AI agents can now browse, compare, buy and make requests on a person’s behalf. Legally, that makes them intermediaries. The rules being written for data intermediaries will increasingly decide what AI agents may do.
Whose agent is it?
In August 2026 the US Court of Appeals for the Ninth Circuit lifted an injunction Amazon had obtained against Perplexity’s shopping agent. It treated the customer, not the AI company, as the person accessing Amazon’s site, describing the agent as a tool rather than a person for the purposes of the federal computer misuse statute. The case continues, and retailers can still rely on their terms of use.
Exercising rights for people
United Kingdom. The government consulted in 2026 on clarifying that people can delegate their data rights to intermediaries, and on authorisation schemes and controller duties. No decision has been published.
European Union. The Data Governance Act regulates data intermediation services with duties of neutrality and acting in individuals’ best interests. The Commission proposes making that regime voluntary.
California. Authorised agents may submit privacy requests, but may use the consumer’s data only to fulfil those requests.
The hard questions
How does an agent prove its authority to a business that has never heard of it? Who is the controller of the data the agent collects? Can the agent’s developer use what it learns, or is it bound like a fiduciary? Current law answers these piecemeal.
Every rule written for human agents and data intermediaries is about to be tested by software that acts at scale.
What to do
If you build agents, design for provable, revocable authority and strict limits on reusing user data. If you run a website, decide your policy on agents and put it in your terms.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.