AI Browser Assistants Collect and Share Sensitive User Data Without Adequate Protection
A study by researchers from University College London and the University of Reggio Calabria found that AI browser assistants including ChatGPT, Copilot and Merlin AI collected and transmitted sensitive user data such as banking information, medical records and social security numbers to their servers without adequate protection. Some assistants continued recording user activity in private spaces and violated US data protection laws.
What happened
Researchers from University College London and the University of Reggio Calabria analysed ten AI browser assistants, including ChatGPT, Copilot, Merlin AI, Sider, TinaMind and Monica, by simulating real-world browsing scenarios and tracking data transmission.
The study found that all assistants except Perplexity AI collected and shared sensitive user data including banking information, medical records, social security numbers and academic records, transmitted in full to their servers.
Several assistants, particularly Merlin and Sider, continued recording user activity when accessing private spaces such as university health portals, dating services and adult content, where users would not expect tracking to occur.
Reported impact
The study concluded that these AI assistants inferred user attributes such as age, sex, income and interests to personalise responses across different browsing sessions, and operated with unprecedented access to users' online behaviour in areas of life that should remain private.
Researchers noted there is no way to know what happens to collected browsing data after transmission, and the collection and sharing practices violated United States data protection legislation regarding health and educational information.
Index analysis
The study demonstrates that despite offering convenience, AI browser assistants extract privacy at a significant cost through data collection practices that sometimes breach legislation or the companies' own terms of service.
Researcher Anna Maria Mandalari stated that the collection and sharing of data is non-trivial, as mass cyberattacks make such stored personal data vulnerable once removed from user devices.
Governance controls
The study's authors call for urgent regulatory oversight of AI assistants to protect personal data and recommend developers adopt privacy-by-design principles including explicit user consent for data collection.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.