What AI Websites Know About You Before You Type a Prompt

You open ChatGPT, or Gemini, or whatever you use. The prompt box is empty. You haven’t typed a thing.

So the service knows nothing about you yet, right?

Not quite. By the time that page finished loading, your browser had already introduced itself. That doesn’t tell you what the AI company keeps, or what it does with your chats. But it does mean the privacy conversation starts a step earlier than most people assume, before you’ve written a single word.

Tools like ipdrop.io can make that early step visible. It’s a browser-checking toolkit: it shows what’s observable from your connection, and it has utilities for things like cleaning up links or photos before you share them. Worth being clear about what it isn’t, though. It’s not an audit of any AI platform. It’s not a VPN. And it can’t prove you’re anonymous.

Your browser’s opening handshake

A website needs a bit of information just to send you a page. Usually that means:

Any one of these is pretty boring. Put them together, though, and you get something closer to a fingerprint. That’s how plenty of sites recognize a returning visitor without anyone logging in.

AI services work the same way. OpenAI’s privacy policy spells it out. It collects the log data your browser or device sends automatically: your IP address, browser type and settings, and when you made each request. It also collects device details, like your operating system and device identifiers, and works out your rough location from your IP. Nothing unusual for a big web service. Still, it’s worth knowing before you assume an empty prompt box means a clean slate.

Showing up versus joining in

Here’s a distinction that makes the rest of this much easier to think about.

There’s what happens when you arrive: the connection and browser data that reach any site you visit. Then there’s everything you add on purpose. Logging in. Typing prompts. Uploading files. Hitting thumbs up or thumbs down.

Two different kinds of data, so two different kinds of evidence. “What can this site see from my browser?” is a much smaller question than “What does this AI company do with everything I give it?” You want answers to both. Just don’t let one stand in for the other.

A browser test can’t see inside the company

A diagnostic tool can tell you what it observes in its own little test. That’s it. It has no idea how an AI company stores your prompts, who inside the company can read them, or whether your privacy settings actually get honored.

For that, check the provider’s current documentation for the exact product, account type and mode you use. Removing a conversation from your visible history is not, by itself, independent evidence that every stored copy has been erased. Check how the service distinguishes deletion, retention and model-training controls rather than treating them as one setting.

Read any stated security, legal or de-identification exceptions alongside the normal retention period. Do not turn a published retention target into an unconditional guarantee, or apply a business product’s policy to a personal account. A browser diagnostic cannot inspect the provider’s internal deletion process, so record that question separately from what the connection test actually observes.

It cuts the other way too. A comforting retention policy says nothing at all about what your browser connection is exposing. You need both pieces.

Test with junk, not your real stuff

Trying out a new AI tool, or checking how a privacy setting behaves? You don’t need a real client file or a family photo for that. Use made-up text and harmless images that fit whatever feature you’re testing. And please don’t paste in real passwords, reset links or private records just to make the test feel realistic.

If you’re comparing a setting before and after a change, keep everything else identical: same browser profile, same network, one change at a time. Note down what you tested and how. A screenshot with no context proves surprisingly little. And if a check can’t show you something? Log it as “unknown.” Not “safe.”

Files carry more than you can see

Photos and documents often hold extra information that never appears on screen.

A photo straight off your phone can include EXIF metadata: the GPS coordinates where you took it, your phone model, the exact time. Documents can carry author names, revision history, comments and hidden text that a quick preview won’t show. Blacking out visible text is one job. Checking the file itself is another.

With photos, keep the original private and work on a separate copy for sharing. Run your cleanup tool, then actually inspect the file it spits out. A “done!” message isn’t proof the metadata’s gone.

Also: the picture itself still counts. A face, a street sign, an address label on a parcel, a monitor glowing in the background. Any of those can identify you or someone else, however spotless the metadata. So ask whether a photo should be uploaded at all before you treat a cleanup tool as a green light. That question gets more pressing as AI makes it easier to build convincing digital likenesses from everyday images.

Before you hit enter on anything sensitive

Start with your connection. Check what it shows: your IP, location, and any WebRTC leak, especially if you’re counting on a VPN to cover you.

Then dig into the service’s settings. If you don’t want your chats used for training, switch that off, and lean on temporary or private modes where they exist.

Strip metadata from files, and then check it’s really gone. Leave out passwords, client data and personal records unless you genuinely have no choice.

And for work? Stick to approved tools. Business and enterprise plans often come with different retention and training terms from personal accounts, and your company may well have a process for signing off AI suppliers.

No tool hands out a privacy badge

No single test earns an AI service a universal “private” stamp. A browser check helps you understand the connection. A file utility helps you prep a cleaner copy to share. Neither one decides whether a particular service is right for sensitive work.

What actually helps is asking a sharper question at each step. What came along with the connection? What got added when you logged in? What did you deliberately hand over? Keep those three apart, and AI privacy gets much easier to reason about, without pretending the risk can be made to vanish. It’s the same layered thinking behind AI-era cybersecurity more broadly.

Quick answers

Can an AI website see my IP address before I type anything?
Yes. Like any site, it gets your IP address and basic browser details as soon as the page loads.

Does a VPN make my AI use anonymous?
Not by itself. For traffic routed through it, a VPN normally makes the destination see a VPN exit address instead of your original public IP. A logged-in account, cookies and browser fingerprinting can still connect activity to you. WebRTC address exposure depends on the browser, its privacy settings and the network route; it is not an inevitable leak.

Does a temporary chat mode prove immediate deletion?
No. Check the provider’s current policy for that exact mode, including its retention period and stated exceptions. A temporary interface is not independent proof of immediate server-side deletion, and a browser test cannot verify that internal process.

Can a photo’s metadata reveal where I live?
It can. Many smartphone photos store GPS coordinates in their EXIF data. Strip it, check the cleaned file, then share.

Can a browser privacy test prove an AI service is safe?
No. It shows what your connection reveals, not how the AI company stores or uses your data.

Related: Is ChatGPT Safe in 2026? Privacy, Security & What Changed