It Reads Your Email, Files Your Claims, And Never Asks Permission — The Privacy Law Of AI Agents

What an AI agent actually does

July 02, 2026 - Most vendor privacy terms were designed for traditional software, a predictable tool guided by human hands. Those terms cover a familiar group: the permitted uses of customer data, confidentiality obligations, security safeguards, breach notification, subcontractor restrictions, limitations of liability, and the return or deletion of data at termination. More recent versions were written for chatbots that merely suggest drafts for human review. An AI agent is something else entirely. Once given a goal, it maps its own course. It moves through internal systems, probes databases and document vaults, drafts and dispatches emails, opens and closes tickets, calls out to third-party APIs, moves money, and weaves these actions together, often without a single human sign-off.

In real terms, an agent sorting a service queue is sifting through account records and emails; a coding agent combs through source code and credentials; a sales agent digs into the CRM; an HR agent dissects resumes and personnel files; a healthcare agent handles charts, appointments, and claims; and a finance agent balances transactions and statements.

Jumpstart your morning with the latest legal news delivered straight to your inbox from The Daily Docket newsletter. Sign up here.

All of this is personal information, flowing autonomously, relentlessly, and at the speed of machines.

Why businesses are racing to deploy them, and to sell them

Inside organizations, agents are sweeping away the manual middle from almost every workflow: tier-one support, IT help desks, onboarding, document review, prior authorizations, claims processing, reconciliation, and back-office data entry. The draw is clear: Tasks that formerly demanded human hours now run tirelessly, day and night.

Equally important for privacy, agents are now the product itself. SaaS vendors are grafting copilots and autonomous agents onto their platforms; startups offer agent-as-a-service that taps inside customer emails, calendars, and records; established firms are crafting proprietary agents atop third-party models.

Two ways of making money heighten the risk. First, vendors charge by usage or seats while quietly feeding customer data into their models, turning regulated information into R&D fuel. Second, agents are most valuable when they have wide, ongoing access, so economic motives clash directly with data restriction. The business model and the privacy risk are two sides of the same coin.

The core problem: An agent is a processing activity, not a tool

The operative insight is that an agent does not simply risk data leakage. It independently performs the regulated act of processing personal information, continuously, autonomously, and at scale. It must be treated as a processing activity to be mapped, disclosed, and constrained, not as a neutral tool that happens to touch data.

The comprehensive U.S. state privacy laws now in force (the CCPA as amended by the CPRA, plus Virginia, Colorado, Connecticut, Texas, and roughly 20 more) and the GDPR all turn on principles an autonomous agent is structurally prone to break: lawful basis and ⁠notice, purpose limitation, data minimization, storage limitation, and accountability.

The privacy risk domains

Purpose limitation and secondary use. Personal information may be used only for purposes disclosed at collection or compatible with them. This is not merely a contractual preference; it is a requirement of the privacy laws themselves, including GDPR Article 5(1)(b) and the purpose-limitation provisions of the comprehensive U.S. state privacy laws, which vendor privacy agreements are then drafted to implement. A business cannot retroactively expand that scope by handing data to an agent that puts it to a new use. Two behaviors recur: vendor model training on the client's prompts, records, and transcripts, a secondary purpose that exceeds any service-provider authorization; and persistent memory that reuses personal data across tasks, sessions, or users, extending retention and undermining deletion.

Automated decision-making and profiling. An agent that screens, scores, prices, ranks, approves, or denies is engaged in automated decision-making that privacy law regulates directly. GDPR Article 22 gives individuals the right not to be subject to solely automated decisions with legal or similarly significant effects, plus meaningful information about the logic and a route to human review.

The states are converging through profiling opt-outs and the California Privacy Protection Agency's ADMT rules (phased compliance from January 1, 2027), which add pre-use notice, opt-out, access, and risk-assessment duties. A consequential-decision agent must launch with disclosure, a genuine appeal path, an opt-out, and a documented assessment.

Sensitive and biometric data. Health, precise geolocation, race or ethnicity, sexual orientation, children's data, and biometric identifiers carry heightened consent and handling rules under the privacy laws themselves (GDPR Article 9 and the sensitive-data provisions of the state statues), obligations that exist independent of, and cannot be contracted away in. the vendor agreement, and agents routinely encounter these categories of data in the ordinary course of their work, buried in documents, images, voice, and free text. Illinois's BIPA requires informed written consent before collecting biometric identifiers and provides a private right of action with statutory damages that have driven nine-figure exposure, so an agent processing voiceprints or facial geometry can create liability with no breach at all. Texas and Washington run analogous regimes.

The processing chain and the unauthorized-recipient problem. Privacy law allocates responsibility by contract along a chain: the controller and processor under the GDPR, and the business and service provider or contractor under the CCPA. An agent vendor is almost always a processor.

A vendor that uses data outside the contract, including to train its models, breaks the chain: Under the CCPA, it becomes a third party to whom data has been sold or shared, triggering opt-out rights the business never offered; under the GDPR, it becomes ⁠an independent controller with direct liability. Multi-model agents compound this by routing data to model providers and tool vendors that the client never vetted.

Personal rights and security. If memory, caches, embeddings, logs, or a vendor's fine-tuned model retain personal data, the business may be unable to honor deletion, correction, or access requests, and the data can resurface in later outputs. Separately, prompt injection and instructions hidden in content the agent reads and obeys can convert a trusted agent into an exfiltration channel with no perimeter breach, making output filtering and data-loss prevention privacy controls, not just security controls.

The sectoral overlays: HIPAA, GLBA, and others

General privacy law is the floor. Industry regimes sit on top, and agents cross into them constantly.

Starting with two of the most regulated sectors, healthcare and finance, in regard to HIPAA (Health Insurance Portability and Accountability Act) compliance, if an agent or its vendor creates, receives, maintains, or transmits protected health information on behalf of a covered entity or business associate, whether for scheduling, intake, coding, claims, or clinical messaging, the vendor is a business associate, and a compliant business associate agreement is mandatory before any PHI flows.

The minimum-necessary standard cuts hard against agents built for broad access, and a vendor that trains on PHI or stores it in memory is making use of the agreement that almost certainly was never authorized.

The Gramm-Leach-Bliley Act (GLBA) governs financial institutions, which are defined broadly enough to reach lenders, advisers, and many fintechs, must protect ⁠nonpublic personal information under the Safeguards Rule, which now requires documented oversight of service providers, access controls, and encryption. An agent with standing access to account data is exactly the service provider the Rule targets, and the institution is still answerable for its conduct.

As for the others, there are plenty. The Fair Credit Reporting Act (FCRA) governs agents used in eligibility, hiring, or background contexts and requires adverse-action notice. The Children's Online Privacy Protection Rule (COPPA) applies wherever children's data appears. The Video Privacy Protection Act (VPPA), now a heavily litigated theory, reaches video-viewing data. The Family Educational Rights and Privacy Act (FERPA) covers education records. And the wave of California Invasion of Privacy Act (CIPA) and state wiretapping suits over session-replay and chatbot eavesdropping maps directly onto agents that collect and route user exchanges in real time.

What the vendor contract must do

A software data-processing agreement will be missing most of this. Tune each term to the data: Bind the vendor to the contracted purposes and prohibit profiling ⁠and model training on personal information; govern agent memory and require deletion of personal data and derived artifacts (embeddings, caches, fine-tuned weights) on request and at termination; include the CCPA- and GDPR-required service-provider and processor terms and flow them to every sub-processor; require least-privilege (meaning the agent is granted access only to the minimum systems and data necessary to perform its assigned task, and nothing more), task-scoped access with data-loss prevention on outbound actions; support individual-rights and automated-decision obligations across every location the agent holds data; require detection and lawful handling of sensitive and biometric data; and add data transfer mechanisms wherever data leaves its origin jurisdiction, plus the HIPAA business associate agreement or GLBA safeguards terms the sector demands.

The governance needs to be put in place first

Contracts allocate risk; governance prevents the deployment that creates it. Before an agent processes personal data: treat it as a processing activity and complete the required data-protection ⁠and ADMT risk assessments; update notices and confirm a lawful basis, including for sensitive and biometric data; maintain an approved-tool list tiered to data sensitivity so regulated data never reaches unvetted consumer tools; wire access, deletion, correction, and opt-outs into the agent's memory, logs, and derivatives; enforce least privilege, full logging, an agent inventory, and a kill switch; and keep a human decision-maker in the loop for any legally consequential action.

Bottom line

An AI agent is a continuous, autonomous processing activity, and increasingly both the tool a business runs on and the product a vendor sells. That single fact engages the core of privacy law and every sectoral overlay from HIPAA to GLBA. Replace the legacy software data-processing agreement with an agent-specific contract, and stand up governance, assessments, updated notices, a sensitivity-tiered tool list, least-privilege access, and a rights workflow that actually reaches the agent, before it is deployed.