30% of popular AI chatbots share data with third parties

AI chatbots are everywhere these days, but have you ever wondered what information they might be gathering about you? To provide clarity, we analyzed the data collection practices of the top 10 AI chatbots available on the Apple Store, from Google Gemini to DeepSeek, ChatGPT, and more. Let’s keep our data in check!

Key insights

• All analyzed AI chatbot apps collect some form of user data. The average number of collected types of data is 11 out of a possible 35 for the analyzed apps. 40% of the apps collect users' locations. Additionally, 30% of these apps track user data. Tracking refers to linking user or device data collected from the app with third-party data for targeted advertising or advertising measurement purposes or sharing it with a data broker¹.
• Google Gemini collects the most information, gathering 22 out of 35 possible data types. This includes precise location data, which only Gemini, Copilot, and Perplexity collect. Gemini also collects a significant amount of data across various other categories, such as contact info (name, email address, phone number, etc.), user content, contacts (such as a list of contacts in the user’s phone), search history, browsing history, and several other types of data. This extensive data collection may be seen as excessive and intrusive by those concerned about data privacy and security.
• ChatGPT collects 10 types of data, such as contact information, user content, identifiers, usage data, and diagnostics, while avoiding tracking data or using third-party advertising within the app. While ChatGPT collects chat history, it is possible to use temporary chats, which auto-delete all data after 30 days, or to request the removal of personal data from training sets⁴. Overall, ChatGPT collects slightly fewer types of data than some other analyzed apps, but users should still review the privacy policy to understand how this data is used and protected.
• Copilot, Poe, and Jasper are the three apps that collect data used to track you. This data could be sold to data brokers or used to display targeted advertisements in your app¹. While Copilot and Poe only collect device IDs, Jasper collects device IDs, product interaction data, advertising data, and other usage data, which refers to “any other data about user activity in the app”.¹
• DeepSeek's data collection practices stand comfortably in the middle ground among other AI chatbot apps. DeepSeek collects 11 unique types of data, such as user input, including chat history, and claims to retain information for as long as necessary, storing it on servers located in the People's Republic of China³.
• Don't let your guard down, as chats stored on servers are always at risk of being breached. According to The Hacker News², DeepSeek has already experienced a breach where more than 1 million records of chat history, API keys, and other information were leaked. It is generally a good idea to be mindful of the information provided.

Methodology and sources

We identified the 10 most popular AI chatbots⁵,⁶ and analyzed their privacy details on the Apple App Store. The comparison was based on how many types of data each app collects, whether it collects any data linked to you, and whether the app includes third-party advertisers. We also checked the privacy policies of DeepSeek³ and ChatGPT⁴ to better understand what kind of data is kept on servers and for how long.

Data was collected from:

References: