Phia, a popular AI shopping agent founded by Bill Gates’ daughter Phoebe Gates and Sophia Kianni, has been collecting a concerning amount of user data

AI shopping agent Phia, which recently secured an $8 million seed round led by Kleiner Perkins and backed by high-profile investors, is facing severe scrutiny after cybersecurity researchers discovered its browser extension was collecting full snapshots of users' web pages, including sensitive financial and personal data, and transmitting them to company servers. This practice, since removed by Phia without user disclosure, is deemed a major privacy violation by experts, potentially breaching GDPR and U.S. state privacy laws, and raises significant reputational and regulatory risks for the rapidly growing startup and its investors, highlighting broader security concerns within the fast-paced AI development landscape.

Analysis

AI shopping agent Phia, which recently secured an $8 million seed round led by Kleiner Perkins and high-profile investors, faces severe scrutiny over its data collection practices. Cybersecurity researchers discovered that a previous version of Phia's browser extension captured full HTML snapshots of all user-visited web pages, including highly sensitive information like bank statements and private emails, transmitting them to the company's servers without explicit consent.

This practice, identified as the "logCompleteHTMLtoGCS" function, directly contradicts Phia's privacy policy and public assurances, leading experts to categorize it as a major privacy violation. While Phia removed the feature after being alerted, it did not disclose the incident to users or confirm the deletion of the collected data, raising significant transparency and legal liability concerns under regulations like GDPR and various U.S. state privacy laws.

Even the updated extension, which logs only URLs, still poses privacy risks as URLs can contain sensitive PII, and Phia's ability to reconstruct browsing history via user logins remains. This incident highlights a broader trend of security vulnerabilities in the fast-paced AI startup ecosystem, where rapid development often outpaces robust security measures and regulatory oversight, creating substantial reputational and financial risks for companies and their investors.

Key Decisions for Investors

• Investors in Phia should immediately assess their exposure to potential regulatory fines (e.g., GDPR, U.S. state laws) and litigation stemming from the severe privacy violations, considering the company's lack of transparent disclosure and data deletion confirmation.
• High-profile investors and venture capital firms backing Phia, such as Kleiner Perkins, should evaluate the significant reputational damage and potential brand association risks from this privacy scandal.
• Institutional investors with exposure to the broader AI startup ecosystem should scrutinize portfolio companies' data handling practices and security protocols, given the article highlights systemic security gaps in rapid AI development.