Study reveals AI browsers share sensitive personal data

A new study from researchers in the UK and Italy has found that popular artificial intelligence (AI) browsing assistants can capture and share sensitive personal data from private websites, potentially violating the EU and UK General Data Protection Regulation (GDPR). The study tested ten widely used AI assistants, including OpenAI's ChatGPT and Microsoft's Copilot, on both public and private portals, such as a university health website.

All but one of the assistants, Perplexity AI, showed evidence of collecting this data, which could then be used for user profiling or personalising AI services. In some cases, the tools were found to transmit full webpage content to their servers, with Merlin AI specifically capturing online banking details, academic and health records, and tax numbers.

The study, which decrypted real-time traffic to see where information was going, also found that some assistants shared user prompts and identifying details like IP addresses with Google Analytics, enabling potential cross-site tracking. One of the study's authors, Anna Maria Mandalari, said that while these assistants offer convenience, they do so at the cost of privacy, and warned that users have no way of knowing what happens to their data once it has been gathered.

Training Announcement: Freevacy offers a range of independently recognised professional AI governance qualifications and AI Literacy short courses that enable specialist teams to implement robust oversight, benchmark AI governance maturity, and establish a responsible-by-design approach across the entire AI lifecycle. Find out more.