AI assistants are doing more on our behalf, and advertisers are already inside. But a new preprint from researchers across five US universities suggests the “do not share my data” switch is missing in the places it matters most.
The audit at a glance
Researchers counted 788 privacy settings and actions across 30 AI products from 18 companies, including ChatGPT, Gemini, Copilot, Claude, Meta AI, Grok, Perplexity and DeepSeek. They found only 14 of 29 applicable products offer an opt-out of sale or sharing for advertising. Even fewer let users opt out of analytics or product-improvement use (7 of 29) or human review (6 of 30).
The work was posted to arXiv on October 22, 2026 as a preprint titled Privacy Preference Controls for Agentic Systems. Data collection happened in October 2026.
Why the ad ecosystem should care
Most agentic traffic uses the Model Context Protocol (MCP) or the Agent2Agent protocol (A2A). The audit found no privacy-preference fields in either standard. That means a user’s “don’t share” signal has no structural place to travel when an orchestrator hands a task to a booking agent, a hotel system or an ad tech partner.
It’s not just theoretical. The authors note that conversational AI passing prompts, titles and links to third parties is already being measured. They also describe how emerging protocols that sit on top of MCP and A2A, like agentic real-time bidding frameworks, will inherit whatever those base protocols carry, or fail to carry.
What the gaps look like in practice
- Advertising opt-out: only 14 of 29 apply.
- Analytics opt-out: only 7 of 29.
- Human review opt-out: only 6 of 30.
- Ad personalization opt-out: 10 of 23 applicable products.
- Defaults documented: only 40% of settings, and 19% for request-based opt-outs.
Temporary modes are not deletion
Some products market “incognito” or temporary chats as privacy-safe. The paper shows why that’s not a deletion guarantee: Claude keeps incognito chats for 30 days, Gemini temporary chats for 72 hours, and Perplexity incognito threads for 24 hours. Legal carve-outs also matter—OpenAI can keep deleted chats beyond 30 days for legal obligations, and Google keeps Gemini API prompts for 55 days.
The framework and the proof
The authors propose five categories of choice: presence, collection, secondary use and sharing, persistence, and autonomy. In eight open-source prototypes covering travel, medical questions, search, email and booking, they show a privacy signal can pass through MCP and A2A without changing the user’s answer.
For marketers, that’s a useful stress test. If a vendor can’t tell you which opt-outs it supports and what each actually blocks, that’s a data-governance risk in your stack.
What to do about it
Before onboarding any AI agent into paid media, CRM or e-commerce workflows, ask three questions: which ad or analytics uses can be switched off; what the default state is; and what happens to data after a session. Treat temporary chat modes as retention windows, not privacy protections. And if you run an agency workflow, document where consumer data crosses from one agent to another.
Source: PPC Land
