The Red Iberoamericana de Protección de Datos (RIPD), the network that brings together data protection authorities from across the Ibero-American region, has published a 29-page set of standards on how personal data rules apply once artificial intelligence enters the processing chain. The document, "Estándares Iberoamericanos sobre el uso de datos personales en sistemas de inteligencia artificial", states that it was published in November 2026. It does not give a day.

Its most direct consequence for the advertising and marketing technology sector sits in a single paragraph. When an AI provider or a data processor uses personal data it handles for a client to develop, train, evaluate or improve its own models, that use "shall, as a general rule, be considered a different purpose and shall not be understood to be included in the processing entrusted, unless there is express authorisation and a legal basis that covers it," according to the standards. Anonymising the client's data first does not change the analysis.

In Short

Data protection regulators across the Ibero-American region, which spans Spain, Portugal and Latin America, published a guide in November 2026 explaining how existing privacy rules apply to AI, from model training to autonomous agents. It affects any company that gives customer data to an AI vendor, builds audience profiles from behavioural signals, or trains models on data scraped from the public web in those countries. Under the standards, vendors may not treat client data as their own training material by default, traits such as health or beliefs that a system infers count as sensitive data, and simply saying "we use AI" no longer counts as informing people.

What the document is, and what it is not

The standards are guidance. According to the text, they have a "guiding nature and complementary character" in relation to the general data protection regime, and they apply "without prejudice" to national law. The preamble is explicit about the limits of the exercise: the document "does not create a parallel ethical-legal regime for artificial intelligence, nor does it seek to replace national legislation" or the network's existing general standards, the Estándares de Protección de Datos Personales para los Estados Iberoamericanos.

"The Standard neither reduces nor relaxes the level of protection recognised by that common framework," the preamble adds. The quotations in this article are PPC Land translations from the Spanish original.

The text says the network approved the standards "as the result of a process of drafting, consultation and technical deliberation in which its member authorities have taken part." It does not list those authorities, name a meeting or give an approval date. The document states that it was financed by the European Union through NextGenerationEU, in collaboration with the Fundación para la Internacionalización de las Administraciones Públicas (FIAP), within the framework of the EU-LAC Digital Alliance. It adds that the views expressed do not necessarily reflect those of the EU or its member states.

Three methodological choices shape the whole text. First, its object is not AI systems in the abstract but "the personal data processing operations that incorporate them." Second, it follows a lifecycle approach, under which development, training, evaluation and improvement are treated as distinct phases whose obligations, "in particular those relating to lawfulness, minimisation and data quality," must be determined separately, although the phases do not by themselves necessarily require separate legal bases. Third, it is risk-based and deliberately technology-neutral, using wording "independent of specific products, brands or providers." The audience runs from data protection authorities and legislators to controllers, processors, AI providers and public bodies.

Much of the vocabulary, from balancing tests to data protection officers, will be familiar to anyone who has worked under the GDPR. What the Ibero-American text adds is a set of positions on where AI changes how those concepts apply.

When a model is in scope

The standards do not apply when no personal data is processed. The document lists three examples: data anonymised to the standard's own threshold, synthetic data "that does not allow people to be identified or re-identified," and AI models "that neither process nor allow personal data to be obtained."

That exemption comes with a burden of proof. Whoever claims the standards do not apply "must be able to demonstrate it, whatever the case invoked, and have available, for that purpose, the analysis on which it is based." If a reasonable risk of identification or re-identification later appears, the processing falls back under the standards.

Then comes a provision that addresses the debate over whether a trained model itself contains personal data. "When personal data relating to an identified or identifiable person can be extracted, revealed or reasonably attributed from a model, including its parameters and the results it produces, the processing shall be subject to the Standard," according to section 1.2.5. The test covers both what sits in the weights and what comes out of the system.

That position runs close to European thinking. The European Data Protection Board's Opinion 28/2024 of December 2024 said AI models trained on personal data cannot automatically be considered anonymous. In July 2026, the EDPB put out draft anonymisation guidelines that replace the 2014 three-criteria test with a framework built on no record isolation, no linkage and no inference. The Ibero-American text sets its own bar: anonymisation "may only be considered effective when it is demonstrated that there is no reasonable risk of identification or re-identification," and that assessment "requires special caution" when a system or its outputs could enable re-identification "or reveal data through memorisation."

Synthetic data gets a specific caveat in the definitions. "Its synthetic character does not by itself imply the anonymisation of the reference data, if there were any," the document states. Pseudonymisation, likewise, "reduces exposure, but does not exclude the processing from the general data protection regime."

Legitimate interest, but not by presumption

The standards decline to rank or list legal bases. That job belongs to the general regime, the text says. What they do instead is set conditions for one basis that AI developers have leaned on heavily.

Where national law allows it, legitimate interest "may constitute an adequate legal basis" for processing aimed at developing, training, evaluating or improving AI systems, provided the balancing test is carried out and protective measures are adopted. The next sentence is the qualification: "The suitability of legitimate interest as a legal basis cannot be presumed."

Factors that may weigh in the balance include minimisation or pseudonymisation, people's reasonable expectations, the severity of risks, the absence of decisions with significant effects during development, and whether the right to object can actually be exercised. The balancing must be "especially rigorous" when processing involves mass reuse of personal data, special categories of data, data on vulnerable people or groups, or profiling with legal or similarly significant effects. Legitimate interest, the text adds, neither replaces an impact assessment nor is replaced by one.

The preamble explains why AI makes the test harder. It points to "the scale at which personal data can be reused, the distance between the moment it is obtained and its later use, and the barely perceptible character that these processing operations tend to have for people."

The question of which basis supports AI training is not settled anywhere. An Oxford study published in March 2026 reviewed 19 regulatory guidelines issued between 2020 and 2024 and found that all of them recognised legitimate interest for AI training, while their methods for applying it diverged. Within the Ibero-American region itself, Ecuador's data protection superintendent signed a resolution in November 2025 requiring written balancing assessments before private-sector controllers rely on legitimate interest. Outside it, South Korea's privacy regulator proposed in August 2025 making legitimate interests the primary basis for using publicly available data in AI.

Consent barely features. The word appears once in the entire document, in the section on neurodata, and there only to say when it should not be used.

The vendor and the client's data

For marketers, the provisions on the AI supply chain may matter more than anything else in the document. Customer data now flows through analytics platforms, customer relationship management tools, creative generators and ad platforms that offer AI features, and the standards take a clear line on who may do what with it.

Section 2.2.2, quoted at the top of this article, sets the default: a vendor's use of client personal data "for their own purposes" is a separate purpose, outside the processing mandate. The text also closes an obvious workaround: "the anonymisation or transformation of such data carried out for those own purposes constitutes a use subject to this provision," and the anonymised result cannot be treated as covered by the mandate "when the operation that produced it was not."

Chapter VI builds on that. Providers of models or AI services can be controllers, processors or joint controllers depending on the functions they perform in each processing operation. When they reuse personal data for their own purposes or determine the purposes or essential means, "they shall assume the responsibilities that correspond under data protection rules." Conditions for using data to develop, train or improve models must be "expressly determined between the parties," but such contractual terms do not substitute for the legal basis the processing requires.

The definition of controller is drawn broadly. It is whoever decides the purposes and essential means of the specific processing, "even if it does not train or technically control the model." A brand that plugs a third-party model into its customer service or audience tools therefore remains responsible for that processing. Under section 6.4, the use of models or services developed by third parties "does not exempt the controller from verifying that its use is compatible with data protection rules," nor from assessing the guarantees providers offer.

The documentation duties follow the same logic. Under section 1.4.3, contracts with processors or AI providers must give the controller what it needs to comply, including, where necessary, the provenance, representativeness and conditions of collection of training data, known limitations, identified biases and mitigation measures. Section 6.3 requires the controller to identify every actor in the chain, "including processors, sub-processors and successive providers," along with any international transfers.

Contracts between vendors and customers already reflect some of this pressure. Microsoft's data protection addendum update of May 2026 set 30 days' notice for subprocessors that provide AI functionality, down from a previous six-month minimum. For international transfers linked to AI development or deployment, the standards list possible supplementary measures: minimisation, encryption, pseudonymisation, or additional contractual guarantees "on their use, retention or reuse."

Public data is not a licence

Section 2.2.3 is short. "The publicly accessible character of personal data, or public data, does not by itself legitimise its use for the development, training or improvement of artificial intelligence models or systems."

Section 9.5 develops the point. Reusing such data for purposes other than those that justified its publication requires an adequate legal basis and, where appropriate, reinforced safeguards, which are "especially required" for mass collection or reliance on legitimate interest. Public accessibility "does not by itself constitute" that legitimate interest, and the context in which data was made public and people's reasonable expectations both count. The safeguards, the text specifies, "operate as additional safeguards required for reuse and not as an authorisation of it."

Section 2.2.4 reaches one form of scraping directly. The reinforced safeguards for biometrics and for collecting public data apply to building or enriching biometric databases "through mass, systematic and indiscriminate collections of images or recordings."

The European parallel is close but not identical. The EDPB's Guidelines 03/2026 on web scraping, adopted in July 2026, found that consent will most probably not be workable for scraping at scale and set out a three-condition legitimate interest test. The EDPB's October 2026 summary listed concrete minimisation steps, including avoiding sites that block scraping through robots.txt, ai.txt or CAPTCHA. The Ibero-American text contains no comparable technical guidance. It does not mention robots.txt, ai.txt or any other machine-readable opt-out signal.

Manipulation, vulnerability and social scoring

The document's strongest language is reserved for three practices. Processing through AI systems "intended to deceptively manipulate people's behaviour, improperly exploit situations of vulnerability - among others, those deriving from age, disability or socioeconomic situation - or establish social scoring mechanisms that produce discriminatory effects or unjustified restrictions of rights" is "incompatible with data protection principles," according to section 2.2.4.

These categories echo the prohibited practices in Article 5 of the EU AI Act. PPC Land's reporting on the boundary between influence and manipulation under the AI Act showed how hard that line can be to draw for persuasion techniques used in advertising. The Ibero-American standards do not attempt to draw it. They state the incompatibility and leave the definitions to national law and authorities.

Inferred sensitivity: judged by effect, not by input

Chapter III may prove the most consequential for audience targeting. It opens with an observation: "Health, ideology, sexual orientation or beliefs can be inferred even from apparently neutral variables." It adds that other especially sensitive inferences can be generated, "among them those relating to economic vulnerability."

The legal consequence follows. The reinforced regime that the general rules provide for special category data "shall be determined by the actual nature of the inferred information and not only by that of the input data." Section 3.1.2 makes the regime applicable whenever a system "generates or uses inferences that allow a special category of data to be reasonably attributed to a person," judged by purpose, context and impact.

Accuracy is no defence. "The degree of reliability or accuracy of the inference shall not by itself exclude the application of the reinforced regime when that inference is used to adopt or support decisions about the person," according to the standards.

Inferences that fall short of special categories are not left unregulated. They must be assessed "in light of their effects on people," under the proportionality rule and the impact assessment provisions.

The implications for interest-based segmentation are plain enough. A segment built from browsing, purchase or location signals that in practice identifies people with a health condition, a religious affiliation, a political leaning or a sexual orientation falls, under this reading, into the regime for sensitive data, whatever the label in the taxonomy. Processing such inferences, "including their retention and use," is only possible when one of the exceptions in the general regime applies. "The Standard does not by itself constitute an authorisation for such processing," the text adds.

Two related principles reinforce the point. Section 2.3.1 extends data minimisation to "the system's capacity to identify, single out or generate inferences about people," which must be avoided when not necessary for the purpose. Section 2.4.2 requires that inferences be used with regard to "their character as hypothesis, deduction or proposal and the associated degree of uncertainty," and never presented as facts "to the person or to third parties." Bias testing gets a narrow allowance: where the general regime permits processing special categories to detect or correct discrimination, that processing stays subject to minimisation and reinforced safeguards.

Vulnerable groups and behavioural advertising

The standards define people or groups in situations of vulnerability as those who, "permanently or circumstantially and by reason of their age, disability or other personal, social, economic or contextual circumstances, including those specific to the digital environment," face a greater risk of harm or greater difficulty controlling their data. The document never uses the words "minors" or "children." Age appears instead as one ground of vulnerability among several.

For systems aimed at such groups, or that may significantly affect them, section 3.2.3 requires "especially protective and predetermined settings, a design adequate to their age and reinforced guarantees against profiling, behavioural advertising and the improper collection of their personal data." This is the only place in the document where advertising is named. The section also states that "profiling, behavioural advertising and inferences that improperly exploit the vulnerability" of these people fall within the general incompatibility with data protection principles.

Using vulnerable people's data to develop, train, validate or improve AI systems requires "an especially rigorous justification and the adoption of reinforced guarantees" at each of those phases. When that data is not needed, measures must be taken to avoid using it.

Neurodata

The standards define neurodata as personal data obtained through specific technical processing, "directly, indirectly or by inference," relating to the anatomical, physiological, functional or behavioural characteristics of a person's brain activity and nervous system. The provisions extend beyond brain-computer interfaces, however. Section 3.3.1 covers processing "that uses neurodata or generates inferences about cognitive, emotional or behavioural states."

Such processing must pass "a special assessment of necessity and proportionality," with attention to context, "in particular when there are relationships characterised by an asymmetry of power," and to risks for autonomy and privacy. Using neurodata or such inferences to improperly manipulate will or behaviour, or to exploit vulnerability, is incompatible with data protection principles. Processing aimed at inferring "intimate convictions" or at especially intrusive surveillance is allowed only exceptionally, when a legal basis, a specially justified purpose, necessity, proportionality and the lack of a less intrusive alternative can all be demonstrated.

The consent provision is unusual. "Consent should not constitute a legitimising basis when the controller is not in a position to determine in advance, with reasonable precision, which inferences will derive from the processing of the neurodata," according to section 3.3.2.

The breadth of "inferences about cognitive, emotional or behavioural states" is worth noting for advertising measurement, where emotional response and attention are routinely modelled. Legislators in the region are moving in the same direction. Colombia's Statutory Bill No. 282 of 2026, published in September 2026, would classify neurodata as sensitive and set fines of up to 5% of prior-year operating revenue. In the United States, California's amended consumer privacy law, which took effect on January 1, 2026, lists neural data among categories of sensitive personal information.

Automated decisions: a rubber stamp is not a human

Chapter IV requires controllers to identify where a decision is based solely on automated processing, including profiling, that produces legal effects or significantly affects a person, "whatever the nature - social, economic or otherwise - of that effect." They must distinguish between fully automated decisions, decision-support systems and cases of effective human intervention, and review that classification when the system or processing changes. The preamble clarifies that significant effects are not limited to legal ones; they include "material, social or economic" consequences.

The human review test is demanding. A decision only stops being solely automated when there is "prior, real and effective" human intervention by someone able to assess and understand the system's output, with authority to confirm it, modify it or depart from it. "Human intervention that is limited to formalising or endorsing the system's result without meeting those conditions shall not constitute effective human intervention," according to section 4.2.1. In that case the decision keeps its fully automated character, along with all the guarantees attached to it.

Automated alert tools can support oversight but "shall not replace human intervention when it is required, nor may they be presented as equivalent to it." Controllers must also assess whether a system may produce discriminatory effects, "including those derived from the use of apparently neutral variables" or from differences in how the system performs across groups, and must be able to document that their mitigation measures are adequate.

Explanations, and the limits of trade secrecy

Section 2.5.1 sets the baseline for transparency. When processing incorporates an AI system, the controller must inform people of its use, its purpose, its role in the processing and the consequences it can have for them. Then comes a sentence that many privacy notices may not meet: "The mere indication that artificial intelligence or algorithms are used does not satisfy the duty to inform."

The information must cover, among other things, the categories and origins of data, whether the system generates profiles, inferences or decisions, any providers involved, the degree of human intervention and how to challenge outcomes. A "merely formal supervision" may not be presented as a guarantee. Information can be layered.

Where needed, a person is entitled to a meaningful explanation covering the system's logic, the factors that significantly influence the result, relevant data sources, known limitations and the measures for detecting and correcting errors and biases. Disclosure of source code, the full model or information that would compromise security, trade secrets or intellectual property is not required, "provided the person retains a sufficient understanding of the processing." But that carve-out has a floor: "The protection of security, trade secrets or intellectual property may not be invoked to empty the essential content of the right to information," according to section 2.5.5.

Courts in Europe are working through the same tension. Germany's Federal Court of Justice, in reasons dated October 21, 2026, held that credit agency SCHUFA must explain how it weighs types of data in its scores, though not disclose its algorithm.

Rights over inferences and trained models

Chapter V applies data subject rights to "inferences, profiles and other results that constitute personal data." The right of access extends to knowing whether a person's data was used in an AI system, whether profiles or inferences were generated about them, and whether these influenced decisions affecting them. Where an inference cannot be corrected directly, the person can ask for correction of the input data, add information, contest it or request its review.

Erasure from trained models gets the most detailed treatment. Controllers "shall endeavour" to select, configure or use systems that make it possible to exercise erasure, restriction and objection across the lifecycle, "in particular through the deletion, unlinking or exclusion of personal data from future training," where technically feasible. Technical feasibility "does not condition the enforceability of these rights," the document adds.

When the state of technology prevents full exercise of these rights in relation to an already trained model, the controller must justify and document that, inform the person concerned and take reasonably available measures. Those include, where possible, deleting the personal data from the environments where it sits, "among others, the training datasets, the indices, the vector representation databases and the persistent memories," and excluding it from future training. "This circumstance shall not be definitive and shall be assessed according to the state of technology existing at each moment," according to section 5.5.

The practical difficulty is real. Tom Chavez, co-founder of super{set}, argued in August 2026 that enterprise data cannot be removed from a large language model once trained. France's CNIL, in recommendations finalised in July 2025, pointed to memorisation checks and to retraining or output filtering as ways to handle rights requests.

Portability is narrower. It covers data provided by the person and, where applicable, observed data that is structured. As a general rule it does not extend to inferred or derived data, "without this affecting their status as personal data."

Governance: assess, consult, or stop

Chapter VII sets out what the document calls algorithmic governance: allocation of responsibilities, risk management, human supervision, staff training and periodic review. Records of processing must identify, where relevant, "the attributes, profiles, inferences or classifications that the system generates or may reasonably generate." Where national law requires a data protection officer, that person must take part "from the initial phases" of AI processing and act "effectively and not merely formally."

Where required by law, a data protection impact assessment must be carried out before processing starts and before deployment, and revised when data, purposes, models, providers or risks change. The standards go beyond the legal minimum: they recommend an assessment "regardless of that requirement" whenever processing may pose a high risk, and efforts "shall be made to obtain" the views of affected groups where discriminatory effects are possible.

If an assessment identifies high risks that persist after mitigation, the controller must consult the competent data protection authority before starting processing or deploying the system, "or else refrain from initiating the processing," according to section 7.6. The same section lists processing that needs especially rigorous risk management, from social scoring, emotion recognition and remote biometric identification in public spaces to neurodata and "the mass reuse of personal data for the development or training of artificial intelligence systems."

Codes of conduct and certification schemes "may facilitate" compliance but "do not replace the responsibility" of the controller. Independent audits are recommended for high-risk processing. All documentation generated under the standards must be available to the competent data protection authority, under numeral 42.4 of the general Ibero-American standards.

Ten named threats

Chapter VIII is the most technical. Section 8.1 requires controllers to identify and keep updated a list of AI-specific threats relevant to their system. The document names ten: extraction of training data, model inversion, membership attacks, leaks through system instructions, exposure of vector representations, re-identification, memorisation, poisoning of training data, improper retrieval of information in retrieval-augmented generation systems, and prompt injection.

Where processing combines sources, "the risk of aggregation and re-identification must be assessed." Suggested controls range from access controls and encryption to filtering of inputs and outputs and limits on memorisation, tested after relevant system changes. Identification risk can be reduced through deduplication, reduced granularity, pseudonymisation, differential privacy or synthetic data, none of which exempts the controller from compliance.

Incident response procedures must integrate AI-specific vulnerabilities, "in particular those that may give rise to the disclosure, extraction or improper use of personal data or to the loss of its availability," with breach notification following the general regime.

Generative and agentic systems

For generative AI, section 9.1 requires specific measures "to avoid the unnecessary introduction of personal data, one's own or that of third parties, in the instructions" - the prompts. Controllers must define retention conditions for prompts and outputs and whether they may be used for training or model improvement. They must also prevent improper disclosure, retrieval or memorisation of personal data and verify results when outputs may be used to make decisions about people. Where processing includes developing or training models, controllers need "sufficient information on the origin of the data used."

Agentic AI receives the most prescriptive treatment in Chapter IX. When a system can autonomously access personal data or execute actions on it, the controller must set an admissible level of autonomy "so that the greater the significance of those effects, the lower the degree of autonomy and the more intense the supervision." The controller must also:

  • delimit the data, tools, services or resources the system can access
  • control persistent memories that retain or reuse personal data, subject to purpose limitation and retention limits
  • guarantee traceability of the system's actions, "including access to authorised resources and interactions with other systems, services or agents"
  • provide human oversight and mechanisms to suspend or interrupt actions, "which must be capable of being activated independently of the system itself"

Autonomous actions must stay within the purposes the controller has determined. Where an agent's action implies a new purpose, it needs a legal basis and, where appropriate, a compatibility check. "The autonomous action of the system neither exempts nor displaces the responsibilities that correspond to those who take part in the processing," according to section 9.2.

The direction matches other regulators' work. Spain's data protection authority mapped the GDPR risks of agentic AI in a 71-page guide published in February 2026, covering autonomy levels, prompt injection and memory. The Council of Europe's draft guidelines on large language model systems, dated August 26, 2026, are due before the Convention 108 committee's 51st plenary on November 17 to 19, 2026, without a committed adoption date. Agents that read customer records, send messages or change campaign settings would sit squarely within the Ibero-American rules on autonomy and interruption.

Biometrics, emotions and scoring people

Processing that combines AI with biometric techniques must distinguish verification, identification and other uses, applying reinforced guarantees where the data are special categories. Remote biometric identification and, where it involves personal data, emotion recognition or inference require "especially rigorous attention." In those cases controllers must be able to demonstrate "the suitability and reliability of the system for the purpose and context in which it is used." The preamble says criteria on these subjects will be read in line with "the evolution of available scientific knowledge on the reliability of such systems."

Emotion detection has already drawn enforcement attention in Europe. Italy's Garante issued a formal warning in May 2026 to Myndoor over a Slack plug-in that detected stress, citing Article 9 of the GDPR and Article 5(1)(f) of the AI Act.

Systems that evaluate, select, classify or prioritise people must include measures against discriminatory outcomes, transparency proportionate to their impact and, where applicable, the guarantees for automated individual decisions.

A region writing its own rules

The standards arrive as several jurisdictions in the Ibero-American space are rewriting their own laws. In Chile, a Senate committee approved on October 26, 2026 moving the start of Law 21.719 to October 15, 2027, along with a five-member board for the new regulator. Until that change becomes law, December 1, 2026 remains the start date. Colombia's third attempt at a new data protection law reached Congress in September. For Brazil, the EDPB adopted an opinion in November 2025 finding the LGPD closely aligned with the GDPR, and the ANPD's AI regulatory sandbox kept a participant that scored 45 of 100.

The standards do not address labelling of AI-generated content. That is the subject of Article 50 of the EU AI Act, whose transparency obligations have applied since August 2, 2026, after the Commission published a code of practice in July 2026, and of Commission guidelines on that article, which PPC Land covers separately. The Ibero-American document's transparency provisions concern something narrower: what controllers must tell people about the processing of their own data.

What the document leaves open

Several things are absent. The document carries no publication day, no list of member authorities and no record of the meeting or vote that approved it. It contains no worked examples, sector-specific cases or named products, a choice the preamble attributes to technology neutrality. It does not define who grants the "express authorisation" that allows a vendor to train on a client's data, though the context points to the controller. It sets no review date.

Most important, it has no enforcement mechanism of its own. Each provision applies "without prejudice" to national law, and the standards repeatedly defer to "the applicable legal system" on legal bases, territorial scope and the powers of authorities. Their weight will depend on whether national regulators cite them in guidance, investigations and decisions, and whether legislators draw on them.

Why it matters for marketing

For companies that process customer data in the region, the document is a single reference point for how regulators expect to read existing law once AI is involved. Three provisions carry the most weight for advertising: the default bar on vendors training their own models on client personal data, with anonymisation offering no shortcut; the treatment of inferred health, beliefs or sexual orientation as special category data, however accurate the inference and however the segment is labelled; and a transparency floor under which saying that "AI" or "algorithms" are used is not enough.

Will regulators in the region apply these readings? The document cannot answer that. It does put a common text in front of every authority that took part in drafting it.

Timeline

Summary

Who: The Red Iberoamericana de Protección de Datos (RIPD), the network of data protection authorities from the Ibero-American region. The standards address data protection authorities, legislators, controllers, processors and AI providers in the public and private sectors. The document was financed by the European Union through NextGenerationEU, in collaboration with FIAP, under the EU-LAC Digital Alliance.

What: A 29-page, non-binding set of standards on the use of personal data in AI systems. Its main positions: vendors may not use client personal data to train their own models without express authorisation and a legal basis; public accessibility does not by itself justify AI training; inferred health, beliefs or sexual orientation trigger the sensitive-data regime regardless of accuracy; human review must be real to avoid automated-decision rules; saying "AI is used" does not meet the duty to inform; and agentic systems need autonomy limits, traceability and an independent stop mechanism.

When: Published in November 2026. The document gives no day, no approval date and no review date.

Where: The Ibero-American region, covering Spain, Portugal and Latin America. The standards apply alongside national law and the network's general data protection standards for Ibero-American states, not in place of them.

Why: The network says AI's capacity to infer, predict and decide requires clarity on how existing data protection principles apply, and aims for a common interpretation across the region. For advertisers, the provisions on vendor training, inferred sensitive data and behavioural advertising aimed at vulnerable groups bear directly on how audience data and AI-powered marketing tools are used.