The Council of Europe's data protection committee today published a draft agenda confirming that its guidelines on privacy and large language models will go before the Bureau of the Convention 108 Committee on September 16 and 17, 2026, in Paris, setting up a path toward formal adoption at the November plenary. The agenda item sits alongside a companion document: a 34-page expert report, prepared by Isabel Barberá and Murielle Popa-Fabre and originally presented to the Committee's 48th Plenary meeting on June 17, 2025, that maps how personal data moves through chatbots, retrieval systems and increasingly autonomous AI agents. Together, the two documents give marketers, publishers and ad tech vendors operating in Europe the clearest picture yet of how a 45-year-old privacy treaty is being stretched to cover generative AI.

Convention 108, the Council of Europe's Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data, dates to 1981 and was modernized through an amending protocol known as Convention 108+. It is not an EU instrument. It sits alongside the General Data Protection Regulation as a separate treaty administered by the Council of Europe, a 46-member intergovernmental organization distinct from the European Union, though the two bodies coordinate closely on digital rights. The draft guidelines now moving through committee are explicitly interpretative: according to the draft text, they "neither create new rights nor impose obligations additional to those arising under" Convention 108+, but instead explain how existing principles apply to systems that did not exist when the treaty was drafted.

What the draft guidelines cover

The draft, circulated as document T-PD(2025)3rev4 and dated August 26, 2026, runs to more than 30 pages and addresses the full lifecycle of what it calls "LLM-based systems." That phrase is doing specific work in the text. The guidelines draw a hard line between a large language model itself, which the document defines as a machine-learning model trained on large quantities of text to predict sequences of tokens, and the broader system built around it, which can include system instructions, retrieval mechanisms, memory features, external tools and orchestration layers connecting multiple AI agents.

That distinction matters because, according to the guidelines, privacy risk cannot be assessed by looking at a model in isolation. A system's user interface, its access permissions, the tools it can call and the organizational context in which it operates all shape whether personal data is being processed lawfully, even when the underlying model never changes. The document states plainly that "the absence of personal data from the initial input or final output does not, in itself, establish that no processing of personal data takes place within intermediate operations or connected components."

The guidelines organize privacy risk across six lifecycle stages: model creation, post-training adaptation, system integration, operational deployment, significant modification, and decommissioning. Each stage carries distinct risks. During model creation, the concern is uncontrolled ingestion of personal data through large-scale training. During post-training adaptation, fine-tuning on task-specific data can amplify bias or repurpose information beyond its original context. System integration brings cross-context profiling risk when models are wired into retrieval-augmented generation setups or connected to external data sources. Deployment and user interaction bring the risk of memory functions retaining conversation history indefinitely, while decommissioning requires revoking credentials and permissions so that connected tools and services stop processing data once a system is retired.

Agentic systems get their own section

A substantial portion of the draft, Section VII, is dedicated specifically to agentic AI systems, meaning AI agents that can receive information from their environment, select a sequence of steps, invoke tools and take actions with varying degrees of human involvement. The guidelines are careful to note that agentic characteristics arise from how a system is configured at the deployment level, not from any special property of the underlying model, and that describing a system as an agent "should neither displace nor dilute or alter roles and responsibilities of data controllers and processors."

The practical recommendations for agentic systems are detailed. Controllers should maintain a documented inventory of every model, tool, memory store and data flow in a system. Each agent's credentials should be limited to what its assigned task requires and capable of being revoked without delay. Permissions to read data should be kept separate from permissions to create, modify, transmit or delete it. And before an agent takes an action capable of producing significant or irreversible effects, the guidelines call for a point of effective human review, one where the reviewer has genuine authority to pause, override or reverse the action rather than merely rubber-stamping it.

This lands at a moment when agentic advertising infrastructure is expanding rapidly across the industry PPC Land covers. UK regulators warned in March 2026 that agentic AI is already operating in production systems and that oversight frameworks were needed immediately rather than after deployment scaled further. Spain's data protection authority reached a similar conclusion earlier that year, publishing a guide that specifically flagged how uncontrolled agent access to email accounts, customer databases and HR records risks violating GDPR's data minimisation principle because an agent may draw on far more data than a given task requires. The Council of Europe's draft echoes that concern almost verbatim, warning against "open-ended access to entire mailboxes, drives, contact lists, databases or accounts" where narrower, task-limited access would suffice.

The memorization problem, in technical detail

The expert report accompanying the draft guidelines spends significant space explaining why personal data ends up trapped inside a trained model in the first place, and why removing it afterward is difficult. According to the report, when a model processes text, it converts words into numerical vectors called embeddings, which capture relationships based on how often words co-occur in training data. That mechanism has a direct privacy consequence: information that merely appears near a person's name during training, even by coincidence, can become statistically linked to that person inside the model.

The report illustrates the problem with a documented case from August 2024, in which a German journalist who had spent years covering criminal trials found that Microsoft's Bing Copilot chatbot falsely described him as connected to the crimes he had reported on. The journalist's name had appeared repeatedly in articles about those cases, and the model's internal associations mistook proximity in the training text for a factual link. The report frames this as a structural risk rather than an isolated glitch: any name that repeatedly co-occurs with sensitive content in training data can accumulate similar spurious associations.

The report also details empirical research on training data extraction, the practice of recovering verbatim text that a model memorized during training by crafting specific prompts. Citing research from Carlini et al., the report notes that a sequence appearing ten times in a training dataset is reproduced by the model, on average, roughly 1,000 times more often than a sequence that appeared only once. A separate study cited in the report found that repeating certain words, such as "poem" or "company," in a prompt designed to make a model diverge from normal output caused it to emit memorized training data up to 164 times more frequently than repeating a more neutral word like "know." The report states that extracting personal information such as email signatures through this technique required computation costing roughly $200, a figure it presents as evidence that the barrier to this kind of extraction is now low.

Mitigation strategies exist but each has documented limits, according to the report. Deduplicating training datasets reduces memorization but has recently been shown to introduce its own security side channels. Reducing the size of a model's context window limits memorization but also constrains the retrieval-heavy applications increasingly common in enterprise deployments. Filtering memorized sequences out of model output before it reaches a user is, per the report, "ineffective at preventing training data leakage" because the filtering can be circumvented by prompts specifically designed to extract memorized information. The report notes a broader industry shift toward smaller, on-device language models as one avenue that could reduce reliance on cloud APIs, pointing to Google's move in May 2025 to make small language models downloadable directly onto smartphones as an early example of that trend.

Regulatory lineage: this builds on the EDPB's 2025 report

The Council of Europe's expert report does not stand alone. It draws explicitly on the European Data Protection Board's earlier work in the same area. PPC Land reported in April 2025 on the EDPB's landmark report on privacy risks and mitigations in large language models, also authored by Isabel Barberá through the EDPB's Support Pool of Experts programme and published on April 10, 2025. That earlier document proposed a risk management methodology built around three illustrative use cases: a customer service virtual assistant, a system for monitoring student progress, and a travel-planning AI assistant. The Council of Europe's newer report, co-authored by Barberá and Murielle Popa-Fabre, extends that foundational work with additional technical detail on mechanistic interpretability, agentic systems and stakeholder interview findings, while explicitly citing the EDPB report as a source for its proposed lifecycle risk management framework.

The relationship between the two documents reflects a broader pattern of regulatory cross-referencing across European data protection bodies during 2026. The EDPB adopted Guidelines 03/2026 on web scraping in the context of generative AI on July 7, 2026, establishing a three-condition legitimate interest test that AI developers must satisfy before scraping personal data for training. The Council of Europe's draft guidelines address the same underlying tension around legitimate interest as a legal basis, stating that public availability of data "does not automatically create a legal basis for the processing" and that organizations relying on legitimate interest must demonstrate the lawfulness of the pursued interest, the necessity of the processing and its proportionality against the rights of the individuals affected.

Stakeholder interviews reveal uneven practices

Section 5 of the underlying expert report documents findings from interviews and questionnaires conducted with organizations across the LLM ecosystem, including model developers, system integrators, red-teaming firms, regulators, start-ups and research institutions. Six organizations agreed to be named: Cybernetica, KPN, Safer AI, HackAPrompt, Capgemini and Quivr. Most participants requested anonymity.

The findings, presented in the report as eight numbered observations, describe a landscape where privacy risk management practices vary sharply by organizational size and maturity. According to the report, several private-sector actors, including both start-ups and larger technology companies, tend to equate infrastructure and data security with the broader legal concept of privacy and data protection, a conflation the report identifies as a structural weakness. The report also found that organizations struggle to apply data protection principles consistently during experimentation phases, when production data is sometimes used without adequate safeguards, and that repurposing existing user data to justify the business case for LLM adoption increasingly conflicts with the "legitimate interest" legal basis as use cases scale beyond the original purpose for which data was collected.

On technical mitigation, the report is blunt: "The ecosystem has not reached the maturity of using" privacy-enhancing technologies. Only a limited number of organizations interviewed made even partial use of differential privacy or synthetic data, and trusted execution environments were reported as being used almost exclusively during experimentation, primarily to protect model weights rather than personal data. Risk prioritization was described as rarely formalized, with several stakeholders reporting that they moved directly to mitigating identified risks without a structured process for first estimating the likelihood or severity of those risks.

What the guidelines would require of controllers

Beyond the diagnostic material, the draft guidelines lay out specific recommendations addressed separately to data controllers, to processors, and to policymakers. For controllers operating agentic systems, the guidelines call for testing the complete deployed system, not merely the underlying model, before launch and after any significant change, covering scenarios including prompt injection attempts, unauthorized data extraction, and cascading errors between multiple agents. Organizations are also expected to maintain operational records detailed enough to trace and reconstruct a sequence of actions, while keeping those records proportionate and subject to their own access controls and retention limits.

The guidelines are explicit that an AI model's internal reasoning traces, the intermediate text some systems generate while working through a problem, should not be treated as a reliable audit record. According to the draft, such traces "should not be regarded as a reliable audit record or, in themselves, as sufficient to provide the knowledge of the reasoning underlying data processing" that Convention 108+ requires organizations to be able to explain to individuals who ask how a decision about them was made.

For transborder data flows, a live issue given how much AI infrastructure runs through cloud providers outside Europe, the guidelines direct organizations to assess, transfer by transfer, whether the legal and technical environment of a data recipient can sustain an adequate level of protection, and point toward the Council of Europe's own Model Contractual Clauses as one available mechanism.

Why this matters for advertising and marketing

For PPC Land's readership, the draft guidelines land at a moment when generative AI and agentic systems are moving from experimental tools into core advertising infrastructure. Platforms are shipping AI agents capable of managing campaigns, and PPC Land has tracked how governance postures diverge sharply across ad tech vendors, with some connectors granting AI agents write access to modify live campaigns while others restrict access to read-only queries. The Council of Europe's insistence that permissions to read data be kept distinct from permissions to create, modify or delete it maps directly onto that divide, and organizations that have already granted broad write access to AI agents may find themselves needing to retrofit the narrower, task-scoped permissions the guidelines recommend.

The guidelines' treatment of memory features carries similar weight for marketing technology built around personalization. Systems that retain conversation history to improve continuity or tailor future responses, a design pattern common across AI-powered customer service and increasingly across conversational commerce, fall squarely within the guidelines' scope. The draft calls for persistent memory to be disabled by default unless continuity serves a specified purpose with appropriately mitigated risk, and for organizations to be able to locate, correct and delete personal data held across every layer of memory a system uses, including caches and vector stores, not just the primary conversation log.

The timing also intersects with the EU AI Act's own transparency regime. Article 50 of the AI Act became legally applicable on August 2, 2026, requiring labeling of AI-generated content and disclosure obligations for both providers and deployers. The AI Act and Convention 108+ are separate legal instruments with separate enforcement mechanisms, but both now apply concurrently to many of the same AI-powered marketing systems, adding to the layered compliance picture that legal and privacy teams at agencies and platforms must track.

What happens next

The draft guidelines are scheduled for discussion at the Bureau meeting in Paris on September 16 and 17, 2026, where the rapporteur, Anamarija Mladinić, will present alongside the Secretariat. According to the annotated agenda, the Bureau's required action at that meeting is to take note of the presentations, hold an exchange of views, and decide on necessary follow-up, a formulation that leaves room for further revision before the text reaches the full Consultative Committee. The agenda lists the 51st Plenary meeting, scheduled for November 17 to 19, 2026, as the next full committee gathering, and the guidelines' adoption timeline points toward that session, though the annotated agenda does not commit to adoption on a specific date.

The expert report underpinning the guidelines recommends that the Council of Europe move next toward a piloting phase, testing the proposed lifecycle risk management framework with a mix of regulators, industry developers and civil society partners across five stages: model creation, post-training adaptation, system integration, operational deployment and end-user interaction. That pilot has not yet been scheduled as of this writing.

Timeline

  • January 1, 1985: Convention 108, the Council of Europe's original data protection treaty, enters into force following its 1981 signature.
  • February 2025: The EDPB's initial report on LLM privacy risks is submitted by expert Isabel Barberá.
  • April 10, 2025: The EDPB publishes its landmark report on privacy risks and mitigations in large language models, authored by Barberá through the Support Pool of Experts programme.
  • May 2025: Google begins making small language models downloadable for local, on-device deployment on smartphones, according to the expert report.
  • June 17, 2025: The Council of Europe expert report on privacy and data protection risks in LLMs is presented to the Consultative Committee's 48th Plenary meeting.
  • July 7, 2026: The EDPB adopts Guidelines 03/2026 on web scraping in the context of generative AI, a framework the Council of Europe's draft guidelines cite as related work.
  • August 2, 2026: Transparency obligations under Article 50 of the EU AI Act become legally applicable, a separate but concurrent compliance regime for AI-generated content.
  • August 26, 2026: The draft Guidelines on Privacy and Data Protection in the context of LLM-based systems, document T-PD(2025)3rev4, are dated for circulation.
  • September 2, 2026: The Council of Europe publishes the draft annotated agenda for the 66th Bureau meeting confirming the guidelines' review date.
  • September 16-17, 2026: The Bureau of the Consultative Committee is scheduled to review the draft guidelines in Paris.
  • November 17-19, 2026: The 51st Plenary meeting is scheduled, marking the next full committee session following the Bureau's review.

Summary

Who: The Council of Europe's Consultative Committee of Convention 108, together with expert authors Isabel Barberá and Murielle Popa-Fabre and rapporteur Anamarija Mladinić, alongside stakeholders including Cybernetica, KPN, Safer AI, HackAPrompt, Capgemini and Quivr who contributed to the underlying research.

What: Draft guidelines on privacy and data protection in the context of large language model-based systems, interpreting how Convention 108+ applies across the AI lifecycle, from training data collection through agentic AI deployment and decommissioning, accompanied by a 34-page expert report documenting memorization risks, extraction techniques and stakeholder interview findings.

When: The draft guidelines are dated August 26, 2026, and are scheduled for Bureau review on September 16 and 17, 2026, with the annotated agenda confirming this timeline published September 2, 2026. The underlying expert report was presented to the Committee's plenary on June 17, 2025, building on an EDPB report published April 10, 2025.

Where: The guidelines apply across the 46 member states of the Council of Europe and other parties to Convention 108+, a treaty separate from but complementary to the EU's GDPR and AI Act.

Why: As generative AI systems, memory features and autonomous AI agents become embedded in advertising, customer service and marketing infrastructure, the guidelines aim to close a gap between abstract privacy principles written in 1981 and the technical realities of systems that memorize training data, act autonomously through tools, and blur the line between a model's internal workings and the applications built around it.