AI Chatbots: Which Ones Collect the Most Data?

Many people are now using AI to find answers, create content, and gather information. But using AI comes at the cost of your user data. A new report from Surfshark, a VPN and security service, looks at what data different AI platforms collect and which ones collect the most. The report analyzed the privacy details of 10 popular AI chatbots—ChatGPT, Claude AI, DeepSeek, Google Gemini, Grok, Jasper, Meta AI, Microsoft Copilot, Perplexity, Pi, and Poe.

Surfshark's analysis checked the privacy details for each app on Apple's App Store and the privacy policies for DeepSeek and ChatGPT. The analysis sought to determine how many types of data each app collects, whether it gathers data linked to you, and whether the app uses third-party advertising.

Data Collection by AI Chatbots

Surfshark looked at 35 different data types, including contact info, health and fitness, financial info, location, sensitive info, contacts, user content, history, identifiers, diagnostics, usage data, and purchases. Sensitive info includes things like racial or ethnic data, sexual orientation, pregnancy or childbirth information, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, or biometric data.

All 10 AI apps collect some type of user data. The average number of data types amassed was 13 out of 35. Some 45% of the apps gather your location, and almost 30% track user data, meaning the information collected is linked with third-party data to deliver targeted ads or share with a data broker.

Worst Offenders in Data Collection

Meta AI collects the most user data, scooping up 32 out of the 35 possible types, or 90% of them. Meta AI was the only AI app that grabbed data across categories such as financial information, health and fitness, and sensitive information. Further, only Meta and Copilot grabbed data linked to the user's identity to display third-party ads. Meta AI can gather as many as 24 different data types for this purpose.

Google Gemini collects 22 different data types, including your precise location, contact info (name, email address, phone number, etc.), user content, contacts (a list of contacts on your phone), search history, and browsing history. Poe collects 14 different types of data, Claude 13, and Copilot 12. Poe and Copilot gather data used to track you and can sell your data to brokers or use it to display targeted ads in the app.

DeepSeek collects 11 types of data, including your chat history. The data collected by DeepSeek is sent to China Mobile. DeepSeek claims to save information on servers located in the People's Republic of China. DeepSeek has experienced a breach where more than 1 million records of chat history, API keys, and other information were leaked.

ChatGPT gathers 10 types of data, such as contact information, user content, identifiers, usage data, and diagnostics. OpenAI's AI doesn't track your data or use third-party ads. Privacy-minded users can use temporary chats where all data is automatically deleted after 30 days and can request that your personal data not be used for training purposes.

Grok gathers seven types of data, while Pi and Jasper each scoop up five different types. Jasper collects device IDs, product interaction data, advertising data, and other usage data to send you targeted ads or share data with a broker.

Protecting Your Data

Collecting user data is common among AI bots, mobile apps, social media sites, search engines, and software. Often, that's the price for free or inexpensive products that rely on advertising. ChatGPT and other AI apps and services provide ways to prevent or limit the collection of your data. Investigate the privacy policies and settings for any AI you use to take charge of your own data.