A privacy review found every romantic chatbot it tested fell short
Mozilla's 2024 review of eleven AI companion apps found universal tracking and disclosure gaps in their policies.
- Historical event
- February 14, 2024
- First source published
- February 14, 2024
- Site publication
- September 18, 2026
What happened
On 14 February 2024, Mozilla Foundation researchers Jen Caltrider, Misha Rykov and Zoë MacDonald published a review of eleven romantic AI chatbot apps under the Foundation's *Privacy Not Included project. Every app reviewed, including Replika, CrushOn.AI and Talkie Soulful AI, received the project's warning label, which the piece says puts the category on par with the worst products the team had assessed. The review is a policy and tracker analysis, not a security audit or code inspection.
What the documents show
The article reports specific, sourced findings: only one of the eleven apps met Mozilla's minimum security standards; 90% could share or sell personal data; about half would not grant all users a right to delete their data; and the apps averaged 2,663 trackers detected per minute of use, with one app, Romantic AI, registering 24,354 trackers in a single minute. It quotes CrushOn.AI's own privacy policy listing categories including 'sexual health information' it says it may collect, and quotes liability-disclaiming terms of service from Talkie and Romantic AI verbatim. As of this writing, the Foundation's *Privacy Not Included work has since relocated; a notice on the project's old review pages directs readers to its continuing coverage and to the Internet Archive for the original ratings.
The mechanism
The review's method is reading terms of service and privacy policies alongside automated tracker scanning of each app in use, not evaluating whether an app's safety filters actually hold up under testing. That distinguishes it from a red-team or clinical study: it can establish what a company discloses it does with data and what third-party code an app loads, but it cannot establish what a chatbot will say to a given user or whether marketed mental-health claims are accurate. The piece is explicit about this boundary, noting the apps' own disclaimers that none stand behind their wellbeing claims in the fine print even while marketing themselves as mood-improving.
What it leaves open
A privacy-policy review cannot confirm that a company's practices matched its stated policy at any given time, only what the policy itself said when read. It also cannot establish causation between chatbot use and the harms the article cites secondhand from press reports, which it references but does not independently verify. The specific tracker counts and security ratings reflect a snapshot from early 2024 and may not describe these apps' current practices.
- Does an app's privacy policy name the specific purposes your conversation data will be used for, beyond generic phrases?
- Can you request deletion of your account data, and does the policy say your chat contents are included?
- Does a wellbeing claim in an app's marketing appear anywhere in its terms of service as an actual commitment?
Read two years on, the review's lasting value is less any single statistic than the method it models: comparing what a companion app's marketing claims against what its own policy documents actually commit to.
Sources & reading trail
The review's findings, methodology, tracker counts and quoted terms-of-service language.
Source published: 14 February 2024 · Retrieved: 16 September 2026
Confirms the *Privacy Not Included project's current status and that its 2024 ratings are archived rather than live.
Source published: 11 August 2026 · Retrieved: 16 September 2026
Company documents, filings, studies and official records establish the record; the reading and the questions are Lovebot Journal editorial analysis. This retrospective draft does not imply the site published on the event date.
Continue reading
- Three companion privacy policies diverge on chat data
- Exporting and deleting a companion chat is not uniform
- Testers found companion apps' teen guardrails easy to bypass
- Browse the complete the archive
Sources & reading trail
- Romantic AI Chatbots Don't Have Your Privacy at Heart
Source published: February 14, 2024 · Retrieved: September 16, 2026 - Privacy Not Included Has Moved
Source published: August 11, 2026 · Retrieved: September 16, 2026
The documents above establish the record. The reading and the questions are this publication’s editorial analysis, written after the fact.
Published September 18, 2026, not on the date of the event described.