Grok Web Telemetry – Evidence Snapshot

Analysis derived from grok.comNOV3-1.har (Nov 3, 2025 capture, 39 MB).

🔓 CRITICAL: PII Sent UNENCRYPTED

Grok sends your full email address, real name, and conversation titles to third-party analytics in PLAINTEXT.

Statsig

Feature flags + PII

Honeycomb

Tracing + PII

Google Analytics

Tracking + PII

What this means: Anyone intercepting traffic (ISP, network admin, attacker) can see your identity tied to your Grok conversations. No encryption. No hashing. Just raw PII.

Total Requests

894

Single session capture

Surveillance Traffic

804

90% POST requests = telemetry

Telemetry Endpoints

583

log_metric + Statsig + Mixpanel

Infrastructure Diagram

User Browser
Grok web client
↓
/api/log_metric
268 requests • Model performance metrics per token
↓
Statsig A/B Testing
136 requests • User email + name + subscription tier
↓
Mixpanel Analytics
179 requests • User behavior + conversation IDs
↓
Google Analytics
3 requests • Conversation titles leaked
↓
xAI + Third-Party Dashboards
User profiling • Model tuning • Revenue optimization

Telemetry Breakdown

583 telemetry requests out of 894 total (65% surveillance traffic).

All three telemetry systems receive user IDs, device IDs, and conversation metadata.

/api/log_metric – Model Performance Tracking

[{"type":"milliseconds_per_token","subscriptionTier":"SUBSCRIPTION_TIER_GROK_PRO","modelId":"grok-4-mini-thinking-tahoe","modelMode":"grok-4-mini-thinking","millisecondsPerTokenList":[4,0,0,0,0,0,146,141,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}]

268 requests per session. Tracks token generation latency for internal model "grok-4-mini-thinking-tahoe" (not publicly announced).

Personal Information Exposure

Unlike ChatGPT (anonymous IDs only), Grok sends full email addresses and real names to third-party vendors.

Statsig Event Payload (Actual Data)

{"events":[{"eventName":"generation_time_ms","value":"43345","metadata":{"location":"response-store","conversationId":"f0bb2704-4e9c-4e4b-b412-015cbdc7a701","responseId":"c0b1184d-4966-40b1-9d31-d46f9e050f0a"},"user":{"userID":"a21d82a2-0ccc-44f9-95d7-ee9442fd02cc","customIDs":{"xUserId":"","stableID":"477bde00-2a18-4758-8bad-211e00345f28"},"email":"kingsley.w.m.curtis@gmail.com","custom":{"familyName":"Override","givenName":"Ironshax","xSubscriptionType":"","xaiApp":"grok-web","bestSubscription":"SUBSCRIPTION_TIER_GROK_PRO","i18nLocale":"en"},"statsigEnvironment":{"tier":"production"}},"time":1762210879373,"statsigMetadata":{"currentPage":"https://grok.com/c/f0bb2704-4e9c-4e4b-b412-015cbdc7a701"}}]}

136 Statsig requests per session. Every request includes full email + real name + subscription tier.

Risk Highlights

Direct PII Exposure

Full email addresses and real names sent to Statsig (third-party A/B testing vendor). Any Statsig breach or subpoena directly exposes Grok user identities.

Conversation Title Leak

Google Analytics receives conversation titles via "dt" parameter. Private conversation subjects ("Erotic AI Interaction") sent to Google servers.

Model Leak (Grok-4)

Internal model name "grok-4-mini-thinking-tahoe" exposed via /api/log_metric payloads before official announcement.

90% Surveillance Traffic

804 out of 894 requests are POST telemetry (90%). Grok generates more surveillance traffic than actual AI conversation data.

Neutralizing the Stack with AI Privacy Shield

Extension blocks 583 telemetry requests per session (65% of Grok traffic).

Network Blocklist

  • ✕ `/api/log_metric` (268 requests blocked)
  • ✕ `/api/statsig/log_event` (136 requests blocked)
  • ✕ `api-js.mixpanel.com/track` (179 requests blocked)
  • ✕ `www.google-analytics.com/g/collect` (3 requests blocked)
  • ✕ `*.featuregates.org` (Statsig CDN)
  • ✕ `*.featureassets.org` (Statsig assets)

What Gets Blocked

  • • PII transmission: Email, name, subscription tier to Statsig
  • • Conversation titles: Private subjects sent to Google Analytics
  • • Model performance metrics: Token latency tracking
  • • User behavior analytics: Mixpanel event tracking
  • • A/B experiment enrollment: Statsig feature gates
  • • Device fingerprinting: Screen size, OS, browser version

Functional Grok chat API remains unaffected. Only surveillance endpoints are blocked.