Intermediate8 min
Data Privacy & User Consent
Protect user data beyond PII filtering: informed consent for AI interactions, data retention policies, right to deletion, and minimizing data collection in agent systems.
Quick Reference
- →Informed consent: tell users when they're interacting with AI and how their data is used
- →Data minimization: collect only what the agent needs — don't log full conversations by default
- →Right to deletion: users can request deletion of their threads, memory, and preferences from Store
- →Retention policies: TTL on threads, checkpoints, and Store items — don't keep data forever
- →Third-party disclosure: if agent data flows to LLM providers, users should know
- →GDPR/CCPA compliance: lawful basis for processing, data portability, erasure rights
Informed Consent
- ▸Disclose that the user is interacting with AI, not a human — required in many jurisdictions
- ▸Explain what data the agent collects: conversation history, preferences, tool usage
- ▸Clarify how data is used: improving the agent, training models (if applicable), analytics
- ▸Specify data retention: how long conversations are stored, when they're deleted
- ▸Provide opt-out: users should be able to disable conversation logging or memory