When one AI agent passes your data to another, can your privacy choice follow?
An audit of 30 AI products found hundreds of privacy controls but inconsistent defaults and no common way to carry a person's choice across connected agents. Eight prototypes show a possible technical route, not a deployment-ready standard.
The short version
- What happened
- Researchers found 788 privacy-control instances across public documentation and settings for 30 AI products from 18 companies; 567 controls, or 72%, fitted their five-part agentic privacy taxonomy.
- Who it affects
- People may connect calendars, documents, shopping accounts or workplace tools to one agent without seeing every downstream service. Portable, inspectable preferences could reduce repeated settings work, but today users still need to check each product separately.
- What remains unproven
- This is an unreviewed preprint and a documentation audit, not a functional test of whether controls work as described.
Keep in mind
This is an unreviewed preprint and a documentation audit, not a functional test of whether controls work as described.
The authors viewed public material from a US location and may have missed regional, logged-in or enterprise controls.
A language model helped retrieve candidate pages, so relevant documentation may have been missed despite manual verification.
The eight prototypes are demonstrations; the paper does not evaluate production deployment, interoperability at scale or resistance to malicious components.
Source analysis · 1 linked source. Primary analysed source date: 21 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The control exists, but its meaning may not travel
AI agents can call tools, exchange context and delegate work to other agents. That creates a practical privacy question: if a person has opted out of model training, human review or long-term memory in one product, does the next service receive and honour that choice? A new preprint finds no shared answer. The researchers propose five control categories—whether an agent is present, what it collects, how information is used or reviewed, how long it persists and how independently the agent may act.
Using that framework, they examined public settings and documentation available from a US location in October 2026. The starting list covered 22 highly ranked AI companies plus xAI and DeepSeek. Four had no public product in scope, leaving 30 products from 18 companies. An automated language-model pass retrieved candidate pages; the authors then manually verified the controls and their wording.[1]
Hundreds of controls do not add up to one portable preference
The audit recorded 788 control instances. Of those, 567—72%—mapped to the proposed agentic taxonomy. Another 21, or 3%, addressed retention without fitting the categories, while 200, or 25%, sat outside scope. The count shows that providers offer many choices, but the paper finds inconsistent terminology, placement and granularity. Only 40% of documented controls stated their default. Among opt-outs that required a person to contact the company, the figure was 19%.
Those percentages describe documentation, not how often people use a control or whether a system enforces it reliably. A product with many controls is not necessarily more protective than one with fewer, clearer defaults. Nor does the audit establish that a named company has broken a law. It supplies a denominator for a narrower claim: people and software agents cannot yet rely on one widely documented preference language across products.[1]
The distinction that matters
How a portable preference could move through an agent workflow
The paper's prototypes separate a person's choice from any single settings page.
Choose
A person sets limits on collection, use, retention or autonomy
A machine-readable preference object is created
Attach
The orchestrator sends the preference with the task and context
MCP tools and other agents can inspect the same instruction
Enforce
Each component allows, transforms or blocks the requested action
The decision can be logged at every hand-off
The prototypes show a route, not a finished safety layer
The researchers built eight open-source prototypes for common orchestrator, Model Context Protocol and agent-to-agent scenarios. Their design attaches a machine-readable privacy object to a request, allows downstream components to evaluate it, and records whether the action is allowed, transformed or blocked. That could make a preference visible at each hand-off instead of leaving it inside the first product's settings page.
The evidence would become stronger if independent teams reproduced the inventory across countries, tested logged-in and enterprise controls, and ran the prototypes against production systems under adversarial conditions. The current audit may miss pages because discovery used a language model; it could not see every account-only control; and it did not test functional enforcement. For users, the immediate lesson is modest: check each connected service rather than assume that one opt-out automatically follows the data.[1]