Researchers in Madrid examined which information nine widely used AI services send to external providers. Every one of them transmits data to third parties. For several offerings, links to complete conversations reach advertising and analytics services in the browser. Rejecting cookies does not prevent most of this.
For companies, the question therefore shifts. The website through which a model is used also determines how well business information is protected. A private account in the browser has different data paths than a company account with a contract or an integration via the interface.
We recommend a sober inventory: which services are actually in use, which content never belongs there and which access is officially provided for the most important tasks.