05/22/2026
Please post:��When you open a chatbot at midnight, worried about a symptom, you are not thinking about network traffic. But your browser is. We captured every HTTP/HTTPS request generated during routine interactions with Claude, ChatGPT, Gemini, and Grok: logging in, starting a chat, sharing a conversation. Between 9% and 36% of those requests went to third-party domains: analytics services, behavioral tracking, in some cases advertising networks. Every platform contacted external analytics during ordinary use. None of this is forbidden. It lives in the terms of service you clicked through.
The gap this study surfaces is not technical. It is a governance failure. These platforms were designed as consumer products, and their data practices follow from that: built for product analytics, not for the weight of what people actually bring to them. Over 40 million people use AI chatbots daily for health questions, many after clinic hours, many in communities where care is hard to reach. They are not patients in any legal sense. That is the problem. HIPAA does not apply because the law was never written for this.
The ask: transparency reports, guidance from medical associations, regulatory frameworks that meet people where they are actually seeking care.
Objective: This study presents an analysis of network traffic across four commercial LLM platforms to document which external domains they contact during routin