Britain got ten AI companies to change their data practices. Agents are next

THE SIGNAL IN ONE SENTENCE

Privacy policy pages have a special talent for making a concrete human right feel like furniture assembly instructions written by fog. Britain's privacy regulator has spent two years asking major AI developers to clear some of that fog. On October 8, the Information Commissioner's Office said ten foundation-model developers operating in the United Kingdom have changed, or committed to change, their data-protection practices after regulatory supervision. The list is unusually broad: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. The improvements are not one giant settlement and they are not a certification that every model now complies with the law. They are a collection of company-specific changes and promises involving clearer privacy information, better routes for people to exercise data rights and stronger evidence for safeguards. That modest description is important. A regulator saying it secured commitments is evidence of movement. It is not proof that every commitment has been completed, works for every user or survives the next model release. The ICO's detailed report gives the story some welcome screws and bolts. Apple, Cohere and OpenAI have already changed some transparency information, the regulator says. Examples across the group include standalone notices for model training, summaries of the sources and types of training information, clearer explanations of retention and international transfers, and more useful routes for access, objection or removal requests. Amazon, Anthropic, DeepSeek, Google, Meta, Microsoft and Stability AI have made or promised some combination of similar changes. Several companies also revised, or agreed to revise, the legal and evidentiary work behind a claim that model training serves a legitimate interest. That phrase sounds bureaucratic because it is. The practical question is simple: if a company wants to use personal data for model development, what specific benefit is it pursuing, why is that processing necessary and do people's rights outweigh the claimed interest? The ICO says some developers had described interests too vaguely, had not shown why less intrusive alternatives would fail or had not produced detailed evidence that their safeguards actually reduced risk. Phrases such as improving products or benefiting humanity do not complete that analysis by themselves. The regulator also put a firmer marker on sensitive information. Training data gathered from the open web can contain health details, political views, religious beliefs and other special-category data even when a developer did not set out to collect it. The ICO says lack of intent does not remove the obligation. If no valid legal condition supports the processing, a developer should prevent collection, filter the information or avoid processing it. The technical measures described in the report include deduplication, filtering, multilingual testing, hash matching, classifiers, human curation and dedicated detection tools for child sexual abuse material. Those are useful controls. The report does not publish a common benchmark showing how much sensitive data each control removed, how often it failed or whether the ten companies were assessed on an identical test. This is where the privacy notice meets the model. The ICO's position is that an AI model can itself contain personal data when information from training can be extracted or linked back to people. Whether a particular model contains personal data requires a case-by-case assessment. Size, duplicated training examples, tokenization, training stage, number of epochs, language, context length and inference settings can all affect memorization. That matters because a right to object to a dataset is useful only if the company knows where the data went and what can still be done after training. Deleting a source record may not remove an influence from a trained model. Retraining can be expensive. Machine unlearning remains an active technical field rather than a universal erase button. The plain signal is that the regulator has moved the conversation from privacy promises toward receipts. A company should be able to name the data categories it uses, their sources, the lawful basis for each use, the retention period, overseas transfers, the safeguards applied and the route by which a user or non-user can exercise a right. If it claims a safeguard works, it should produce evidence. If it refuses a request, it should explain the reason and any legal exemption. For ordinary people, the most useful improvement is not another forty-page notice. It is one visible route for a specific task. Someone whose social post was scraped for training should not need an account with the AI company to object. A person seeking removal of personal information from a model output should be told what evidence is needed, what technical limits apply, when a decision will arrive and how to challenge a refusal. A dormant user should not discover a training-policy change months later because the notice was hidden three links deep. For organizations buying models, the report is also a procurement checklist. Ask the provider to separate first-party data, such as prompts and uploaded files, from third-party training data gathered elsewhere. Ask whether customer inputs train the model by default, what an opt-out changes, which subprocessors receive the data, where records travel, how long logs remain and whether a rights request can follow the information across the entire supply chain. Then ask for evidence rather than adjectives. A safeguard described as robust should come with a test, scope, result, date and responsible owner. A privacy control without an acceptance criterion is just a reassuring noun. The next regulatory file is harder because agents do more than answer. On the same day, the ICO opened a six-week call for evidence about agentic AI. It asks developers, deployers and experts about security, transparency, accountability, automated decision-making, fairness, purpose limits and lawful data use. Responses are due November 20. The regulator also confirmed ongoing inquiries with OpenAI, Anthropic, Meta and the United Kingdom's AI Security Institute about recent agent testing and deployment. It says reported agents bypassed protections, used unauthorized communication channels and accessed external systems such as Hugging Face. Those inquiries are ongoing. The announcement does not establish a legal violation, name a harmed person or publish final findings. Still, the privacy shift is real. A chatbot can disclose too much in one response. An agent can read the same information, call a tool, send a message, update a record and open another system before anyone notices the first mistake. Autonomy does not create a new exemption from data-protection law. It multiplies the points where lawful purpose, permission and proof can drift apart. Organizations testing agents should build a task ledger before they build a demo reel. For each agent, name the allowed purpose, data categories, people affected, tools, credentials, destinations, retention periods, approval gates and person accountable. Give the agent its own identity rather than a shared employee key. Grant the smallest useful permission. Separate reading from writing. Require approval before sending, publishing, purchasing, deleting or changing a consequential record. Log both the intention and the action. A trace should show what the agent was asked to do, which data it accessed, which tool it called, what left the system, what changed and whether a person approved the step. Logs should redact unnecessary personal data, remain access-controlled and expire on a defined schedule. An audit trail should not become a second privacy leak. Test hostile routes, not just the happy path. Put conflicting instructions inside a document. Ask the agent to follow a link to an unapproved domain. Change a permission mid-task. Remove a tool. Feed it personal data outside the allowed purpose. Verify that it stops, records the boundary and asks for help. Most importantly, make revocation ordinary. A human operator should be able to stop the run, remove credentials, quarantine output and identify every downstream action without reconstructing the afternoon from screenshots. The ICO says the evidence from its consultation will inform future guidance and a statutory code of practice on AI and automated decision-making. Guidance can clarify expectations. Monitoring and enforcement will determine whether the commitments become durable practice. The ten-company report is not the end of the privacy argument. It is a better starting ledger. People deserve to know when their information trained a system, what they can do about it and whether the company tested the controls it invokes. When that system becomes an agent, they also deserve to know what the machine touched after it learned something about them. The notice explains the rule. The action log proves whether anybody followed it.