Recent research from UCL and Mediterranea University reveals that popular AI web browser assistants, including ChatGPT, Copilot, Monica, and Sider, collect and share extensive sensitive user data without sufficient safeguards.

The study involved simulating real-world browsing scenarios with a fictitious profile of a wealthy Generation Y individual from California, engaging in typical activities like reading news, shopping, and watching videos.

Researchers found that assistants like Merlin capture information from forms, while others infer personal attributes such as age and interests to personalize responses.

AI assistants like Copilot store complete chat histories, indicating that user data persists across browsing sessions.

Extensions such as Sider and TinaMind share user questions and identifiable information, including IP addresses, with analytics platforms like Google Analytics, enabling cross-site tracking and targeted advertising.

Some extensions also share user prompts and data with third-party platforms, raising privacy concerns.

These findings highlight significant issues regarding transparency and accountability in how user browsing data is managed by AI assistants.

The study underscores the urgent need for future regulation and increased transparency as generative AI becomes more embedded in daily digital interactions.

Many assistants rely on server-side APIs that can be auto-invoked without explicit user consent, leading to unintended data collection even in private browsing modes.

Alarmingly, some AI assistants continued retrieving data even after users closed their search pages, raising serious privacy concerns.

Certain AI browser privacy policies acknowledge collecting personal details like names, contact info, and payment data, with some storing information outside the EU.