UK data watchdog says ten AI giants have agreed to change how they handle personal data

[QuantumLeap34]

The UK Information Commissioner's Office has reviewed how major AI developers comply with UK data protection law, The Register reports. As a result, ten of them have made or promised changes to how they handle personal data. The list is Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI. That covers most of the companies whose models people use every day

The changes include clearer disclosure of how personal data is used in training, easier ways for people to exercise their data rights and stricter checks on safeguards. The programme began in 2025 with 11 firms. The ICO paused its work with xAI to run a separate formal investigation into Grok. So the eleventh company is now in a more serious process rather than a cooperative review

The ICO is clear that some problems are still open. Sensitive data held inside models, removing people's details after a model has been trained and extraction of personal data from models are all unresolved. Those are hard technical problems, because you cannot simply delete a row from a neural network the way you can from a database. It is good that the regulator is saying so rather than declaring victory

Richard Nevinson, the ICO's director of technology regulation, said AI has huge potential to benefit society but that depends on trust and transparency. The ICO has also contacted OpenAI, Anthropic, Meta and the AI Security Institute about reports of agents bypassing safeguards. Nevinson said the fact that AI agents act with autonomy is not an excuse for poor compliance. A six week call for evidence on agentic AI closes on 20 November

I think this is a sensible approach from the ICO. Working with companies to get changes made is faster than years of legal action. The xAI case shows there is a stick behind the carrot, though. Anyone who has ever wondered whether their old forum posts ended up in a training set will want to see those data rights get easier to use

Do these changes go far enough? And should people have the right to get their data removed from a model after training?

AI giants promise to play nice with personal data after UK watchdog scrutinywww.theregister.com

[Aaron]

In my view the ICO is doing a decent job with limited resources. The big US firms have armies of lawyers, and the regulator cannot fight all of them at once. Getting voluntary changes from ten of them is a practical result

It will not satisfy everyone, though. Ten out of eleven cooperating is a decent hit rate

[Ridge66]

DeepSeek being on the list surprised me. A Chinese company agreeing to UK regulator requests is a positive sign. I wonder how the ICO would enforce anything if it did not follow through. Cross border enforcement is always messy

[ReacherBadger]

Removing data after training is the hard one. Retraining a huge model to remove one person's details is not practical

There is research on machine unlearning, but it is still early. I am not sure the law and the technology will meet any time soon. Filters that stop the model repeating the data might be the practical answer. They are not perfect, but they are something

[Sookie]

Agents bypassing safeguards is the next big issue. Once an AI is acting on your behalf, filling in forms and moving data around, the privacy risks multiply. The call for evidence is a good idea

I might send in a response myself. Responses close on 20 November

[Buffer]

Clearer disclosure is a start, but most people will never read it. What matters is whether opting out is easy and whether it works. I tried to opt out of one company's training a while ago and it took four forms. That needs to be one click. Opting out should also cover data already collected