Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), on October 27, 2026 published a ten-point guide for people who hand tasks to artificial intelligence assistants and agents. The advice is narrow and specific: give an agent only the access a task requires, keep a confirmation step before it sends, pays, signs or accepts anything, and treat every email, web page and document it reads as a possible carrier of hidden instructions.

The 12-page document is titled "Asistentes y agentes de IA: que la IA actúe por ti, no sin ti" - "AI assistants and agents: let AI act for you, not without you". It is addressed to users rather than companies, although its final page lists seven controls the agency says providers of such tools should offer. It carries the banner "Cuidado con lo que le confIAs" (rendered by the AEPD in English as "Be careful what you confIAde"), the name of an earlier AEPD decalogue on privacy when using AI tools, published in January 2026. The press release that accompanied it cites a case in which an agent closed a sale and gave its user's address to the buyer, who turned up at the seller's home without the seller knowing a pickup had been arranged. The decalogue is written in Spanish, and the quotations from it in this article are PPC Land translations. Quotations from the press release come from the English version the AEPD issued, which is marked as AI-translated.

In Short

Spain's data protection authority published a 10-point guide on October 27, 2026 for people who let AI assistants and agents read their email, manage their calendars or buy things on their behalf. It matters because these tools are moving from answering questions to taking actions, so a mistake or a manipulated agent can now send a message, share a file or complete a payment in someone's name. The guide's central rule is that the agent prepares and the person approves: minimal access, no blanket "always allow" permissions, and a confirmation step before anything that costs money, creates a contract or reaches other people.

Five questions before delegating

The decalogue opens by describing assistants as already within reach of anyone. Built into phones and computers, they can manage a calendar or complete purchases and bookings, and the document calls them "a powerful tool for personal management". Providers, it says, "are offering them on a massive scale". To use them safely, the AEPD argues, the decision about what to entrust to an assistant and how far it may act should be made at the start, not after the fact.

Five questions frame everything that follows:

  • What can it see?
  • What can it remember?
  • What can it do in my name?
  • Where does it send my data?
  • Does it affect anyone else?

The ten points map onto those questions. Visibility is the subject of points 1 to 3. Memory has a point of its own. Action - instructions, confirmations and manipulation - runs through points 5 to 7, other people's data is point 8, and the last two deal with account security and supervision. Two boxes on the final page cover use at work and what users can expect from providers.

From answering to acting

The argument running through the document is that delegation changes the nature of a mistake. The press release puts it in two sentences taken from the decalogue: "When the assistant only answers, an error is a wrong answer. When it acts, it is an email sent, a file shared, a purchase, a contract or a consent given in your name".

Those lines sit under point 6, "Confirma lo importante" (Confirm what matters), next to a sentence with legal weight: "Remember that you can be responsible for the actions you have allowed your agent to carry out." The document does not develop it. No statute is cited and no example of liability is given. But the sentence places at least part of the consequence of an agent's action on the person who authorised it.

The press release reduces the operating principle to a single premise: the agent prepares and the individual approves.

The ten points

Who holds the keys

"An assistant with access to your email, your calendar, your files or your payments is a key to a large part of your digital life," the first point reads. It recommends services that are clearly identified, with a known company behind them and a way to contact it, that allow users to exercise their rights and defend them legally in the EU, and that state clearly where data are sent. Assistants of unknown origin, "whether free or paid", deserve distrust, the document says, particularly those that ask for access to an entire device or to information they do not need for the task. Priority should go to assistants that process data on the device itself, without sending them to external servers.

Two lines in point 1 touch advertising directly. Users are told to check whether their data are used "for purposes unrelated to your interest, such as marketing", and to switch those uses off where the service allows it. And the document warns that a choice made about model training may be hard to undo: "if you allow your data to be used to develop AI models, it could be difficult to delete them afterwards."

The point ends with a description of the assistant the AEPD would rather see people choose: one that discloses what data it keeps, "including profiles and the data it infers", lets users consult and delete them, shows what it accessed, when, and what it changed in each task, and allows unwanted changes to be undone.

Access, not blank cheques

Point 2 is titled "Concede accesos, no cheques en blanco" (Grant access, not blank cheques). Its subject is scope. "Reading is not the same as sending, modifying or deleting. And accepting all permissions out of fatigue is not being in control."

Where a service offers a choice, the guide recommends the minimum: the agent should ask before opening information the user considers sensitive, should be able to read but not modify or delete without approval, and should reach only what the task needs - a folder, a calendar - rather than a whole account or device. If a service cannot be limited that way, the document asks whether the task justifies connecting all of it. Connections should be reviewed periodically, and again whenever the assistant or an app adds new functions.

Point 3 adds a proportionality test. "The more information it has, the greater the damage if it makes a mistake, if it is deceived or if someone gets into your account." Health, financial situation, identity and passwords sit at the top of the scale, and the more delicate the data, the more limited the agent's access and autonomy should be. Passwords, verification codes and card numbers do not belong in the conversation: when identification or payment is needed, the person should type those details into the form or secure space built for that purpose. Names and data a task does not require should be removed from a document before the agent receives it.

Memory

Memory gets the longest treatment. "Memory makes the assistant more useful, but little by little it builds a profile of your tastes, relationships, routines, worries or data from connected applications," point 4 states. "A trivial piece of data, added to many others over months, ends up describing your life."

The first recommendation is procedural. Deletion should go through the service's memory, history and privacy controls, not through a request typed into the chat. The document also notes that deleting a chat, deleting a memory and removing a connected application "do not have the same effect".

The guide then lists what a service may keep beyond what it remembers in order to help: data held for security, abuse detection, technical logs, "profiles and scores about you", alerts about activity and location data, among others. Each use can generate new data or infer it. Those data may also be held by companies working for the provider, or preserved by court order. To find out what is held, the document points to the right of access; to remove it, the right of erasure.

One sentence in this section reaches past the assistant to the merchants it deals with. "When your assistant uses third-party services to carry out your tasks (for example, a booking website or an online shop), or accesses them for marketing purposes, the information stored in those services falls outside the assistant's management. To delete it, go to each of them." An order placed by an agent, in other words, leaves records with the shop, and the assistant's own delete controls do not reach them.

Point 4 closes with three further recommendations: temporary conversations for sensitive matters; separate accounts, profiles or spaces for personal, family and professional use where the service permits it; and backups stored in a known place and protected with a key the user has chosen.

Saying what not to do

An agent, the document explains, can do more than execute a one-off instruction. It can pursue an objective, break it into steps and decide how to carry them out. "'Organise the dinner' or 'check my email and take care of everything' is equivalent to giving it carte blanche."

Point 5 therefore asks for limits as well as goals: whom the agent may write to, how much it may spend, what it must not touch and when it should stop and ask. Small, reversible tasks come first. Then comes a qualification that matters for anyone building agent products: "The limits you write in the instruction guide the agent, but they do not replace permissions and confirmations." A spending cap typed into a prompt is guidance to a model. A cap enforced by the platform is a control.

The same point introduces a combination the AEPD treats as hazardous: content from strangers, access to private information and the capacity to act in the user's name, all within a single task. Where the three have to coexist, the document wants confirmation before any external action.

Confirmation

Point 6 recommends switching on prior confirmation, where the service allows it, for sending, publishing, sharing, deleting, paying, contracting or accepting terms. It advises against permanent authorisations to act without asking - the document cites the interface label "permitir siempre", or "always allow" - unless they are genuinely necessary and their scope is understood.

Approvals should be read properly: recipient, amount, date, attachment. "A summary can hide what is essential." Pressing "approve all" so that the agent stops asking is discouraged. Decisions with legal consequences, such as signing or accepting a contract, or with financial or health consequences, should not be executed without review, and neither should those that seriously affect another person. "Assistants can make mistakes and present an incorrect answer with an appearance of certainty."

Hidden instructions

Point 7, "Desconfía también de lo que lee" (Distrust what it reads, too), describes the attack known as prompt injection, although the document never uses the term. "A website, an email, a PDF or a calendar invitation can contain hidden instructions, even ones invisible to you (white text on a white background), so that the agent does something different from what you asked, such as sending your data, opening a link or approving something."

On defences, the AEPD is blunt. "No measure completely eliminates this risk; that is why the best protection is to limit what the agent can do if it manages to be deceived." The more outside content an agent handles - emails, websites, other people's documents - the less access and capacity to act it should have over the user's data and accounts.

The guide's example of a risky task is short: "summarise my new emails and reply to all of them". That one sentence combines untrusted content, private data and outbound action. Warning signs include an agent that asks for a password or code, urges approval of something, visits unexpected sites or proposes a link; in each case, the task should be stopped and reviewed. The point also mentions configuring, accepting or creating restrictions on external services the agent tries to reach.

For publishers and brands, the section has a second reading. The AEPD names websites as a vector. Every page an agent visits on a shopper's behalf is, in this framing, a possible source of instructions the shopper never saw.

Other people's data

"In your email, your calendar, your contacts, your photos and your chats there is information about family members, friends, colleagues, clients or patients who have not decided to interact with that artificial intelligence," point 8 states. An agent given access to those sources can process third parties' information. "The fact that you authorise it does not give you free rein to use other people's information."

The guide warns against using an agent to gather or infer sensitive information about others - health, ideology, financial situation - and against decisions that affect them without first considering whether that is appropriate and lawful. When an agent communicates with other people on a user's behalf, they should not be left confused about who is acting, and particular care applies if the agent uses the user's voice, image or identity. Shared devices should have separate profiles; children should have their own, and be accompanied while they use them.

The concern for people who never opted in has a recent parallel in Germany. In September, the Hamburg data protection authority found that Ray-Ban Meta glasses expose bystanders without their consent, concluding that neither consent nor legitimate interest generally justifies using bystander data for AI training.

Accounts and devices

"The assistant's account gives access to everything it has connected," point 9 begins. "Whoever controls it, or whoever manages to get you to install a malicious add-on, can read your email, impersonate you or spend your money."

The recommendations are familiar from general account security: a unique, strong password, two-step verification or a passkey, login alerts, no open sessions on devices other people use, and periodic checks of where the account is signed in. Add-ons, described as "extensions that add functions to the assistant", and connectors, "which link it to other applications", should come only from known sources, with their requested permissions checked.

One item addresses agents that operate a browser or a computer. Such an agent could reach pages where the user is already logged in and process whatever appears on screen. For sensitive tasks, the document recommends a separate profile or session where possible, and deleting afterwards the sessions, cookies or access no longer needed. Very sensitive information on the device should be stored encrypted and decrypted only while the agent is switched off.

Supervision and exit

"Delegating is not disengaging," point 10 opens. The document wants users to know how to stop an agent and withdraw its access before they need to, and to be ready for a compromised account or device. Updates should be checked so that they do not change settings or widen what the agent does with data. The assistant's activity history should be reviewed, along with the affected applications themselves: which messages were sent, which files shared, which purchases made.

Scheduled, recurring and unattended tasks receive special attention. The guide asks users to limit how long they run, what data and services they use and what they can do without asking, and to delete those no longer needed. Alerts on services where a problem could cause serious harm are recommended.

If something goes wrong, the sequence is: stop the agent, disconnect the affected applications, change passwords, check what was sent and warn anyone who could be affected - at work, the organisation. Data the service keeps are subject to data protection law, the document reminds readers, so rights of access, rectification and erasure apply, and a complaint can be filed with the AEPD. A copy of important data on another device is recommended in case the main one fails, is lost or has to be locked.

What providers are expected to offer

"Responsibility for AI assistants and agents cannot fall only on the user," the final page states. "Whoever offers assistants capable of acting for you should also offer sufficient controls." Seven follow:

  • Permissions that are understandable and distinguish consulting from acting.
  • Configurable confirmation for the actions with the greatest impact.
  • A history of what the agent has done on the user's behalf.
  • An immediate way to stop the agent.
  • Memory management and deletion.
  • Clear information on whom data are sent to and whether they are used to train the AI.
  • A simple route for exercising rights.

"If a service does not offer you these controls, take it into account when deciding what to entrust to it."

The list is phrased as expectation, with "debería" (should), not as obligation. It cites no article of the General Data Protection Regulation, makes no reference to the EU AI Act, names no company or product and sets no deadline. Several of the user-side recommendations depend on these controls existing: the document repeatedly qualifies its advice with "when the service allows it".

At work

A separate box covers professional use. Only assistants authorised by the organisation should be used, connected only to the accounts, applications and data the organisation has approved. "That you can use a tool in your personal life does not mean it is suitable for professional use."

The document rules out installing agents on work equipment on one's own initiative and connecting professional email or documents to a personal AI account. Data about clients, patients, pupils or citizens remain the organisation's responsibility, it notes, and individuals are responsible for how they use them. In case of doubt, the guide points to the organisation's data protection officer.

The sale that went wrong

The press release uses one case to argue that "these are not theoretical risks". According to the AEPD, a user instructed an agent to sell an item and selected the "always allow" option, "believing that it would continue to request his authorisation before accepting offers. The agent closed the deal and provided his address to the buyer, who appeared at the seller's home without the seller knowing that the appointment had been arranged."

The agency did not name the person, the product or the platform. Its account matches an incident reported by the Associated Press on October 19, 2026, involving Matt Robb, a Toronto-based content creator who let Meta's Muse agent handle his Facebook Marketplace listings. According to the AP, the address disclosure came down to "always allow" permissions Robb granted when he first let Muse onto his Marketplace profile, where he had stored a pickup address; he had expected the agent to check with him before sharing the address or accepting offers. A buyer arrived outside his home late at night, and Muse sent an automated reply indicating he was there. TechRadar had reported the episode on September 28, citing Robb's post on Threads, and identified the item as an MX Keys Mini keyboard. The AP also reported that Meta contacted Robb to discuss what went wrong and, asked about a separate instance in which Muse appeared to accept a price $100 below Robb's minimum, acknowledged the agent's error without further comment.

Muse is recent. Meta released it on September 8, and PPC Land reported at the time that Meta puts an AI agent that buys things inside WhatsApp, US only. Within two weeks it had been shut out of Amazon: on September 20, Amazon blocked Meta's Muse AI agent from shopping on its site.

The case illustrates points 5 and 6 almost exactly. The user believed a limit existed; the permission granted said otherwise.

The AEPD's earlier work on agents

The decalogue is the agency's most consumer-facing document on agentic AI, but not its first. In February 2026, the AEPD published version 1.1 of a 71-page guide titled "Agentic Artificial Intelligence from the Perspective of Data Protection", and PPC Land reported at the time that Spain's data watchdog mapped the hidden GDPR risks of agentic AI. That document, aimed at organisations, set out four levels of autonomy, running from "agent proposes, human operates" to "agent operates, human observes", treated direct and indirect prompt injection, and examined memory risks along four dimensions. The October decalogue translates much of that analysis into instructions for individuals and, for consequential actions, settles on a model in which the agent prepares and the person approves.

The agency has also seen agents in its breach workload. In mid-September 2026, according to Reuters, the AEPD said it had received the first reported notification of a personal data breach allegedly carried out by an AI agent, which used a widely known large language model to find vulnerabilities, log into a system, change personal data and access invoices. The notification came from the affected organisation, the information remained under review, and neither the model nor the organisation was named.

The press release places the new guide within the agency's 2025-2030 Strategic Plan, which lists a culture of privacy among the public and "technological innovation with safeguards" among its pillars.

Other regulators on the same ground

Spain is not alone. On March 31, 2026, four UK regulators - the CMA, the FCA, the ICO and Ofcom - published a foresight paper through the Digital Regulation Cooperation Forum, and PPC Land reported that UK regulators warn agentic AI is already here and needs watching now. The ICO followed on October 8 with a call for evidence on agentic AI and data protection; the ICO gave AI agent firms until November 20 to submit evidence across six themes, from data security and transparency to automated decision-making.

Industry and research groups are working on the same questions. On October 1, MLCommons catalogued 25 privacy risks posed by AI agents in a first draft taxonomy. A few days later, a paper with 65 authors argued that consent can't keep up with AI agents, listing 51 open problems.

That last argument sits awkwardly beside the decalogue. The AEPD's model leans heavily on the user: read every approval, keep confirmations switched on, refuse "approve all". Yet the same document concedes, in point 2, that people accept permissions "out of fatigue". How many confirmations a person will read carefully before the prompts become noise is a question the guide does not try to answer.

What it means for advertisers, retailers and publishers

The decalogue has no legal force, and it is addressed to individuals. Its practical effect on the advertising and commerce industry is indirect, but the points of contact are specific.

Agent checkout. Retailers and platforms are building flows in which agents complete purchases. Walmart, for example, said on October 21 that AI agents can buy within customer-set limits such as $50 or $100. The AEPD's framework accommodates spending limits - point 5 lists "how much it can spend" among the boundaries users should set - but distinguishes limits written into an instruction from permissions enforced by the service, and it still recommends a confirmation step before paying where one is available. A national data protection authority telling consumers to keep that step is a design input for anyone trying to remove it.

Identification. The guide tells users to prefer clearly identified providers. Merchants face the mirror problem: knowing which agent is on their site, and for whom. Arkose Labs reported on October 20 that 97.7% of legitimate AI agent sessions carry no verified ID.

Marketing data. Two passages concern advertisers directly. Point 1 tells users to switch off marketing uses of their data where the service permits it. Point 4 tells them that records created when an agent shops or books, or when it accesses services "for marketing purposes", must be deleted at each merchant separately. The availability of the first control varies: a preprint by researchers from Wesleyan, UC San Diego, Stanford, Carnegie Mellon and Villanova, posted in a revised version on October 22, found that 14 of 29 applicable AI products offered an opt-out from the sale or sharing of data for advertising.

Content as an attack surface. Point 7 lists websites alongside emails and documents as places where hidden instructions may sit, with white text on a white background as the example. For publishers and brands, that places ordinary web pages inside the threat model regulators now describe to consumers.

Spain's own industry has bet on agents. In January, IAB Spain's 2026 digital roadmap put AI agents at advertising's center, while stressing human supervision. The AEPD's guide spells out, from the consumer side, what that supervision looks like.

What the guide leaves open

Several questions remain outside the document's scope. It does not say whether the AEPD considers any current product to meet the seven provider controls, or whether it intends to check. It does not distinguish between assistants built into operating systems and standalone agents. And it does not address who bears responsibility when an agent, acting within permissions a user granted, follows instructions planted by a third party - the precise scenario point 7 describes.

The document is advisory. Its weight comes from the issuer: the authority that handles data protection complaints in Spain, and that tells readers, on the guide's tenth page, they can complain to it if their rights are not respected.

Timeline

Summary

Who: The Agencia Española de Protección de Datos (AEPD), Spain's data protection authority, addressing people who use AI assistants and agents, with a list of expectations for the companies that provide them.

What: A 12-page, ten-point guide titled "Asistentes y agentes de IA: que la IA actúe por ti, no sin ti", built on five questions about what an agent can see, remember and do, where it sends data and whom it affects. It recommends minimal access, no blanket "always allow" permissions, confirmation before sending, paying or contracting, controlled memory deletion, distrust of hidden instructions in content, protection of third parties' data, account security and supervision, and lists seven controls providers should offer.

When: Published October 27, 2026, following the AEPD's January 2026 decalogue on AI tools and its February 2026 guidance on agentic AI.

Where: Spain, through the AEPD's website, in Spanish, with an English version of the press release. The advice is addressed to users in Spain, and the section on work to the organisations whose staff use these tools.

Why: Assistants are moving from answering to acting, so an error or a manipulated agent now produces a sent email, a purchase or a contract in the user's name. The agency cited a case in which an agent with "always allow" permissions sold an item and gave the seller's address to the buyer. For advertisers and retailers, the guide bears on agent checkout design, marketing uses of data and the treatment of web content as a channel for hidden instructions.