The report
A chat transcript is not necessarily confined to the model provider's inference API. Modern chat sites run ordinary web analytics, advertising and session-management scripts, and those scripts can become separate recipients of conversation context. Researchers sampled 42 web-based AI chat services, 25 general-purpose and 17 specialized, from a US East vantage point in May 2026. Study design.
The authors observed contextual data flowing to third-party services and examined identity attributes capable of linking some context to an account or person. These are browser-side network observations, not a claim that the underlying model memorized every message or that a central service was breached. The study cannot establish what each downstream recipient later retained, shared or used. Observed transfers.
The distinction between a page request, an identifier and a complete transcript is consequential. Privacy impact depends on exactly which fields travelled together, whether they reached third-party infrastructure, and whether the site had told users that the data would be processed in that way. A recipient seeing conversation context without a stable identifier is not identical to receiving a message tied to an account. Nor does identifying a tracking endpoint prove misuse of all data passing through it.
A useful audit captures outbound browser requests during realistic prompts, maps parameters and destinations, and repeats the test after privacy settings and authentication changes. These checks test the actual website data path, not only a provider's model-data training policy. The published results remain limited to the surveyed web properties and sampling period. Primary paper.