AI privacy risks exposed as companies harvest user data for training

Artificial intelligence (AI) is increasingly collecting and utilizing personal data, often without transparent consent, raising significant privacy and security concerns. A recent study by researchers at University College London and the Mediterranea University of Reggio Calabria, presented at the USENIX security symposium, revealed that AI web browser assistants engage in widespread tracking, profiling, and personalization. These assistants shared sensitive data like banking and health information, as well as IP addresses, with their servers.

Key Findings:

• Data Collection: AI assistants guess user attributes (age, sex, salary, interests) and use this to personalize responses.
• Lack of Transparency: Only Perplexity showed no evidence of profiling; others operated without clear consent or violated privacy laws.
• Risks: Hervé Lambert of Panda Security warns of commercial manipulation, exclusion, extortion, and identity theft.

Company Practices:

• Google updated its privacy terms to use Gemini AI interactions for training, offering an opt-out via temporary chat. Users must disable activity tracking to prevent data sharing.
• WhatsApp claims personal messages are off-limits but admits Meta AI uses interactions to improve models, urging users to avoid sharing sensitive info.
• WeTransfer faced backlash for unclear terms but clarified it does not train AI or sell user content.

Regulatory and Ethical Concerns:

• Marc Rivero (Kaspersky) highlights risks of AI accessing WhatsApp data, potentially enabling cybercrime.
• Eusebio Nieva (Check Point Software) advocates for EU-style regulations to ensure transparency and security.
• Meta and startup Sakana AI are exploring self-improving AI to reduce reliance on personal data, though this raises fears of AI misuse (e.g., hacking, weapon design).

Call to Action:

• Lambert stresses the need for privacy-by-design in AI development.
• () urges integrating from the outset.