external servers.
The investigation revealed that some tools continued tracking user activity even during private browsing, sending full web page content, including confidential information, to their systems.
Sometimes, prompts and identifying details, like IP addresses, were shared with analytics platforms, enabling potential cross-site tracking and targeted advertising.
Researchers also found that some assistants profiled users by age, gender, income, and interests, tailoring their responses across multiple sessions.
According to the report, such practices likely violate American health privacy laws and the European Union’s General Data Protection Regulation.
Privacy policies for some AI browsers admit to collecting names, contact information, payment data, and more, and sometimes storing information outside the EU.
The study warns that users cannot be sure how their browsing data is handled once gathered, raising concerns about transparency and accountability in AI-enhanced browsing.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
