Quick answer: Your data is collected every time you browse, buy, scroll or speak to a smart device: through cookies, tracking pixels, device fingerprints, app permissions, location signals and the data brokers who combine them. AI adds two new layers. What you type into AI tools may be stored and, depending on the provider and your settings, used to improve models, and AI makes it far easier to analyze, profile and impersonate people. You cannot stop all tracking, but you can reduce it significantly with a few settings and habits.
How your data is tracked: before and after AI
| Area | Before AI | With AI |
|---|---|---|
| Web browsing | Cookies and pixels record visits and clicks | Behavior is modeled to predict interests and intent |
| Devices and apps | Advertising IDs, location and app usage are shared with partners | Patterns across apps are combined into detailed profiles |
| Data brokers | Public records and purchases are compiled and sold | Profiles are enriched and matched more accurately |
| What you type | Search queries are logged | Prompts and uploaded files in AI tools may be stored and reviewed |
| Your voice and face | Photos and recordings are stored by services | Short samples can be used to clone voices and create deepfakes |
The shift is not only more data, but better analysis. AI can connect small, harmless-looking signals into a clear picture of who you are, where you go and what you are likely to do next.
The main ways your data is recorded
- Cookies and tracking pixels: small files and invisible images that record visits, clicks and purchases across websites.
- Device fingerprinting: identifying your browser by its settings and hardware, even without cookies; see our guide to browser fingerprinting techniques.
- Mobile advertising IDs and app permissions: apps can share location, contacts and usage with advertising networks.
- Location data: collected by apps and sometimes sold, revealing home, work and routines.
- Data brokers: companies that buy, combine and sell personal profiles.
- Smart devices and cameras: voice assistants, TVs and cameras that record usage; see ultrasound tracking beacons for an unusual example.
- Breaches: data stolen from companies ends up on criminal markets; see dark web intelligence.
AI tools and your data
When you use an AI assistant, your prompts, files and feedback are processed by the provider. Depending on the product and your settings, they may be retained, reviewed by staff for safety or used to train future models. Business and enterprise plans usually offer stronger controls than free consumer versions. Before using any AI tool for work, check its data retention and training settings, and never paste passwords, customer data or confidential documents into a tool your organization has not approved.
New AI-powered threats
- Convincing phishing written without the spelling mistakes people used to rely on.
- Voice cloning used in fake calls from “family” or “the CEO”; see deepfake voice phishing.
- Deepfake video calls, such as the case where an employee was tricked into transferring $25 million; see our report on the deepfake CFO scam.
- Automated profiling that combines leaked and public data to target people precisely.
Your rights
Privacy laws give many people rights over their data. In the EU and UK, the GDPR lets you access, correct and delete personal data and object to certain processing. In California, the CCPA gives similar rights, including opting out of the sale of personal information. CISA’s Secure Our World program explains simple steps to stay safe online, and the UK Information Commissioner’s Office explains your rights under UK data protection law.
How to reduce tracking: a practical checklist
- Review app permissions and turn off location, microphone and contacts access where not needed.
- Reset or limit your mobile advertising ID in phone settings.
- Use a privacy-focused browser or tracker-blocking extensions, and reject non-essential cookies.
- Check AI tool settings and opt out of training where available; never share sensitive data.
- Request removal from data broker sites, and use legal rights such as deletion requests.
- Secure your accounts with a password manager and passkeys; see FIDO2 vs WebAuthn.
- Agree a family or team code word to verify unusual calls and requests.
What businesses and schools should do
- Set a written policy on which AI tools are approved and which data may be used with them.
- Collect only the personal data you need and delete it when no longer required; see SaaS privacy and data protection best practices.
- Train staff and students to recognize AI-powered scams.
- Check your overall protection with our free Cybersecurity Readiness Assessment and the guide Is Your Business Cybersecurity-Proof?
Frequently asked questions
How is my data tracked online?
Mainly through cookies, tracking pixels, device fingerprinting, app permissions, location data and data brokers that combine information from many sources.
Do AI chatbots store what I type?
Often, yes. Depending on the provider and your settings, prompts may be retained, reviewed or used for training. Check each tool’s data settings and avoid sharing sensitive information.
Can I stop companies from selling my data?
In many places, yes. Laws such as the GDPR and CCPA give rights to object to processing or opt out of sale, and many data brokers offer removal requests.
Is it possible to be completely untrackable?
Not realistically. The goal is to reduce unnecessary collection and protect the accounts and data that matter most.
Conclusion
Data collection was already extensive before AI. AI makes that data easier to analyze and easier to abuse. Limit what you share, check the settings of the apps and AI tools you use, exercise your privacy rights and verify any unusual request. Those habits protect people, families, schools and businesses alike.
