![\"\"](\"https:\/\/static.euronews.com\/website\/images\/logos\/logo-euronews-stacked-outlined-72x72-grey-9.svg\"){kind=logo}
\n ADVERTISEMENT<\/p>\n
\n ADVERTISEMENT<\/p>\n
Artificial intelligence (AI) web browser assistants track and share sensitive user data, including medical records and social security numbers, a new study has found.<\/p>\n
Researchers from the United Kingdom and Italy tested 10 of the most popular AI-powered browsers \u2013including OpenAI\u2019s ChatGPT, Microsoft\u2019s Copilot, and Merlin AI, an extension for Google\u2019s Chrome browser \u2013 with public-facing tasks like online shopping, as well as on private websites such as a university health portal.\u00a0<\/p>\n
They found evidence that all of the assistants, excluding Perplexity AI, showed signs that they collect this data and use it to profile users or personalise their AI services, potentially in violation of data privacy rules.<\/p>\n
\u201cThese AI browser assistants operate with unprecedented access to users\u2019 online behaviour in areas of their online life that should remain private,\u201d Anna Maria Mandalari, the study\u2019s senior author and an assistant professor at University College London, said in a news release.<\/p>\n
\u201cWhile they offer convenience, our findings show they often do so at the cost of user privacy \u2026 and sometimes in breach of privacy legislation or the company\u2019s own terms of service\u201d.\u00a0<\/p>\n
\u2018There\u2019s no way of knowing what\u2019s happening with your browser data\u2019<\/p>\n
AI browsers are tools to \u201cenhance\u201d searching on the web with features like summaries and search assistance, the report said.\u00a0<\/p>\n
For the study, researchers accessed private portals and then asked the AI assistants questions such as \u201cwhat was the purpose of the current medical visit?\u201d to see if the browser retained any data about that activity.\u00a0<\/p>\n
During the public and private tasks, researchers decrypted traffic between the AI browsers, their servers, and other online trackers to see where the information was going in real time.\u00a0<\/p>\n
Some of the tools, like Merlin and Sider\u2019s AI assistant, did not stop recording activity when users went into private spaces.\u00a0<\/p>\n
That meant that several assistants \u201ctransmitted full webpage content,\u201d for example any content visible on the screen to their servers. In Merlin\u2019s case, it also captured users\u2019 online banking details, academic and health records, and a social security number entered on a US tax website.<\/p>\n
Other extensions, such as Sider and TinaMind, shared the prompts that users entered and any identifying information, including a computer\u2019s internet protocol (IP) address, with Google Analytics. This enabled \u201cpotential cross-site tracking and ad targeting,\u201d the study found.<\/p>\n
On the Google, Copilot, Monica, and Sider browsers, the ChatGPT assistant made assumptions about the age, gender, income, and interest of the user they interacted with. It used that information to personalise responses across several browsing sessions.<\/p>\n
In Copilot\u2019s case, it stored the complete chat history into the background of the browser, which indicated to researchers that \u201cthese histories persist across browsing sessions\u201d.<\/p>\n
Mandalari said the results show that \u201cthere\u2019s no way of knowing what\u2019s happening with your browsing data once it has been gathered\u201d.\u00a0<\/p>\n
Browsers likely breach EU data protection rules, study says<\/p>\n
The study was conducted in the United States, and alleged that the AI assistants broke American privacy laws that deal with health information.<\/p>\n
The researchers said the browsers likely also breach European Union rules such as the General Data Protection Regulation (GDPR), which governs how personal data is used or shared.<\/p>\n
The findings may come as a surprise to people who use AI-supported internet browsers \u2013 even if they are familiar with the fine print.<\/p>\n
In Merlin\u2019s privacy policy<\/a> for the EU and UK, it says it collects data such as names, contact information, account credentials, transaction history, and payment information. Personal data is also collected from the prompts that users put into the system or any surveys that the platform sends out.\u00a0<\/p>\n That data is used to personalise the experience of people using the AI browser, send notifications, and provide user support, the company continued. It can also be used when responding to legal requests.\u00a0<\/p>\n