A recent discovery by user @j4ck.xyz on Bluesky has raised significant privacy concerns regarding Microsoft's Copilot AI assistant. According to the user, Copilot can accurately report a user's location, even when accessed in a browser's incognito mode, without being signed into a Microsoft account, and with location permissions explicitly denied.
This capability suggests that Microsoft may be using IP address-based geolocation or other fingerprinting techniques to determine a user's location, bypassing traditional browser-based privacy controls. The fact that this occurs even in a "private" browsing session is particularly alarming, as users rightfully expect a higher degree of privacy in such modes.
This revelation has sparked a conversation about the extent to which AI assistants are collecting and using user data, often without clear and transparent disclosure. While location data can be used for legitimate purposes, such as providing localized search results, the lack of user control and the surreptitious nature of the data collection are a serious breach of user trust.
This incident serves as a stark reminder that as AI becomes more integrated into our digital lives, it is crucial to remain vigilant about our privacy and to demand greater transparency and control over our personal data.