The UK Information Commissioner's Office is collecting evidence on 30 specific points about how AI agents handle personal information, from session isolation and tamper-evident logging to the lawful basis for training orchestrator models, in a call for evidence it opened on October 8, 2026, which closes at the end of November 20, 2026, according to the ICO's consultation page.

The ICO publishes the call in two forms: a 37-page PDF and a set of 12 web pages covering an introduction, an explainer on agentic AI, an overview of the evidence sought, one page for each of six themes, a page of seven survey questions and two annexes. PPC Land reported on the call on October 21, setting out the regulator's definition of an agent, its three-layer map of the ecosystem and its main legal positions. What the theme pages also contain, in more detail than any summary of the regulator's expectations, is the list of things the ICO wants organisations to show it. Those requests are where the regulator's future guidance is most likely to take shape - and several of them land on infrastructure that the advertising industry has spent 2026 building.

In Short

The UK's privacy regulator has written out 30 things it wants companies to explain about how their AI agents handle people's personal information, such as how they keep one user's data away from another, how they record what an agent did and who is responsible when several companies' tools are involved. It matters to anyone building or using agents that read data, call other services or take actions for people, including the ad platforms that now let agents run campaigns through standard connectors. Answers are due by the end of November 20, 2026, and the ICO says they will shape its guidance and a statutory code on AI and automated decisions.

Thirty requests, unevenly spread

Each theme page follows the same pattern: "The challenge", "Our expectations" and "Where we are seeking evidence". The last section is a bulleted list. Counted bullet by bullet, the six lists contain 30 requests, and they are not evenly spread.

Theme Evidence requests Most specific ask
1. Data security 5 Structured logging that records agent identity alongside actions, with tamper-evident records
2. Transparency 8 Post-task summaries and audit trails showing what an agent did and with whose data
3. Accountability 5 What developers should tell deployers to set out controller and processor roles
4. Automated decision-making 5 How logging supports compliant multi-stage decisions
5. Fairness and purpose limitation 3 Real examples of compatibility assessments for new purposes
6. Lawful processing 4 How legitimate interests assessments are run for training orchestrator models
Additional questions 7 Whether data protection uncertainty has delayed or stopped deployments

Transparency gets the most questions, and the questions there are the most practical, down to the level of interface elements. Fairness and purpose limitation get the fewest.

The overview page frames all six themes as places where a "data protection by design and by default" approach runs into difficulty. "Our initial analysis of agentic AI systems identified six key areas where organisations face challenges in taking a data protection by design and by default approach," according to the ICO. It also says the list is "not exhaustive" and asks for views on other issues it should prioritise. The evidence it wants is on best-practice "measures; tools; processes; and policy interventions", and it concedes a limit on its own role: "We recognise that policy alone can't address many of the challenges associated with agentic AI. These challenges also require governance, organisational and technical solutions."

Security: identity, isolation and logs

The first theme's five requests read like a specification for an agent control plane. The ICO wants evidence on session isolation controls "that ensure data within a session is only accessible to specific parties (eg the user who started the session)"; on how organisations decide whether an agent may reach only internal knowledge systems, which the page illustrates with "document repositories, policy libraries, intranet sites", or also third-party databases; on "how and whether guardrails and permission controls change dynamically"; on structured logging that records agent identity alongside actions such as data retrieval or database edits, "outcome tracking and tamper-evident records"; and on which features built in by system providers actually help deployers, and where deployers still struggle.

The expectations behind these requests carry one "must" and several "shoulds". Organisations must assess the security risks from an agent's capabilities, connections and processing and apply proportionate measures. The page adds a point that the PDF summary tends to lose: the controls governing data access, tool use, third-party software and an agent's actions "need to be transparent to end users or other agents". Organisations should make limitations clear not only to the people deploying, overseeing or using the system but, "where necessary, to other agents interacting with it." The ICO, in other words, expects that some agents will need to be told the limits of the agents they deal with.

The threat the ICO describes is an instruction that spreads. Because an agent can retrieve information from outside and update an internal database without approval at each step, "security failures or malicious instructions (such as instructions to delete a record or an entire database) could spread across connected systems and data sources." The page does not use the term, but malicious instructions reaching an agent through the content it reads are the attack class known as prompt injection. Plugins are one route. The Dutch data protection authority warned on February 12, 2026 against using OpenClaw and similar open-source agents on systems holding privacy-sensitive data, after researchers found that about one-fifth of OpenClaw plug-ins appeared to contain malware. The ICO's Annex A reaches the same point from the other side, saying organisations should assess plugins' "provenance, permissions and data flows before making them available to an agent."

Agent identity, as the ICO describes it

The theme's most detailed passage concerns identity. "Without a clear way to identify when an AI agent is operating, organisations can't determine what guardrails and control settings they need to manage its use appropriately," the page states. It lists six things an agent identity "may need to account for": the agent's owner and intended purpose; its capabilities and available tools; its permissions and approval thresholds; its deployment and operating context; its relationships with other agents and systems; and its current task, session or delegated authority.

That is considerably more than the web currently receives. Web Bot Auth, the scheme in which an agent cryptographically signs its requests so a site can check which operator sent them, answers only the first of those questions, and even that is rare. Arkose Labs found that only 2.3% of legitimate AI agent sessions it saw between July 1 and September 30, 2026 carried a verified Web Bot Auth signature, with ChatGPT agent the only agent signing at scale, at 78.4% of its sessions. Meta has since begun signing a relatively small number of requests from its Muse agent and Meta-WebIndexer, without an announcement, according to a DataDome researcher who traced the change to around October 12. On the advertising side, IAB Tech Lab's [agent registry had reached 10 entries by March 2026, all of them MCP servers, each validated against the company's GPP and TCF IDs](https://ppc.land/iab-tech-labs-agent-registry-hits-10-with-amazon-and-new-deployment-types/) - an identity tied to an organisation, not to a task or a delegated authority.

Sessions without a session

The session isolation request meets a design change in the most widely used agent protocol. The final MCP specification, shipped on July 28, 2026, removed the concept of a session from the protocol entirely, dropping the initialisation handshake and the Mcp-Session-Id header so that any server instance can handle any request; servers that need state pass an explicit handle, such as a basket identifier, as a tool argument. The ICO's glossary defines a session as "a bounded interaction between a user and an AI system or between AI agents in which context, state or data may be maintained across one or more exchanges." Where, then, does isolation live? Nothing in the specification change removes the need the ICO describes. It does move the place where isolation would have to be built, and evidenced, from the protocol to the servers and applications that issue and check those handles.

The ICO also notes that some agentic systems restrict which websites an agent can visit, and says it is "interested in understanding how efficient these measures are in practice and how stakeholders evaluate security risks in general."

Transparency: eight requests, most of them about timing

The transparency theme has the longest list, and its requests describe a user interface as much as a policy. The ICO wants evidence on:

  • how organisations explain whether personal information is handled on a person's device, remotely, or both;
  • how they give timely information when an agent accesses a new data source, uses an external tool, or shares personal information with another agent or organisation;
  • how they use "pre-authorisation, prompts, approval steps, live status indicators or other techniques";
  • how end users can set limits on "the websites, tools, data sources and actions available to an agent";
  • how post-task summaries and audit trails explain what an agent did, what personal information it used, which tools and recipients were involved, and what happened as a result;
  • how people can challenge, correct or reverse an agent's actions;
  • how agent identification, authentication, permissions and tracing support transparency; and
  • how meaningful transparency works when information moves between agents in a multi-agent system.

The underlying expectation is that a single notice before a task starts may not be enough. Where processing changes mid-task, or an agent reaches for a new source, a new tool or an action "with significant consequences", organisations should consider further information or asking for approval first. The ICO accepts that this may mean "extra 'friction' into the user experience", and says organisations "must consider the risks and consequences of potential actions an agent could take when deciding what measures they need."

The page then splits its supply-chain measures into two kinds. Some help organisations understand and explain processing. "Others (such as authentication, permission setting and logging) support oversight, accountability and governance," according to the ICO. That distinction matters because the same log can serve both a user-facing summary and a regulator's audit, but only if it records the right things.

Where the market already is, and is not

Some commercial products already resemble the controls on this list. Walmart's Agent Profiles, announced on October 21, 2026, make approval of every purchase the default, or let customers set a spending limit such as $50, $100 or $200, with agent purchases shown separately - an approval threshold and a user-set limit in one feature. Google Cloud has added project spend caps that pause its Gemini agent when a limit is reached. Both concern money rather than personal information, which is what the ICO is asking about.

On privacy preferences specifically, the record is thinner. A preprint audit of 30 AI products from 18 companies found that only 14 of 29 applicable products offered an opt-out of ad data sale or sharing, and its authors found no privacy preference fields in existing agentic protocols such as MCP and A2A; their prototypes had to use the protocols' general-purpose "meta" field instead. If a user's limits are supposed to travel with a task from one agent to another, as the ICO's multi-agent question implies, there is at present no standard field to carry them.

Not everyone agrees that more prompts are the answer. A report by 65 researchers, 36 of them affiliated with Google, argued in October that consent prompts and static permissions cannot keep up with agents and proposed contextual integrity as an alternative, listing 51 open research problems. The ICO's approach, which adds approval steps at the moments that matter, and that report's approach, which tries to reduce reliance on them, will both be tested by the evidence that arrives. MLCommons, separately, has catalogued 25 privacy risk vectors for agents across five domains in a draft taxonomy released on October 1, 2026.

Device storage remains the familiar part. Where an agent stores information on a person's device or reads information stored there, organisations "must provide clear and comprehensive information about the purposes of that storage or access, in accordance with regulation 6 of the PECR", according to the ICO - the same cookie rule the regulator discussed in its May 2026 advice to government on consent for low-risk advertising.

Accountability: who sets the permissions

The third theme's five requests ask how organisations allocate controller, joint controller and processor roles; how they show that allocation "in practice and in their contracts"; what logging, tracing and monitoring they use "to ensure controllers retain control and accountability for the data processing that serves the purposes they set"; what information developers currently give deployers about how systems work, how they process personal information and "what risks could emerge through use"; and what information developers should give to set out clear roles.

The last two requests describe a gap from both ends: what developers hand over now, and what they ought to. The ICO notes that it set out its expectations on accountability for generative AI in 2024, and that "overarching decisions about the means and purposes of data processing impact controllership." For agents, it adds six further factors "including but not limited to" who decides the agent's goals, what personal information it can reach, which models and tools it can select, which protocols it can use, what permissions it has and what actions it can take. "In agentic AI, decisions about protocols, permissions and access controls may more heavily influence the means of processing," the page states.

The ICO names no advertising platform, and its Table 1 of participants deliberately does not say who is a controller. But the factors it lists map closely onto the decisions ad platforms have made in shipping their own MCP servers. Google's Ads API team released a read-only server in October 2025 with two tools, search and list_accessible_customers. Amazon's Ads MCP Server moved to open beta in early 2026 for partners with active API credentials, with pre-built tools that can create an end-to-end Sponsored Products campaign from a single prompt. Meta opened its ads MCP server on July 16, 2026 to any developer holding a Meta app, covering campaign creation and editing, Custom Audiences, catalogs, reporting and lift studies. Whether a server can only read, or can also write, or can touch customer lists, is a decision about tools, permissions and actions - three of the six factors on the ICO's list. Which party is a controller for which step is the question the ICO is asking respondents to answer, not one it has settled.

The ICO restates one position plainly. "Some agentic AI developers suggest they are controllers only for: the initial development of an agentic AI system; and its maintenance and security-related processing," the page reports, before responding that organisations "should interpret the concept of a controller broadly to ensure complete and effective protection for people."

Automated decisions: reconstructing what happened

The fourth theme applies articles 22A to 22D of the UK GDPR, which replaced the old Article 22 under the Data (Use and Access) Act 2025, to agents. Its five requests ask how organisations work out whether the provisions apply; how they make sure, where they conclude the provisions do not apply, that human involvement is meaningful; how organisations using automated decision-making with agents apply the required safeguards; how "technical logging and audit mechanisms can support compliant multi-stage ADM"; and how permission setting and interface design support compliance.

The expectations are more specific than the general rule that one human step does not automatically take a workflow outside the provisions. Organisations "should put measures in place to ensure that, where an agent behaves unexpectedly, they can understand and reconstruct the decision-making process", covering which agent was involved, under what authority, what systems or data it accessed and whether any human involvement was meaningful. "These measures are even more important in the context of multi-stage decision-making," the page adds. Logging should show which contributing decisions were solely automated, whether meaningful human involvement was present, and "how much automated and human processes influenced the eventual decision or result impacting a person."

The ICO also says where human involvement and escalation need to sit: "at critical moments in any multi-stage decision-making; and before they apply a significant decision to a person." Technical controls and interfaces that limit what an agent can do, or require human approval before certain actions, "may be relevant in assessing whether a decision involves meaningful human involvement."

That logging standard - which steps were automated and which were human - is hard to meet with ordinary web analytics. Microsoft Clarity's study of more than 5.2 million agent-classified sessions found checkout in 25.21% of agent sessions against 14.65% of human-only sessions, but the tool cannot separate agent and human actions within a single session. The ICO's theme pages do not discuss advertising decisions under the ADM heading, and say nothing about whether targeting or pricing decisions made by agents would count as significant.

Fairness and purpose: the data agents learn from

The fifth theme has three requests: real instances where organisations assessed whether a new processing purpose was compatible with the original one, or concluded it was not; guardrails and controls that support fairness and purpose limitation; and monitoring of agent actions, data access and tool interactions that reduces the risk of agents using personal information "for purposes that have not been appropriately assessed and authorised."

The challenge section identifies a category of data that sits at the centre of how agents are now trained. "Another subset of personal information use is the use of models trained with data generated when people carry out tasks on computers," the page states, listing the actions people take, the order in which they take them, the choices they make and how they interact with systems. The glossary's entry on imitation learning lists demonstrations ranging from a human writing a summary to "screenshots of computer or browser use". That is the training material behind computer use agents, which click buttons and fill out forms inside a browser or operating system on a person's behalf - an environment the glossary describes in nearly the same words.

Purpose limitation is tested by two features of agents: intermediate actions "that the user or deployer didn't individually specify", and memory, since an agent "may also retain or reuse information encountered during one task to support another immediate or future task." The glossary's definition of an AI agent makes the first point explicit: an agent's goals can include "intermediate, self-defined objectives intended to achieve an overarching goal." The ICO says it consulted on purpose limitation in generative AI in 2024 and that those findings apply here, and it repeats its warning that labelling agent development as research does not on its own bring in the scientific research provisions. Processing "can't be solely for internal, commercial product development."

Lawful processing: one basis per step

The sixth theme asks four questions: which lawful bases organisations use for each processing activity; what challenges they face in choosing; what analysis supports the choice; and how they conduct legitimate interests assessments, "including training or adapting orchestrator models."

The challenge section lists five activities that may each need a basis: training or adapting models, interpreting end-user instructions, accessing information on a device, retrieving information from other systems, and sharing it with other agents or third parties. Where an agent "can dynamically select tools, data sources or actions," the page says, it may be harder to provide transparent information, assess users' reasonable expectations, and determine whether a basis is available. The ICO also tells organisations to consider "whether any other legislation applies to their data processing, particularly where this may impact the lawful basis" - PECR being the example it gives.

Its expectations include a line on how the bases relate to one another. "No one lawful basis is naturally 'better' or more important than another," the page states. "But depending on the nature and context of the processing, not all lawful bases are available or appropriate." Legitimate interests may be available for some activities, particularly training orchestrator models, but only with an assessment in place.

What the annexes add

The two annexes contain several statements that matter more than their placement suggests.

Annex A breaks tool use down into five operations on personal information - collecting, retrieving, changing, disclosing and deleting - and says organisations should understand "what information each tool can access; what actions it can take; and who receives the information." It describes memory as possibly holding previous prompts, tasks, preferences, outputs and actions, kept for a single session or longer, and possibly shared between agents. Orchestration components may split a goal into tasks, select agents, models, data sources or tools, and record performance information, functions that "can affect: what personal information the system uses; where it sends it; and how long it keeps it." On protocols, the annex adds a sentence that the summary versions tend to skip: "Some may also support identity, authentication or payment credentials."

Annex B defines 17 terms. One of them sits awkwardly against the main text. The page on agentic AI says subagents "may operate within the same session or context as the orchestrating agent." The glossary says a subagent "has its own context window, system prompt and set of tools (collectively referred to as a 'background session' and not directly visible in the main, user-facing session)." Both descriptions can be true of different designs, but the difference bears directly on the session isolation question in Theme 1: whether a subagent shares the user's session or runs in its own background session determines what it can see. Agent teams, by contrast, have separate user-facing sessions, and the user "can directly interact with each member of the team in its own session," according to the glossary.

The glossary's entry on agentic protocols adds a technical point: the LLMs involved "must be trained on how to use these protocols, either via supervised fine-tuning or through in-context learning."

The survey, and what the answers feed

The seven additional questions sit outside the legal themes and are tied to the ICO's secondary duties to support "responsible innovation and economic growth". They ask where organisations stand on a five-step adoption scale now and within 12 months, rate seven named barriers from "Not a barrier" to "Major barrier", and ask directly whether data protection uncertainty has led an organisation to delay or abandon an agent deployment. One question asks how organisations obtain assurance "in the absence of specific regulatory guidance on agentic AI", offering ten options including "Vendor assurances" and "Third-party governance or safeguarding solutions". The ICO says the answers will help it understand "what the potential costs and benefits of any future regulatory interventions are."

The evidence will feed guidance and the ICO's statutory code of practice on AI and automated decision-making. Separately, the introduction says the ICO is "currently exploring the application of agentic AI in the adtech ecosystem and will publish a report on this later this year." The pages give no date or scope for that report.

The call arrives after the ICO, CMA, FCA and Ofcom set out a shared view in the Digital Regulation Cooperation Forum's foresight paper on agentic AI on March 31, 2026. The difference now is the level of detail. A regulator that asks how post-task summaries list recipients, how tamper-evident logs attach to an agent's identity, and what developers should tell deployers about risk is, in effect, describing the records it may expect organisations to hold. For ad tech companies that expose campaign, audience and reporting functions to agents through standard protocols, several of those questions have no settled industry answer yet, on the evidence PPC Land has reported this year.

Timeline

Summary

Who: The UK Information Commissioner's Office, seeking evidence from developers and deployers of agentic AI systems and from legal and technical experts. The requests bear on any organisation that lets agents access personal information, including ad platforms and ad tech companies that expose functions to agents through protocols such as MCP.

What: A call for evidence published as a 37-page PDF and 12 web pages, containing 30 separate evidence requests across six themes - data security (5), transparency (8), accountability (5), automated decision-making (5), fairness and purpose limitation (3) and lawful processing (4) - plus seven survey questions on adoption, barriers and benefits, and two annexes defining agent components and 17 terms.

When: Opened on October 8, 2026. Responses close at the end of November 20, 2026, according to the ICO's consultation page. A separate ICO report on agentic AI in adtech is promised for later in 2026, without a date.

Where: The United Kingdom, under the UK GDPR, its articles 22A to 22D on automated decision-making, and the Privacy and Electronic Communications Regulations 2003.

Why: The ICO says agents process personal information at greater scale and with more variation than earlier AI, making compliance harder to ensure and demonstrate. The specific requests - session isolation, agent identity, tamper-evident logging, post-task summaries, reversible actions and documented lawful bases per step - indicate what the regulator expects organisations to be able to show, and will feed its guidance and its statutory code of practice on AI and automated decision-making.