Your ChatGPT Queries Were Sent to Meta and Google. Every Single One.

Lines of code displayed on a computer monitor in a dark room

TL;DR:

The tracking: OpenAI embedded Meta’s Facebook Pixel and Google Analytics in ChatGPT.com. Every time you typed a query, it became your browser tab’s title, and the Pixel grabbed that title, your Facebook user ID, and a timestamp, then fired it to Meta’s servers in a silent HTTP request. ^[1][2]
Google got your email: Google Analytics intercepted a hashed version of your login email plus your Google profile ID via the Secure-3PSID cookie. The FTC calls hashing “vastly overrated as an anonymization technique.” ^[1][3]
The lawsuit: Couture v. OpenAI (Case No. 3:26-cv-03000-H-GC, S.D. Cal.), filed May 13, 2026, alleges violations of the federal Electronic Communications Privacy Act ($10,000 per violation) and the California Invasion of Privacy Act ($5,000 per violation). ^[1][2]
It’s not just OpenAI: An identical suit hit Perplexity AI in April. The complaint says Perplexity’s “Incognito” mode, explicitly marketed as preventing data sharing, didn’t stop the pixel from firing. ^[2]
Protect yourself now: Install uBlock Origin. Sign out of Facebook and Google before using AI chatbots. Use a separate browser profile for sensitive queries.

How a Chatbot Becomes an Ad Pipeline

Here’s what happens when you type “symptoms of depression” into ChatGPT.

ChatGPT turns your query into the browser tab title. You’ve probably noticed it: the tab says something like “Symptoms of Depression” instead of “ChatGPT.” That seems like a convenience feature. It’s also a surveillance mechanism. ^[1]

The Facebook Pixel (a snippet of JavaScript embedded in ChatGPT.com’s pages) reads that tab title and fires a GET request to Meta’s servers. The request includes a data field called pmd[title] containing whatever you asked about, alongside three cookies that identify you:

c_user: Your Facebook user ID. In cleartext. Anyone with this number can navigate directly to your Facebook profile. ^[1]
fr: An encrypted session token Meta uses for ad targeting and cross-site tracking. ^[1][2]
_fbp: A persistent first-party cookie set by ChatGPT.com itself, following you across every site running the Pixel. ^[1][2]

All three cookies last 90 days. Every query. Every session. Firing silently in real time while you ask a chatbot about your health, your finances, your relationships.

Google Got Your Email Too

The Facebook Pixel is the flashy part. Google Analytics did quieter damage.

According to the complaint, when you log into ChatGPT, Google Analytics intercepts a hashed version of your email address, tagged with the “em” identifier, alongside your session ID and conversation title. A cookie called Secure-3PSID transmits your Google profile ID. ^[1]

OpenAI could argue the email is “hashed” and therefore anonymized. The FTC disagrees. In its enforcement guidance, the Commission has called hashing “vastly overrated as an anonymization technique” because the recipient, in this case Google, already has the original email in its advertising database and can trivially match the hash. ^[1]

It gets worse. With Google Signals enabled, Google Analytics builds cross-device profiles using your User-ID (up to 256 characters), your email, phone, and name, your device IDs from the _ga cookie, and behavioral modeling via machine learning. Your ChatGPT queries don’t stay in a silo. They feed an advertising profile that follows you across every device you own. ^[1]

Perplexity’s “Incognito Mode” Didn’t Help

This isn’t an OpenAI-only problem. In April 2026, an identical class action hit Perplexity AI for the same Facebook Pixel embedding. ^[2]

The kicker: Perplexity offers an “Incognito” mode that explicitly promises to prevent data sharing. The complaint alleges the Pixel fired anyway. The feature you thought was protecting you was decorative. ^[2]

Two of the most prominent AI companies, both running hidden ad-tech pipelines in their chat interfaces. The pattern suggests this isn’t accidental: it’s an industry practice.

$10,000 Per Violation, Millions of Users

Plaintiff Amargo Couture, a California resident who used ChatGPT throughout 2025 and 2026 for health, financial, and personal queries, filed the suit on behalf of all U.S. residents who accessed ChatGPT.com. ^[1][3]

The complaint asserts four counts:

Federal ECPA violation (18 U.S.C. § 2511): intentional interception of electronic communications. Statutory damages: $10,000 or $100 per day per violation. ^[1]
CIPA § 631(a): reading message contents without all-party consent. ^[1]
CIPA § 632: recording confidential communications without consent. ^[1]
California constitutional privacy: intrusion upon seclusion. ^[1]

Under CIPA § 637.2, each violation carries $5,000 in damages or triple actual damages, whichever is greater. The class covers millions of ChatGPT users. Aggregate claims exceed $5 million, and that’s the floor. ^[1]

OpenAI has not publicly responded to the lawsuit as of May 24, 2026.

How to Check If You’re Being Tracked Right Now

You don’t have to take the lawsuit’s word for it. You can see tracking pixels on any website yourself:

Install the Meta Pixel Helper Chrome extension (made by Meta, ironically). Visit any site and the extension shows which pixels are firing, what data they’re sending, and to whom.
Open your browser’s DevTools (F12 → Network tab). Filter requests by “facebook.com” or “google-analytics.com.” Watch the requests fire as you type.
Check the cookies. In DevTools → Application → Cookies, look for c_user, fr, _fbp, and Secure-3PSID. If they’re there, your identity is attached to your browsing.

What to Do About It

Install uBlock Origin. It blocks the Facebook Pixel before it loads. The tracking request never leaves your browser. This alone stops the core mechanism described in the lawsuit. uBlock Origin is free and open-source, available for Firefox, Chrome, and Edge.
Use Firefox with Enhanced Tracking Protection set to Strict. Firefox blocks third-party tracking cookies by default, and Strict mode catches most analytics scripts too.
Sign out of Facebook and Google before using AI tools. No c_user cookie means no Facebook ID to transmit. No Google login means no email hash to intercept. Simple but effective.
Use separate browser profiles. One profile for social media, one for AI tools, one for sensitive searches. Containers prevent cookies from crossing over.
Use the API or desktop app instead of the web interface. The complaint targets ChatGPT.com, the web interface. The API and native apps may not embed the same tracking code. (Though nobody has audited those either.)
Consider the ChatGPT app. Native mobile and desktop apps don’t render web pages the same way, so browser-based tracking pixels don’t apply. But app-level telemetry is a separate question entirely.

The AI Privacy Illusion

There’s a reason this story hits harder than a typical tracking-pixel scandal. People share things with AI chatbots that they wouldn’t type into a Google search. Medical symptoms. Relationship problems. Financial anxieties. The conversational interface creates a false sense of privacy: you feel like you’re talking to someone, not typing into a browser window running ad-tech JavaScript.

That’s the gap the lawsuit targets. Not just that OpenAI tracked users, but that it tracked users who believed they were having private conversations. People who asked ChatGPT about STI symptoms or divorce lawyers or addiction treatment: all of it captured as a browser tab title and fired to Meta’s servers alongside their Facebook profile ID.

OpenAI’s privacy policy mentions analytics. It doesn’t say “we send your conversation topics to Facebook alongside your real identity.” There’s a canyon between “we use analytics” and “Meta knows what you asked your AI therapist about.”

What Happens Next

OpenAI’s response is expected by mid-June. If the company follows the typical playbook, expect a statement about how analytics tools are “industry standard” and “don’t compromise user privacy.” That argument might work for a news site. It’s a harder sell for a platform where people share their most private thoughts.

The Perplexity case will move in parallel. If discovery in either case forces the companies to disclose exactly what data was transmitted, when, and to whom, the technical evidence could reshape how every AI company handles web-based analytics.

In the meantime: install uBlock Origin. Sign out of Facebook before you chat with your AI. And maybe stop treating browser-based AI tools like they’re private.

They never were.

Previously: Your AI Chatbot Was Selling You Out