Contextual integrity is a theory of privacy which holds that a flow of personal information is acceptable when it matches the norms of the setting in which it occurs, and a violation when it breaks them. It was developed by Helen Nissenbaum, now a professor of information science at Cornell Tech, to explain something older definitions could not: why people object to uses of data that was never secret. A diagnosis passing from patient to doctor is expected; the same diagnosis reaching an advertising network is not, although the fact has not changed. Locating the harm in the flow rather than the data has made it the reference framework for deciding what AI agents and ad systems may share.

How the framework works

The theory rests on four claims, as summarised in the standard reference sources: privacy concerns appropriate flows of information; appropriate flows are those that conform with contextual informational norms; those norms have five independent parameters; and conceptions of privacy rest on ethical concerns that change over time.

The five parameters describe any flow:

  • Data subject - the person the information is about, such as a patient, shopper or reader.
  • Sender - who passes the information on, such as a doctor, bank or website.
  • Recipient - who receives it, such as a family member, the police or an advertising network.
  • Information type - what is passed, such as purchase history, location or the contents of a message.
  • Transmission principle - the condition attached to the flow, such as confidentiality, consent, notice, reciprocity, purchase, a warrant or a legal mandate.

All five must be specified before a privacy judgment can be made. "Is location data sensitive?" has no answer in the theory. "May a navigation app sell a user's precise location to a data broker without notice?" does, and changing one parameter can flip the verdict: the same location sent to an emergency service under a legal duty conforms to a different norm.

Contexts are social domains with their own purposes and values, such as healthcare, finance, education and the marketplace. The theory is not purely descriptive. Once a new flow is found to depart from existing norms, Nissenbaum's method asks a second question: whether the departure serves or undermines the ends and values of that context. That evaluative step separates contextual integrity from a simple measure of what users happen to expect.

A worked example from advertising shows the mechanics. A shopper (data subject) buys pregnancy tests at a retailer (sender). Inside the retail context, using the purchase to manage stock or process a refund matches the norm. A flow of the same purchase record (information type) to an ad network (recipient) for sale (transmission principle) changes two parameters at once, and the theory flags it whether or not a privacy policy disclosed it.

Origin and evolution

Nissenbaum set out the idea in "Privacy as Contextual Integrity", published in the Washington Law Review in 2004 (volume 79, page 119). That version described two kinds of norms, norms of appropriateness and norms of distribution. Her book Privacy in Context: Technology, Policy, and the Integrity of Social Life, published by Stanford University Press, gave the theory its five-parameter form. Sources disagree on its date: Wikipedia's article on the theory cites 2010, its biography of Nissenbaum gives 2009, and the October 2026 Google-led report cites 2009 while calling the 2004 article an older version of the theory.

In 2006, Adam Barth, Anupam Datta, John Mitchell and Nissenbaum presented a formal logic for expressing contextual norms at the IEEE Symposium on Security and Privacy and used it to encode privacy provisions of the Gramm-Leach-Bliley Act.

Policy followed in 2012. The White House Consumer Privacy Bill of Rights, published on February 23, 2012, included a "Respect for Context" principle stating that consumers have a right to expect companies to collect, use and disclose data in ways consistent with the context in which they provided it. The Federal Trade Commission's March 2012 report, "Protecting Consumer Privacy in an Era of Rapid Change", used the word context "an astounding 85 times", according to Alexis Madrigal, writing in a March 30, 2012 piece on Nissenbaum's influence on the agency. Neither became law.

Empirical work then tested the theory. Kirsten Martin and Nissenbaum's "Measuring Privacy", dated December 2015, ran a factorial vignette survey of 569 respondents that varied recipient and use. According to the authors, whether a flow met privacy expectations was "highly dependent on these contextual elements", while Alan Westin's widely used categories of privacy concern "proved relatively unimportant".

Nissenbaum also took the argument to the ad stack. With Daniel Howe and Mushon Zer-Aviv she built AdNauseam, a 2014 browser extension that hides ads and clicks on them in the background to pollute tracking profiles. Google removed it from the Chrome Web Store and flagged it as malware, The Register reported on January 5, 2017.

Application to AI agents

Large language model (LLM) agents gave the theory a second life. An agent that reads a user's inbox and files, then fills in forms or messages third parties, must decide flow by flow what each recipient should receive.

Google DeepMind researchers led by Sahra Ghalebikesabi published "Operationalizing Contextual Integrity in Privacy-Conscious Assistants" on August 5, 2024, reporting that prompting frontier models to reason through the five parameters "yields strong results" on a form-filling benchmark. A team led by Guangchen Lan followed in May 2025 with a reinforcement learning method trained on about 700 synthetic examples, which according to the authors cut inappropriate disclosure while keeping task performance.

Measured failure rates remain high. AgentSCOPE, a benchmark posted by Ivoline Ngong and colleagues on March 5, 2026, annotated each step of 62 multi-tool workflows with the five parameters and found violations in more than 80% of scenarios across seven models; in 24% of cases the final output looked clean. "Capable but Careless", by Anmol Goel and Iryna Gurevych, accepted to the EMNLP 2026 conference, tested 15 computer-use agents and found 11 leaked in more than half of scenarios, with average leakage of 67.9%.

Industry and standards bodies have adopted the vocabulary. MLCommons' draft Agent Privacy Risk Taxonomy, released on October 1, 2026 with 25 risk vectors, builds on Nissenbaum's theory alongside Daniel Solove's taxonomy and NIST frameworks. Four days later, a report by 65 researchers, 36 of them at Google, proposed a "contextual policy engine" that would allow, deny, modify or escalate each agent action, and argued that consent alone cannot govern agents that act continuously.

Why it matters for marketers

Contextual integrity explains a pattern familiar from privacy enforcement: complaints often concern data the user handed over willingly, used somewhere they did not expect. The theory gives that intuition a structure that regulators, courts and engineers increasingly share. It also shifts attention from what data a company holds to where it sends it, the core question in clean rooms, retail media data sharing and AI assistants.

European law contains a related test without naming the theory. Article 6(4) of the General Data Protection Regulation (GDPR) requires a controller assessing a new purpose to consider "the context in which the personal data have been collected", and Recital 47 ties legitimate interests to the "reasonable expectations of data subjects based on their relationship with the controller". On September 17, 2026, the Regional Court of Cologne rejected Snap's claim that ads selected from My AI chatbot prompts were merely contextual, holding that processing the prompt text engaged Article 9. In contextual integrity terms, the dispute was over whether a conversation with an assistant can flow to an ad system at all.

Limitations and criticisms

The most persistent objection is conservatism. If appropriateness is measured against existing norms, entrenched practices, including harmful ones, can look legitimate; Nissenbaum's answer is the evaluative step against a context's values, though critics say that step is underspecified. Contexts also overlap, and online services rarely sit in one.

Mihailis Diamantis of the University of Iowa made a sharper legal case in an article for Business Ethics Quarterly, published online on October 27, 2025. He argued that "contextual integrity is dangerous precisely because of the complexity and sociality that draw so many scholars to it", because in adversarial litigation those features favour the well-funded repeat player, usually the company.

Within AI research, Yan Shvartzshnaider and Vasisht Duddu argued in a January 2025 position paper that much LLM work "inadequately applies CI" by reducing it to labelling outputs as private or public. Sahar Abdelnabi and Eugene Bagdasarian went further on May 17, 2026, claiming that "an adversary can always construct a context under which a blocked flow appears legitimate", which casts prompt injection as an attack on the agent's reading of context.

Not the same as

Contextual advertising selects ads from the content of a page or app rather than from a profile of the person. It shares the word but not the meaning; contextual integrity is a theory for judging data flows and would apply to contextual ads only where user data enters the decision.

Data integrity is an information security property: data remains accurate, complete and unaltered. GDPR Article 5(1)(f) pairs it with confidentiality as a security principle. It says nothing about whether a flow is appropriate.

Purpose limitation, in GDPR Article 5(1)(b), requires data to be collected for specified purposes and not processed incompatibly. It is the closest legal relative, but it is anchored in the controller's stated purpose rather than in social norms.

Recent developments

The Council of Europe's draft guidelines on privacy and LLM-based systems, document T-PD(2025)3rev4 dated August 26, 2026, include a section on agents and are due before the Convention 108 committee's plenary on November 17 to 19, 2026, with no committed adoption date. Spain's regulator, the AEPD, published a 71-page guide on agentic AI in February 2026.

The October 5, 2026 Google report remains a research agenda with 51 open problems and no experimental results.

Timeline

  • 2004 - Helen Nissenbaum publishes "Privacy as Contextual Integrity" in the Washington Law Review (volume 79).
  • 2006 - Barth, Datta, Mitchell and Nissenbaum present a formal logic for contextual integrity at the IEEE Symposium on Security and Privacy.
  • 2009 or 2010 - Stanford University Press publishes Privacy in Context (sources differ on the year).
  • February 23, 2012 - White House Consumer Privacy Bill of Rights includes a "Respect for Context" principle.
  • March 2012 - FTC publishes "Protecting Consumer Privacy in an Era of Rapid Change".
  • 2014 - AdNauseam browser extension released by Howe, Zer-Aviv and Nissenbaum.
  • December 2015 - Martin and Nissenbaum complete "Measuring Privacy" (569 respondents).
  • January 5, 2017 - Google's removal of AdNauseam from the Chrome Web Store is reported.
  • August 5, 2024 - Google DeepMind-led paper on operationalising contextual integrity in AI assistants.
  • January 31, 2025 - Shvartzshnaider and Duddu argue the theory is inadequately applied to LLMs.
  • October 27, 2025 - Diamantis publishes "The Danger of Contextual Integrity".
  • Late 2025 - Google's Contextual Agent Privacy and Security workshop held in New York City.
  • February 2026 - AEPD publishes its guide on agentic AI and data protection.
  • March 5, 2026 - AgentSCOPE benchmark posted.
  • May 17, 2026 - Abdelnabi and Bagdasarian recast prompt injection through contextual integrity.
  • June 22, 2026 - "Capable but Careless" benchmark of 15 computer-use agents posted.
  • August 26, 2026 - Council of Europe draft LLM privacy guidelines dated.
  • September 17, 2026 - Regional Court of Cologne rules on Snap's use of chatbot prompts for ads.
  • October 1, 2026 - MLCommons releases draft Agent Privacy Risk Taxonomy.
  • October 5, 2026 - Google-led report by 65 researchers proposes contextual policy engines for agents.
  • November 17-19, 2026 - Convention 108 committee plenary scheduled.

Summary

Who: Developed by Helen Nissenbaum of Cornell Tech, formalised with computer scientists including Adam Barth, Anupam Datta and John Mitchell, and now used by AI researchers at Google, Google DeepMind and universities, by MLCommons, and by privacy regulators and scholars.

What: A theory that defines privacy as appropriate information flow, judged against context-specific norms described by five parameters: data subject, sender, recipient, information type and transmission principle.

When: First published in 2004, set out in full in Privacy in Context (2009 or 2010), reflected in US policy documents in 2012, and applied to AI agents from 2024, with a wave of agent benchmarks and frameworks through 2026.

Where: In academic privacy law and computer science, in US policy debates, in agent design and evaluation work, and indirectly in GDPR tests that weigh the context of collection and reasonable expectations.

Why: It explains why sharing data that was never secret can still be a violation, and it gives designers of ad systems and AI agents a test for each flow that does not depend on consent alone.