The Information Commissioner’s Office has secured new data‑protection commitments from OpenAI, Google, Microsoft, Meta, Amazon, Anthropic, Apple and other leading AI companies, while opening an investigation into the use of autonomous AI agents.

The UK’s Information Commissioner’s Office (ICO) has forced a coalition of the world’s biggest AI developers to tighten their data‑privacy practices, while simultaneously launching a fresh probe into the emerging realm of autonomous AI agents.

New privacy commitments from AI giants

OpenAI, Google, Microsoft, Meta, Amazon, Anthropic, Apple and several other leading firms have each agreed to amend their privacy policies, introduce clearer user consent mechanisms, and implement stricter data‑minimisation safeguards for large‑language models and generative tools.

The ICO’s demand centres on ensuring that personal data used to train or fine‑tune AI systems is either fully anonymised or obtained with explicit, informed consent, addressing long‑standing concerns about inadvertent data leakage.

Key elements of the upgraded safeguards

  • Mandatory impact assessments for any new model that processes personal data
  • Enhanced transparency dashboards that disclose data sources and retention periods
  • Opt‑out pathways allowing individuals to request removal of their data from training corpora
  • Regular independent audits to verify compliance with UK data‑protection law

These measures echo the ICO’s earlier guidance on AI ethics, but they now carry the weight of formal commitments that the regulator can enforce through fines or other remedial actions.

Investigation into autonomous AI agents

Alongside the privacy push, the ICO has opened a formal investigation into the deployment of autonomous AI agents—software that can act independently to perform tasks, make decisions, or interact with users without direct human oversight.

The regulator is particularly focused on how these agents handle personal data during real‑time interactions, the adequacy of consent mechanisms, and the potential for unintended data exposure when agents operate across multiple platforms.

Industry observers note that the ICO’s move signals a shift from regulating static AI models to scrutinising dynamic, self‑directed systems that could amplify privacy risks if left unchecked.

The ICO is committed to ensuring that the rapid evolution of AI does not outpace the protections that individuals expect under the UK’s data‑protection framework.

The investigation will assess whether current safeguards are sufficient and may result in further binding obligations for developers of autonomous agents, including requirements for real‑time monitoring and user‑controlled data deletion.

Stakeholders have welcomed the ICO’s decisive action, saying it provides much‑needed clarity at a time when AI capabilities are expanding faster than regulatory frameworks can adapt.

For a full overview of the ICO’s commitments and the scope of its new investigation, see the coverage by Think Digital Partners.

Think Digital Partners coverage of ICO AI privacy upgrades