AI founders spend considerable time evaluating model security, data retention policies and whether customer prompts are used for training. Far less attention goes to the advertising pixels and analytics scripts running alongside the product.
That distinction is becoming harder to ignore. In May 2026, a lawsuit accused OpenAI of transmitting ChatGPT users’ queries and identifying information to Meta and Google through tracking technologies. The original complaint was voluntarily dismissed without prejudice, while related litigation continued in California federal court. The allegations have not been proven.
The case raises a question for every SaaS company handling private conversations: does your privacy architecture protect user data beyond the model itself?
The analytics stack is part of your privacy architecture
Tracking pixels are not inherently unlawful. They help companies measure conversions, understand customer behavior and optimize advertising. The legal exposure arises when those tools collect information users reasonably expect to remain within the service.
The Federal Trade Commission has already pursued this issue outside the AI industry. In 2023, BetterHelp agreed to pay $7.8 million to resolve FTC allegations that the online counseling platform disclosed sensitive health information to advertising companies, including Facebook and Snapchat, despite promising users greater privacy. The resulting order also restricted future disclosures and required additional privacy safeguards.
For AI businesses, the implications extend well beyond healthcare. A chatbot may process financial details, employment disputes, proprietary source code or confidential business plans. If analytics integrations transmit identifiable conversation content to third parties, the company’s privacy disclosures and contractual assurances may no longer match its technology.
The relevant distinction is between collecting product metrics and disclosing the substance of a private interaction.
Why US privacy litigation changes the calculation
The 2026 OpenAI litigation invoked the federal Electronic Communications Privacy Act (ECPA) and California Invasion of Privacy Act (CIPA). These laws can become relevant when tracking technology allegedly intercepts communications without legally sufficient consent.
California Penal Code § 637.2 provides statutory damages of $5,000 per violation or three times actual damages, whichever is greater, for qualifying violations. That figure does not apply automatically to every tracking event; liability depends on the facts and the statutory requirements.
For founders, three issues deserve particular attention:
- Actual data transmission. Do tracking tools receive chatbot prompts, responses, account identifiers or only aggregated interaction metrics?
- Consent and disclosure. Do users receive legally sufficient notice, and does the consent mechanism reflect what the software actually does?
- Third-party control. Can analytics vendors retain, combine or reuse information beyond the purposes authorized by the company?
These questions are also commercial. Enterprise customers increasingly scrutinize confidentiality commitments, vendor access and restrictions on secondary data use. A startup may satisfy a procurement questionnaire on paper while its application sends information to recipients that were never considered during contract negotiations.
Privacy liability is not something you can outsource
US tech lawyers increasingly need to assess the relationship between product architecture and contractual promises. A privacy policy may describe limited data collection, but network traffic can reveal a different picture. An attorney reviewing SaaS contracts or technology licensing terms cannot resolve that discrepancy through drafting alone.
The same applies to investment due diligence. A company may have properly assigned its intellectualproperty, secured copyright ownership and documented software development rights, yet still face material exposure from third-party tracking.
For an IT lawyer https://stalirov.lawyer/en, the critical issue is whether the company’s actual data flows support its representations to customers, investors and regulators.
Founders should treat analytics changes affecting sensitive interactions as privacy-relevant product changes. Before deploying a new pixel, session replay tool or conversion event, engineering and legal teams should establish what information it captures, where that information goes and whether its collection is necessary.
The BetterHelp settlement demonstrates that misleading privacy promises can carry substantial consequences. The 2026 AI litigation shows how similar questions are now being raised about conversational products.
A secure AI model does not make an AI product private. The rest of the stack has to earn that claim, too.
Written by Valeriy Stalirov, Founder and CEO at Stalirov&Co, an IT law company
