An employee asks an AI assistant to improve a customer complaint. The customer’s name, the problem and the proposed compensation are all in the text. Before making this a routine task, management needs to know who receives that information beyond the AI provider itself.
A new study gives Norwegian companies a concrete reason to ask. Researchers found that tracking and analytics services received conversation titles or full prompts from some AI chat websites they tested. This was not a test of every product, plan or current configuration. It was a demonstration that a website’s ordinary measurement tools can carry information far beyond the intended conversation.
The decision is not whether to prohibit useful AI. It is which work can use an approved service, what information staff should remove, and what evidence the supplier can provide about other recipients.
What the researchers measured
In a paper published on 27 October 2026, researchers examined 42 chatbot websites: 25 general-purpose services and 17 tools for health, legal or educational questions. During controlled sessions between 6 and 20 May, they used test accounts and their own prompts, recorded network traffic and traced which website scripts accessed information.
They observed conversation titles being sent to third-party tracking services on 21 of the 42 sites, and complete prompts on nine. These results describe the selected sites and test conditions, not the share of Norwegian companies affected or the likelihood that an employee’s actual conversation was disclosed. The study did not use real customer conversations.
A title is not the same as a full transcript. It can nevertheless reveal the subject of a conversation. A title about a planned redundancy, for example, may expose information even when the underlying chat stays private. The researchers also observed email addresses reaching trackers in some cases, making it possible to associate the topic with an identified user.
Configuration matters. The researchers say two services removed trackers that had collected conversational context before the paper was submitted, and another changed a tracker configuration after notification. That is a reason to check current evidence, not to assume that the earlier observation describes a service today. The paper examines web interfaces under its own conditions; it does not establish what happens in every enterprise contract, geographic region, mobile app or API integration.
A training promise answers a different question
A supplier may promise not to use customer content to train its models. That is useful information, but it does not by itself explain whether the website sends a conversation title, a prompt, an email address or a URL to analytics and support providers. Nor does a list of third-party domains alone establish that sensitive content was sent.
A separate research investigation examined four AI services and reported flows involving conversation links, titles and identifiers. Its observations and concerns differ by service and configuration. The researchers also state that they had no evidence that trackers actually read conversations through the links they observed. Together, the studies support checking actual data flows, not assuming that every third party saw complete private chats.
Use a harmless test before choosing the work
Imagine a small Norwegian professional-services firm that wants an assistant to draft answers to customer enquiries. This example is hypothetical. The firm can begin with general writing help using invented customer details while it checks the business account and contract. Staff retain a faster way to draft, while management postpones submitting actual complaints until it has enough evidence.
Ask the supplier to demonstrate the exact web interface, account type, region and settings employees will use. With its agreement, an IT provider can use an approved test account and harmless invented phrases. Test a new chat, a follow-up message, a title change and a return to an existing conversation. Check the information sent to other domains and the purposes of those recipients. Record the date and configuration; a test of one browser session will not reveal every server-side transfer or future change.
Do not paste real customer records or a secret into a test. If the supplier cannot explain the relevant flows or provide a suitable demonstration, use a less sensitive workflow while the question remains open. A delayed decision also has a cost: employees may continue using unapproved accounts or miss useful assistance. Give them a clear approved alternative and revisit the decision with the supplier.
Ask four questions before expanding
Management can ask the owner of the proposed service and the supplier for one written answer to each question:
- Which categories of content, titles, links and identifiers leave the chat interface, and who receives them for analytics, advertising or support?
- Which controls apply to the specific business plan, including optional tracking and account settings, and what evidence supports the answer?
- Where applicable, what do the contract, processing terms and subprocessor information say about purpose, retention, deletion and transfers?
- Who checks changes and responds if information reaches an unintended recipient?
A supplier’s answer, a contract and a controlled test each contribute different evidence. None alone proves that every relevant data flow has been found. When personal data is involved, the company must assess its own role and applicable obligations. Datatilsynet explains why the purpose of processing and a supplier’s own use matter in its review of educational services. That report concerns schools and municipalities; it does not settle whether a particular business or service complies.
Employees also need a short, usable rule: which approved tool to use, what information must stay out until reviewed and whom to contact with a doubtful case. Removing a name is not always enough if the remaining details identify the customer or transaction.
The board should ask whether management knows which sensitive workflows use external AI, whether material supplier questions remain open and when they will be resolved. It should not inspect individual prompts. The guide to access in AI search addresses a different boundary: what employees are allowed to retrieve from the company’s own files. Both the inward access and the outward flow need attention.
Sources checked on 5 November 2026. The company and customer scenario are hypothetical. The studies describe their measured configurations, not all current AI products. The illustration is AI-generated.