The Perplexity "Incognito" Lawsuit and Why AI Privacy Claims Are About to Be Tested in Court

A federal class-action complaint filed in San Francisco in early April 2026 alleges that Perplexity AI embedded ad-tracking code that transmitted user conversations to third parties, even when users had toggled the app's incognito mode on. The perplexity incognito lawsuit names all three companies as defendants and proposes a class spanning free-tier users who chatted with the product between December 2022 and February 2026. If you evaluate AI vendors for your team or product, this case is worth reading closely. Not because it proves anything yet. Because it surfaces questions you should already be asking about every conversational AI tool you depend on.

Key Takeaways

• The lawsuit alleges that server-side tracking (conversion APIs, ad pixels) transmitted prompts, responses, IP addresses, and device data to third parties regardless of whether incognito mode was enabled. The mechanism described would bypass any client-side privacy toggle by design.
• None of the defendants have been found liable, no class has been certified, and Perplexity has stated it was unable to verify the complaint's existence at the time of initial reporting. These are unproven allegations.
• Chatbot wiretap lawsuits are the fastest-growing category of deployer-facing AI litigation, growing from 2 matters in 2021 to 30 in 2025, with statutory damages of up to $10,000 per violation under federal wiretap law.
• "Incognito" is a UI label, not a technical standard. Across the industry it typically means reduced local storage, not zero server-side collection. If your vendor can't produce a data-flow diagram, the toggle means nothing.
• For technical buyers, the practical takeaway is to evaluate AI vendors on architecture (what data leaves the client, where it goes, who can read it) rather than on feature names.

What Does the Perplexity Lawsuit Actually Allege?

The 135-page complaint alleges that Perplexity embedded Meta Pixel, Google Ads, Google DoubleClick, and Meta's Conversions API trackers directly in its codebase. According to the complaint, these integrations sent user conversations, including prompts, AI-generated responses, email addresses, IP addresses, and device fingerprints, to Meta and Google for ad targeting purposes.

The proposed class covers free-tier users only. Paid Pro and Max subscribers are explicitly excluded, because their agreements apparently operate under different terms. That's a detail worth sitting with: it implies the legal exposure may be concentrated where the revenue model relies on advertising or data monetization rather than subscription fees.

Perplexity's chief communications officer has stated the company had not been served and was unable to verify the complaint's claims. No confirmation. No denial of the specific tracking practices described. As of this writing, the case is in its earliest procedural stages.

Why Didn't Incognito Mode Prevent the Alleged Tracking?

Because the alleged tracking happened server-side, not in the browser. That is the single most important technical detail in the complaint.

Perplexity's incognito mode promises "anonymous threads" that don't save to history and expire after 24 hours. The lawsuit's claim is that this promise is structurally irrelevant to the data flows in question. When tracking is implemented through a server-side Conversions API, the data transmission happens on the backend before any client-side toggle can intervene. Your browser never sees the call. Your ad blocker never sees it. Your VPN never sees it. The "incognito" toggle controls what gets stored in your local history. It has no architectural relationship to what the server does with your prompt after receiving it.

The complaint also flags a distinction between account holders and non-account users. Using developer tools, the plaintiffs found that opening prompts are always shared, and non-subscribed users' initial prompts were allegedly shared with a URL through which the entire conversation could be accessed by third parties. If accurate, that would mean users with the least contractual relationship to the platform had the weakest data protections.

What Legal Theory Are the Plaintiffs Using?

They are repurposing California's wiretapping statutes. The complaint likens the ad trackers to wiretap-style interception, arguing that embedding tracking code that captures the content of a conversation and transmits it to a third party without user consent meets the statutory definition of an illegal intercept.

This is not novel legal theory. It is the theory that is currently winning procedural battles across the country. An analysis of 284 deployer-facing AI litigation matters found that chatbot wiretap claims grew from 2 matters in 2021 to 30 in 2025, making it the fastest-growing category in the dataset. Courts have been increasingly allowing such claims to survive dismissal against AI chat vendors specifically.

The damages math matters. The Electronic Communications Privacy Act provides statutory damages of $10,000 per violation, compared to $5,000 under California's Invasion of Privacy Act. When you multiply per-violation statutory damages across a proposed class of millions of free-tier users over a multi-year period, the numbers get large fast. That is the incentive structure driving this wave of litigation.

Is This Part of a Broader Pattern?

Yes. The Perplexity case sits inside a much larger collision between old privacy statutes and new AI products.

In a separate, unrelated case, Google's request for summary judgment in a $5 billion lawsuit over Chrome's Incognito mode was denied by a federal judge. The plaintiffs in that case claimed Chrome's analytics, cookies, and tracking tools continued collecting browsing data even when Incognito mode was active. The structural parallel is obvious: a product feature named "incognito" that controls local storage but does not prevent server-side or third-party collection.

Perplexity also faces separate legal exposure on other fronts. A judge issued a temporary injunction against Perplexity's Comet AI tool after ruling it could no longer scrape certain websites without permission. That case involved unauthorized access claims from Amazon. The company is accumulating legal surface area.

Meanwhile, the legislative environment is accelerating. In the first weeks of 2026, 78 chatbot-related bills were filed across 27 states. Rather than waiting for comprehensive AI-specific federal legislation, plaintiffs are fitting AI-related conduct into existing statutes that already carry statutory damages provisions. The laws are from the 1960s. The conduct is from 2025. The fit is imperfect but good enough to survive motions to dismiss, and that is all a plaintiff needs to reach discovery.

What Does "Incognito" Actually Mean Across the Industry?

Nothing standardized. That is the core problem this lawsuit exposes, and it extends well beyond one company.

In most products, "incognito" means reduced local storage. Your search history is not saved. Your session cookies are cleared on exit. The conversation does not appear in your account's history after a set window. These are real features. They are also not guarantees about server-side collection, third-party data sharing, or inference logging.

The gap between what the label implies and what the architecture does is where the legal exposure lives. A user who sees the word "incognito" reasonably infers something close to: my conversation is private, nobody else sees it, the data is not used for advertising. Whether or not the vendor's documentation technically says something narrower, the reasonable-user standard is what courts will apply. And courts have been applying it aggressively.

If you are evaluating AI vendors, "incognito" should trigger a follow-up question, not reassurance. The follow-up is: show me the data-flow diagram. Which third-party SDKs or APIs are loaded on your chat surfaces? What subprocessors receive prompt data? Does your server-side code make outbound calls with conversation content? These are questions with verifiable answers. A toggle is not a verifiable answer.

How Does Server-Side Tracking Defeat Client-Side Privacy Controls?

The mechanism is straightforward, and understanding it matters for any technical decision-maker.

Client-side privacy controls operate in the browser or on the device. Ad blockers intercept network requests initiated by JavaScript running in the page. VPNs encrypt traffic between the client and the destination server. Browser-level incognito modes prevent persistent cookie storage and clear session data on exit. All of these tools assume the privacy-violating behavior happens on the client side or in transit.

Server-side tracking bypasses all of them. When a chat platform receives your prompt, processes it on its own servers, and then makes a server-to-server API call to an ad platform's Conversions API with your prompt content attached, that call never touches your browser. Your ad blocker cannot see it. Your VPN does not cover it. Your incognito toggle is architecturally irrelevant to it. The data has already left the chat platform's backend through a channel the user has no visibility into and no ability to block.

This is why the complaint's allegation about the Conversions API is the most technically significant claim in the filing. If true, it would mean that no client-side privacy measure available to users could have prevented the alleged data sharing. The only effective control would be the vendor's own architectural decision not to make those calls.

What Should Technical Buyers Actually Ask AI Vendors?

Five questions. All of them should have concrete, verifiable answers.

1. Which third-party tracking pixels, SDKs, or conversion APIs are loaded on your chat interface or called from your backend when a user submits a prompt? The answer should be a list, not a reassurance. "None" is a valid answer. "We take privacy seriously" is not.
2. Does any prompt content, response content, or session metadata leave your infrastructure to a third party for purposes other than model inference? Model inference requires sending data to an LLM provider. That is a known, necessary data flow. Ad targeting is not.
3. What does your incognito or private mode actually control? Local history only? Server-side logging? Third-party data sharing? Retention windows? Each of these is a separate engineering decision. A single toggle can control any combination of them or none.
4. Can you provide a data-flow diagram showing where prompt data goes from the moment of submission to final deletion? This is the artifact that replaces trust with auditability.
5. What is your subprocessor list, and under what contractual terms do subprocessors handle conversation data? Under GDPR and increasingly under US state privacy laws, this is not optional. Under good engineering practice, it never was.

If your vendor cannot answer these questions with specifics, the privacy claim is a feature name, not an architecture. And feature names, as this lawsuit is demonstrating, do not hold up well when tested against actual data flows.

Why Are 1960s Wiretap Laws the Weapon of Choice Against AI Companies?

Because they already exist, they carry statutory damages, and they were written broadly enough to cover new communication technologies.

The federal Wiretap Act (Title III of the Omnibus Crime Control and Safe Streets Act, 1968) and California's Invasion of Privacy Act (CIPA, 1967) were written to cover the interception of communications. The statutory language does not specify telephone wires. It covers the interception of the content of any communication. A plaintiff who can argue that embedding a tracking pixel in a chat interface constitutes interception of the content of a communication has a viable claim under statutes that predate the internet by decades.

The strategic advantage for plaintiffs is that these statutes do not require proving actual harm. They provide statutory damages per violation, which means the plaintiff's burden is to prove the violation occurred, not to quantify the damage it caused. For a class of millions of users over multiple years, the aggregate exposure is substantial even at the per-violation minimum.

For companies deploying conversational AI, this creates a compliance landscape where the cost of getting privacy architecture wrong is not a regulatory fine (those are slow and negotiable) but private litigation with per-message statutory damages and class-action economics. The incentive structure is clear: plaintiffs' firms can fund these cases on contingency because the statutory damages make them economically viable even without proving individual harm.

What Does This Case Not Prove?

It proves nothing, yet. That distinction matters.

A complaint is a set of allegations. It has not been tested through discovery, cross-examination, or judicial findings of fact. Perplexity has not confirmed or denied the specific tracking practices described. No class has been certified. The defendants have not filed responsive pleadings (as of the most recent reporting). The case could be dismissed, settled, narrowed, or litigated to verdict over a period of years.

The developer-tools analysis cited in the complaint is interesting but not dispositive. Network traffic inspection can show that outbound requests are being made to specific domains. It can show what data is included in those requests. It cannot, by itself, prove what the receiving party does with that data, whether the data was used for ad targeting specifically, or whether the data transmission was authorized under the platform's terms of service. Those are factual questions that require discovery.

What the complaint does prove, in a weaker but still useful sense, is that someone with sufficient technical sophistication examined the product's network behavior and found enough to file a 135-page federal complaint that multiple attorneys were willing to sign. That is a signal, not a verdict.

What Are the Implications for Anyone Building or Buying AI Products?

Three concrete implications.

First, privacy claims in AI products are now litigable, not just marketable. The combination of old wiretap statutes, statutory damages, and class-action economics means that a privacy toggle that does not match the underlying architecture is not just misleading, it is a litigation target. If you are building a product with any kind of "private" or "incognito" mode, the mode's behavior needs to be defined in terms of data flows, not UI states.

Second, ad-tech integration in conversational AI is a specific, identifiable risk. The alleged mechanism in this case is not exotic. Meta Pixel and Google Ads tracking are standard integrations used by thousands of web products. The difference is that embedding them in a chat interface, where the content being transmitted includes natural-language prompts that may contain personal, medical, financial, or legal information, changes the risk profile dramatically. A conversion pixel on an e-commerce checkout page transmits "user visited page X." A conversion pixel on a chat interface allegedly transmits "user asked about [sensitive topic]." The legal exposure is categorically different.

Third, the "we take privacy seriously" era is ending. Courts and plaintiffs are no longer asking companies whether they care about privacy. They are asking for network traces, subprocessor lists, and data-flow diagrams. The companies that will survive this litigation wave are the ones whose architecture matches their claims, not the ones with the best privacy page copy.

Where Does This Leave Vendors Who Actually Build for Privacy?

In a better position than they were in twelve months ago, provided their architecture is real.

We built Selina as a privacy-focused AI assistant that remembers you across conversations, with memory encrypted at rest and no ad-tech integrations on our chat surfaces. Content is encrypted. The account is protected. We run on a stack of frontier models, routed per task, via API, and operational metadata is kept for a short retention window. Files and transfers through SelinaSEND are end-to-end encrypted.

These are specific, falsifiable claims. That is the point. A claim that can be tested against actual data flows is worth making. A claim that cannot be tested is a liability.

The Perplexity case will take years to resolve. The questions it raises are useful today. If you are choosing an AI vendor, ask the five questions above. If you are building an AI product, make sure your answers are architecture, not copy.

If you want to see what that looks like in practice: start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io