As AI Agents Transform Digital Advertising, Where’s the Privacy Architecture?

By Rowena Lam, Senior Director of Product at IAB Tech Lab

Everyone is excited about AI agents that autonomously create campaigns, discover optimal placement, execute strategies, optimize performance, and report results. They do all this while communicating with other agents to complete transactions. It’s automation at scale. It sounds great. The one word almost completely absent in any meaningful way from this non-stop talk about agentic advertising is “privacy”.

Whether it’s “privacy-first,” “privacy-aware,” or the one I hate the most, “privacy-compliant,” it seems like the questions around privacy are limited to how we can mention the word in materials. It’s not the question you should be asking. When AI agents are autonomously transacting on media, managing audiences, and trafficking creative in the advertising ecosystem, how can we ensure consumer privacy doesn’t get ransacked by the robots as they start making decisions about personal data and control the flow of it?

The Privacy Questions Nobody’s Answering

Consent and Control

How do we ensure agents respect consumer preferences about how their data is used?
Can a consumer exercise rights like request to delete, request access to their data, request correction of their data?

Sensitive Inferences

What happens when a model makes an inference that’s sensitive in nature, about health, finances, or other protected categories?
When agents are optimizing campaigns, how do we prevent them from inadvertently creating proxy variables for protected characteristics?

Data Access and Sharing

What data does each agent access or expose?
Does the agent create new data, and if so, is it personal data and potentially subject to privacy laws?
When an agent passes data to another agent, how are we checking that appropriate contracts are in place as some laws require?
Do we know the lineage and chain of custody for the data so that we can effectuate…

Source