Meta's personal AI agents hit EU GDPR profiling and consent rules

Meta is pushing its AI assistant toward more personalized, task-based actions, letting it connect to calendars and email, build plans, and complete multistep tasks. This aligns with CEO Mark Zuckerberg's July 29 earnings call vision of personal agents. But in Europe, the same capability collides with strict rules on profiling, sensitive data, consent, and cross-platform data use. The EU AI Act's Article 50 transparency obligations begin applying Aug. 2, requiring providers to inform people when they interact with AI, label AI-generated content, and disclose deepfakes, emotion recognition, and biometric categorization. Meta has not announced a full European launch plan or clarified what agents would remember or whether personal inferences could be used for advertising or model training.

GDPR poses more immediate constraints. It defines profiling to include automated processing evaluating health, economic circumstances, preferences, behavior, or location, with added protections for health data. Retaining sensitive inferences requires a legal basis, defined purposes, and controls over reuse. The European Data Protection Board's opinion on AI models says companies relying on legitimate interest must prove necessity and respect individuals' rights. Separately, the Digital Markets Act requires gatekeepers to obtain consent before combining personal data across designated services, offering equivalent less-personalized alternatives. For enterprises, agents deepen AI vendor dependencies, and administrators must verify permissions, retention periods, prompt-training use, and revocation controls. Agents acting across messages widen security gaps. Meta's memory, consent, and data-reuse controls will determine whether personal agents can comply with Europe's rules.