Agentic AI systems operate autonomously, making decisions and processing data in ways users cannot predict or control. This creates a fundamental mismatch between existing data-protection frameworks built on notice-and-choice principles and the reality of how these systems collect, infer, and share personal information. The article examines whether current consent models, controller definitions, and liability frameworks can adequately govern AI agents that independently chain data sources
Introduction
The past few years have seen the rapid emergence of agentic Artificial Intelligence (AI) Systems. These are a new class of tools that can act independently to accomplish specific goals without continuous human supervision.1 Unlike traditional software or narrow AI models which operate within already defined constraints and require human supervision, agentic systems plan, act and adapt independently. They can call APIs, search the web, transact, and retain memories across tasks Their autonomous behaviour offers significant productivity gains but also introduces complex privacy and accountability risks.
This article uses the term “agentic privacy gap” to describe the mismatch between existing data-protection regimes and the ways in which agentic systems collect, infer and share personal data. Because these agents can autonomously chain together disparate data sources and update their goals in real time, individuals cannot anticipate or meaningfully consent to each
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
View source
