10 AI developers make or promise data protection changes

The UK data protection regulator, the Information Commission, said on 8 October 2026 that 10 AI developers have made or promised changes to how they handle personal data. These companies make the large AI systems that chatbots and other AI tools are built on. They are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI.

The regulator has also asked for views on the data protection risks of AI tools that can carry out tasks for people.

Richard Nevinson, the Information Commission's Director of Technology Regulation, said:

AI has huge potential to benefit our society, but that depends on trust and transparency. Our engagement with some of the biggest developers has secured real commitments that will help people better understand and control how their data is used, even in a fast-moving and complex area. But as AI systems operate with greater autonomy, robust data protection safeguards become even more critical.

What is changing

The Information Commission's report says the companies have made changes or committed to make them. Depending on the company, the changes include:

• separate privacy information explaining how and why personal data is used at each stage of training an AI system, and the safeguards in place
• plain summaries of the types and sources of information used to train the AI
• better information to help people use their data protection rights where their data was used for training
• updated privacy notices saying why the data is used, how long it is kept and whether it is sent overseas

What it means for consumers

The report's section on what the regulator expects gives examples of how some of the companies help people use their data protection rights. Meta has a process for its users to object to their data being used for AI training, and a separate form for other people to raise concerns. Apple lets users and non-users object to specific web pages containing their personal data being collected and used for training. OpenAI has published guidance on asking for personal data to be removed from ChatGPT answers. Anthropic has also published further guidance on privacy and personal data in the context of AI systems.

Under UK data protection law, people already have the right to object, for reasons to do with their own situation, when a company uses their data because it says it has a legitimate business reason. The company must then stop, unless it can show compelling reasons that outweigh the person's interests and rights, or needs the data for a legal claim. People also have the right to ask a company what data it holds about them and any information it has about where it came from.

Our guides explain how to object to an AI company using personal data and how to find out what data a company holds.

What happens next

The Information Commission says it will monitor the companies' progress on their commitments.

It has opened a call for evidence on the data protection risks of AI tools that carry out tasks for people, which closes on 20 November 2026.