Fewer than half of the AI assistants and agent platforms examined in a new academic audit document a way for people to stop their data being sold or shared for advertising. Seven researchers from Wesleyan University, the University of California San Diego, Stanford, Carnegie Mellon and Villanova counted 788 privacy settings and actions across 30 products from 18 companies, and found that only 14 of 29 applicable products offer that opt-out. The findings appear in a 27-page preprint, "Privacy Preference Controls for Agentic Systems," whose second version was posted to arXiv on October 22, 2026.

The paper goes further than a census of settings menus. It proposes a five-part taxonomy of the privacy choices people should be able to make once software agents act on their behalf, and it ships eight open-source prototypes that pass a privacy signal through the Model Context Protocol and the Agent2Agent protocol, the two plumbing standards most AI companies now use. Its central technical finding is blunt. "We note that there are no privacy preference-related fields in existing agentic protocols," the authors write.

In Short

Researchers checked 30 AI chatbots and agent tools to see which privacy switches people actually get, and found that fewer than half let you stop your data from being shared for advertising. That matters because AI agents increasingly hand your information to other agents, websites and ad systems you never see, and the technical rules those agents follow have no slot for a "do not share" message. The team built eight test systems showing that such a message can travel along without making the agents less useful, but nothing in the paper obliges any company to adopt it.

Who wrote it, and what they asked

The authors are Shreya Kochar and Deepak Kumar of UC San Diego, Peeranat Sugsavanvit and Sebastian Zimmeck of Wesleyan University, Vidur Gupta of Stanford University, Joseph A. Calandrino of Carnegie Mellon University and Brett Frischmann of Villanova University. Kochar and Zimmeck are the corresponding authors. Zimmeck is also listed among the authors of the W3C editor's draft specification for Global Privacy Control, the browser signal at the center of the paper, and he was lead author of a peer-reviewed study published in May on whether GPC could reduce EU consent banners.

The paper is a preprint. Its own footer records it as received on October 20, 2026, with revision and acceptance both marked "TBD," which means no journal or conference has yet accepted it.

The starting point is a shift the authors describe in their abstract: "the web is undergoing a seismic shift, away from strictly user-driven behavior towards agentic behavior, where AI agents take autonomous actions on behalf of users." From there they ask three questions. Which privacy controls should people be able to express and have respected in agentic systems? What legal and technical obstacles stand in the way? And, in the wording of the third question, "How can we structurally integrate privacy preference controls into agentic systems, especially, as such systems interact with the web and online ad ecosystem?"

That last clause is not decoration. Advertising runs through the whole document. The introduction notes that "AI companies have already started integrating ads to generate revenue," citing OpenAI's test of ads in ChatGPT and Microsoft's Copilot Checkout and brand agents, and that "AI systems are freely participating in third-party tracking."

The authors also state their position openly. They set their work "in contrast with the current practice of data maximization on the web and the surveillance capitalism that it supports," and treat data minimization as "a legally enforceable default from which exceptions should be allowed only when demonstrably informed consent exists." Readers should take the taxonomy as a normative proposal built on that premise, not as a neutral description of what the law already requires.

788 controls across 30 products

The audit sample was assembled from public rankings. The researchers took the ten largest technology companies from three 2026 rankings (CompaniesMarketCap, the Forbes Global 2000 and the Fortune Global 500), the ten most valuable companies on the 2026 Forbes AI 50 list, and then added xAI and DeepSeek because their chatbots appeared in Comscore's March 2026 ranking of US desktop AI chatbots by unique visitors. That produced 22 companies. Four had no product to audit: TSMC, SK Hynix (whose agent framework is internal only), Safe Superintelligence and Skild AI. The remaining 18 companies contributed 30 products.

The list runs from consumer apps to developer platforms. OpenAI is represented by ChatGPT, its dots agent and the OpenAI API; Anthropic by the Claude apps, the Claude API and Claude Code; Google by the Gemini app, Gemini in Workspace and Chrome, and the Gemini API and Vertex AI; Microsoft by the Copilot app, Copilot in Microsoft 365 and Windows, and Microsoft Foundry. Meta AI, Apple Intelligence and Siri, Samsung Galaxy AI and Bixby, Perplexity and its Comet browser, Grok, Le Chat, DeepSeek, Databricks Agent Bricks, Sierra, Tencent Yuanbao, Broadcom Tanzu AI and several others complete it.

Data collection took place in October 2026. According to the paper, "One author used an LLM (Claude Opus 5.5) to retrieve candidate pages," following a design in which one agent collects documentation unattended and a second agent independently re-checks each page. The authors then manually reviewed every page and added pages where the automated collection missed a product's settings. They also used the LLM to sort the controls into categories, ran that step twice to check stability, and reconciled the differences by hand.

The count of documented controls varies widely by product. Databricks Agent Bricks led with 51, followed by the Microsoft Copilot app with 49 and ChatGPT with 48. Samsung Galaxy AI and Bixby had 39 and the Claude apps 38. DeepSeek had the fewest, with nine. A higher count does not mean better privacy; it means more documented switches, some of which govern marketing emails or data exports.

Of the 788 settings and actions, 567, or 72%, fit one of the taxonomy's subcategories. Another 21, or 3%, only set how long data is kept. The remaining 200, or 25%, fell outside the taxonomy's scope. Deletion controls account for 73 of those 200, because the taxonomy covers future processing rather than data already collected.

Where the gaps are

Three numbers stand out in the authors' reading. Only 14 of 29 products offer an opt-out of sale or sharing for advertising, including GPC. Only 7 of 29 let users opt out of analytics or product-improvement use. And only 6 of 30 let users opt out of human review, meaning employees, contractors or third-party reviewers reading, listening to or viewing what people submit. "These findings are particularly concerning as tracking technologies in conversational AI are proliferating," the paper states.

The appendix tables fill in the rest of the picture. Opt-outs of ad personalization appear in 10 of 23 applicable products. A way to turn an AI feature off altogether exists in 18 of 22. Model-training opt-outs appear in 18 of 29, memory controls in 18 of 28, and controls over which connectors and third parties receive data in 18 of 30. The most common agent-specific controls are limits on which apps, sites, files and networks an agent can reach, found in 21 of 28 products, and approval requirements before an agent acts, found in 19 of 28. At the other end, only 4 of 18 applicable products let users limit screen and activity capture, and 7 of 30 let users filter or mask sensitive data.

Defaults are another weak spot. Only 40% of the settings and actions document what state they are in by default. For opt-outs that must be exercised by request to the company, the share falls to 19%.

The audit has clear limits, which the authors spell out. "We note that our audit captures the controls companies document, not whether they work as described," they write. Controls behind a login or under enterprise contracts may not have been visible. The researchers viewed everything from the United States, so controls offered only in other jurisdictions, including the European Union, may be missing. And the LLM-assisted retrieval may have missed documentation despite the manual checks.

Temporary modes that keep data

Several products offer controls that exist but fall short of the taxonomy's definitions. Under the input-collection preference, submitted data should be discarded once a task no longer needs it. Yet according to the paper, Claude's incognito chats are kept for 30 days, Gemini's temporary chats for 72 hours and Perplexity's incognito threads for 24 hours, each figure drawn from the companies' own help pages.

The autonomy category produces a similar example. The taxonomy holds that an agent should not start a task on a user's behalf by default. The authors point out that Claude Code "now starts interactive sessions in a mode where a classifier, rather than the user, approves actions."

Legal and contractual carve-outs further narrow what any switch can deliver. The paper cites three. OpenAI may keep deleted chats beyond its 30-day deletion window when legal obligations require it. Google keeps all Gemini API prompts and outputs for 55 days to detect policy violations. And even with Gemini's Keep Activity setting turned off, a user who submits feedback also gives Google the last 24 hours of chats, which Google may use to improve Gemini. "Thus, how much protection a privacy preference control provides ultimately depends on laws and regulations," the authors conclude.

Five categories for an agent's lifecycle

The taxonomy is organized around the sequence of an agentic task, from whether an agent should be present at all to how much it may decide alone.

Presence (category A) covers whether an AI agent may be in a user's computing environment. It splits into an integration preference, under which agents may not be added "without genuine user consent," for example through features switched on during a software update, and an activation preference, under which agents may not run in the background or ambiently unless the user chose that.

Collection (category B) separates input a user knowingly submits from metadata a user produces without knowing it, such as which options they hover over, how long a task takes, what text they delete before sending a prompt or where they are located. A further subcategory covers the record an agent creates of its own work, such as which other agents it contacted and when. Under the authors' minimization baseline, data is retained only for the task and deleted once no longer needed, unless law requires otherwise.

Secondary use, repurposing, sharing and human review (category C) is where advertising enters directly. Any use beyond the requested task requires an explicit preference. The subcategories cover targeting, meaning "what content, options, or offers the user is shown"; inference of user attributes for personalization; and "commercial and analytical use," under which data may be "sold, licensed, or used for advertising, measurement, or analytics." Model training is treated separately, as is sharing along a chain of connected agents, and human review by the provider's staff or contractors.

Persistence (category D) addresses agents that stay around after a job is done. Users could require an agent to leave once its task ends, to stay but not start anything unprompted, or to stay active but not expand into new applications, devices or domains. The three form a hierarchy.

Autonomy (category E) lets users sort tasks into tiers, for example by data sensitivity or whether an action can be reversed, and decide which tiers an agent may handle alone. When the user is unavailable, the agent defaults to surfacing the decision or declining. "The agent does not have autonomy to express preferences on behalf of the user," the paper states.

Advertising sits at the center of the argument

The paper's first figure contrasts two pictures. On the open web, the browser is a single point at which a user's preference, for instance the header Sec-GPC: 1, can be attached to every outgoing request. In an agentic system, user data crosses several hops of delegation. In the authors' travel example, an orchestrator such as ChatGPT reads the user's calendar through an MCP server, reads a travel agent's published "Agent Card," and hands the booking to that agent through A2A. The travel agent then passes the user's name and dates to a hotel agent and a booking system. The user typically knows only the first point of contact.

"Just as social networks moved outwards over the past two decades, we expect agentic platforms to do the same," the authors write.

They also argue that emerging advertising protocols will inherit whatever MCP and A2A carry, or fail to carry. The paper names the Ad Context Protocol, which launched in October 2025 with six founding members, the Universal Commerce Protocol, which Google launched on January 11, 2026 with Shopify, Etsy, Wayfair, Target and Walmart, and agentic real-time bidding protocols such as the IAB Tech Lab framework released for comment in November 2025. If the base protocols have no field for a privacy preference, those built on top start without one too.

How the ChatGPT pixel figures in

The paper uses ChatGPT as its worked example of an AI platform reaching into the wider ad ecosystem. OpenAI describes ad selection in ChatGPT as a vendor-internal system and says advertisers receive neither raw conversation content nor memories, according to the paper. That matches what OpenAI told the market when it said in January it would test ads in ChatGPT.

Advertisers can, however, install OpenAI's measurement script to send page views and purchase events back to OpenAI. The OpenAI Ads Measurement Pixel launched on May 5, 2026, days after an April 30 privacy policy update stated that OpenAI may receive information from advertisers. Citing observations published by a threat-intelligence blog, the paper says that on Chrome for Android, OpenAI "could link this activity to ChatGPT accounts for signed-in users or device identifiers for logged-out users" through a cookie named __obi, set by bzr.openai.com and scoped to .openai.com. The wording is conditional: the paper reports a capability suggested by outside observations, not a finding that such linking takes place. "This integration illustrates the broader trend," the authors write. "AI platforms are extending their reach beyond their internal boundaries to encompass the traditional online ad ecosystem."

The section leans on recent academic measurement. Researchers at IMDEA Networks found that 6 of 9 AI chatbot web clients passed conversation titles, links, prompts or screenshots to third parties. The new paper summarizes that tracking pixels, software development kits, persistent identifiers and server-side forwarding "now operate inside conversational AI services, passing prompts, generated titles, and conversation permalinks to third parties whose business models rely on advertising."

MCP dominates, and neither protocol has a privacy field

The researchers also recorded which agent protocols each company uses. Of the 22 companies, 16 use MCP and five use A2A in their own products. Counting partner platforms and third-party packages, 18 support MCP and 12 support A2A, although the authors say three of the A2A cases, Apple, Meta and Databricks, "rest on minimal evidence." A2A is the only agent-to-agent protocol used by more than one company. Anthropic, OpenAI, xAI and DeepSeek do not use A2A in their own products, but their models run in A2A agents on partner platforms such as Amazon Bedrock AgentCore and Microsoft Foundry.

The protocol tables in the appendix show how fragmented the layer above MCP has become. Google created A2A, co-created UCP and WebMCP, created the Agent Payments Protocol and is testing Web Bot Auth. Microsoft co-created WebMCP and created NLWeb. OpenAI co-created the Agentic Commerce Protocol and created AGENTS.md. Anthropic created MCP and Agent Skills. Apple uses MCP and, according to the table, opposes WebMCP through a WebKit position. Meta sits on the UCP council.

None of those protocols has a standard place to put a privacy preference. For the prototypes, the team used the general-purpose "meta" field that both MCP and A2A provide and designed its own way of propagating the signal. The authors point to MCP Interceptors, control points that observe, filter or modify traffic and are being standardized by a working group, as a core building block for enforcement.

Eight prototypes, same answers

The prototypes, published on GitHub under the privacy-tech-lab account, cover travel planning, medical questions, productivity tasks, product research, web search, email editing, general questions with memory, and travel booking. Each runs once without a preference and once with GPC propagated as the example signal. In most, the user receives the same answer either way.

In the medical example, a patient asks what a blood pressure reading means. Without a preference, the conversation feeds an analytics log, a model-training dataset and an external pharmaceutical advertising platform. With the preference set, all three secondary uses stop, and each can be switched off separately, for example blocking ads while allowing analytics.

The web search prototype runs eight ordinary queries, including metformin side effects, SNAP benefits and signs of anxiety. None hands over personal data directly, yet without a preference a classifier builds a profile covering health, money, housing, mental health and job status. With the opt-out, "the inferences are still computed but not kept." An implementation note elsewhere in the paper makes the limit explicit: "Blocking only its profile write prevents storage, not inference."

The email prototype separates three kinds of data. A user polishing a pay-rise email deletes a sentence about treatment costs, pauses for 42 seconds on the salary line and rewrites the opening three times. The draft, the editing telemetry and the inferences drawn from both each get their own blocker.

The booking prototype tests autonomy. A weekend trip involves six actions, from searching flights to buying a non-refundable ticket and sending passport details to an airline, while the platform also switches on fare tracking and a newsletter sign-up on its own. Without a preference, the platform's default tiers count as consent and four of the six actions run without the user's approval. With the preference, the agent must ask first, and if the user does not answer, it declines rather than assuming approval.

The publisher test

The fourth prototype is the one closest to the open web. A user asks an agent to research the iPhone 17 across eight technology publishers. The agent queries them in parallel through the model provider's middleware, which logs every call. The preference is attached to each request, and each publisher decides whether to log it. Publishers that honor the signal stop logging. The provider's record of which publishers were called, in what order and with what sub-queries is, in the paper's words, "basically unchanged."

The appendix draws two further lessons from that test. Recording whether a signal was set "turns the opt-out itself into tracked data." And "if any hop drops the signal, no downstream site can enforce the opt-out." For publishers, that means a privacy signal can arrive with an agent's request while the intermediary between the user and the publisher keeps its full view.

The paper's enforcement diagrams make a related point about receipts. A forwarded preference or an acknowledgment from a recipient "cannot establish compliance," according to the implementation table, and enforcement at an independent recipient "still depends on its operator."

From P3P to GPC: why signals need law behind them

The authors place their proposal in a 25-year history of failed and partly successful signals. The Platform for Privacy Preferences, a W3C Recommendation from April 2002, let websites describe their data practices in machine-readable form but "lacked enforcement and, thus, was not widely adopted." The Do Not Track header, which relied on self-regulation, "failed for the same reason."

GPC was designed to avoid that fate by pairing the technical signal with legal force. It is sent as the header Sec-GPC: 1 and exposed to scripts as navigator.globalPrivacyControl, and a site can declare that it honors the signal by serving a .well-known/gpc.json file. Under the California Consumer Privacy Act and its regulations, consumers can opt out of the sale and sharing of personal information through GPC. According to the paper, California also mandates its inclusion in every browser from 2027 onward, a requirement written into California's privacy amendments, including AB 566.

Enforcement exists but has been gradual. The paper notes that the California, Colorado and Connecticut attorneys general have all brought GPC enforcement actions. California's $1.55 million settlement with Healthline in July 2025 involved advertising cookies still observed after users had activated GPC. Google has processed GPC signals to restrict ad data processing for users in a growing list of US states, adding Delaware and Oregon in November 2025. Yet a webXray audit in April 2026 found that 55% of 7,634 sites still set ad cookies when the browser sent the GPC header, a finding Google, Meta and Microsoft disputed. The new paper's own phrase for compliance is that it is "improving steadily, albeit, slowly."

The legal argument in the paper is that even a working GPC is not enough for agents. "Simply extending existing controls through new legislation and regulation will not suffice," the authors write, because current law "is structurally built around a default of data maximization, recognizing only a narrow set of controls." Most US states still lack comprehensive privacy legislation, and there is no legal framework governing AI agents. The harder legal task, in their view, is moving statutory baselines "from purpose-based data maximization to task-bounded minimization," since companies tend to define purposes broadly, "for example, as 'improving services.'"

One appendix turns to the intermediaries between users and model providers. Routers can pick cheaper or faster providers and redirect requests, but each added service "gives another operator access to prompts and tool data." A final provider's promise not to retain prompts "does not cover a relay's own logs." The paper cites OpenRouter, which describes prompt and response retention as opt-in while retaining request metadata, and notes that the authors did not test whether providers honor such settings.

The cited measurements are stark. Among 428 paid and free routers, mostly sourced from Chinese-language marketplaces and communities, one study found nine injecting malicious code and 17 accessing researcher-owned cloud credentials. Another found shared access to upstream prompt caches across 39 reseller endpoints. A third examined how routing metadata can expose sensitive topics even when prompt logging is disabled. The authors' recommendation is to exclude routes whose intermediaries' declared data practices conflict with the user's preferences, "even when this limits the available services or delays the task."

What the paper does not establish

Several limits deserve weight. The audit counts documented controls and does not test whether any of them work. It was conducted from the United States, so European controls built for the GDPR may be undercounted. It relied partly on an LLM for retrieval and categorization. And it is not yet peer reviewed.

The prototypes demonstrate feasibility in controlled code, not adoption. The authors acknowledge that enforceability "varies significantly with context": a user can inspect a local agent's storage, but when a cloud agent completes a purchase overnight, "The user must trust that the company deleted the session data. No one is available to consult."

They also recognize a usability problem with their own proposal. A taxonomy with five categories and more than a dozen subcategories risks reproducing the consent fatigue of the web. "To prevent choice fatigue and avoid repeating the web's cookie banner deluge, agentic systems must focus on meaningful and effective controls," the authors write, adding that user studies are needed before any standard is fixed.

One small inconsistency appears in the document itself. The abstract refers to the "Model Control Protocol," while the keywords, body text and references use the protocol's actual name, Model Context Protocol.

Why it matters for marketers

The paper lands as AI assistants become ad businesses at speed. ChatGPT ads reached 89 countries and more than 100,000 cumulative advertisers on October 21. Shopping agents are already reshaping traffic: Amazon said in September that it had blocked Meta's Muse agent from shopping on Amazon.com, and DataDome counted Muse at a 33% share of AI browser traffic within nine days. Background agents are a paid product, as with Gemini's tasks mode, which keeps working while users are away.

Privacy thinking about agents has been arriving in parallel. MLCommons released a draft taxonomy of 25 privacy risk vectors for AI agents on October 1. A report by 65 researchers, 36 of them at Google, argued that consent prompts and static permissions cannot keep up with AI agents and proposed contextual integrity as the test, a concept the new paper also draws on. On October 21, a W3C discussion paper proposed a nine-point declaration on the web in the AI era and a new Agentic Web Working Group.

What distinguishes the Kochar and Zimmeck paper is its focus on enforcement plumbing for opt-outs that advertisers already deal with on the web. If an agent fetches publisher pages, calls retail APIs or bids through an agentic exchange, the question the paper raises is whether a California user's GPC signal arrives with the request. At present, according to the authors, the protocols offer no standard place to put it. For ad tech companies building on MCP and A2A, that is an open design question; for regulators already enforcing GPC on websites, it is a potential gap in coverage. The paper's closing argument is that the agentic web "is still in its formative stage," and that the time to "build the right privacy primitives" is before the plumbing hardens.

Timeline

Summary

Who: Seven researchers from Wesleyan University, UC San Diego, Stanford University, Carnegie Mellon University and Villanova University, led as corresponding authors by Shreya Kochar and Sebastian Zimmeck, auditing AI products from 18 companies including OpenAI, Google, Microsoft, Anthropic, Meta, Apple and Samsung.

What: A preprint, "Privacy Preference Controls for Agentic Systems," that counts 788 privacy settings and actions across 30 AI products, finds that only 14 of 29 offer an opt-out of data sale or sharing for advertising and only 6 of 30 an opt-out of human review, proposes a five-category taxonomy of privacy controls for AI agents, and releases eight open-source prototypes that pass a GPC-style signal through MCP and A2A, which have no dedicated privacy field.

When: The paper was recorded as received on October 20, 2026, and its second version was posted to arXiv on October 22, 2026. The audit documentation was collected in October 2026.

Where: The audit was conducted from the United States and focused on US privacy law, particularly the California Consumer Privacy Act, with references to the GDPR. The prototypes are published on GitHub.

Why: AI assistants are adding advertising and agents increasingly pass user data across chains of other agents and services, while the web's existing opt-out signal, GPC, attaches to browser requests that agents bypass. The authors argue privacy controls must be built into agent protocols while those protocols are still being designed.