Google - Enforcement
Executive Summary
The UK's Information Commissioner's Office secured commitments from ten major AI developers - including OpenAI, Google, and Microsoft - to improve how they handle personal data in AI training, following a compliance review under UK data protection law. The companies agreed to provide clearer explanations of data use, better processes for users to exercise their data rights, and stronger safeguards assessments. The ICO continues to monitor implementation and has opened a separate investigation...
What Happened
The UK's Information Commissioner's Office (ICO) conducted a compliance review of eleven major AI developers under UK data protection law beginning in 2025. Ten companies - including OpenAI, Google, Microsoft, Amazon, Anthropic, Apple, Meta, and others - agreed to change their practices or committed to doing so, while the ICO paused engagement with xAI to pursue a separate formal investigation into the Grok chatbot. The ICO announced these outcomes on October 8, 2026.
Who Is Affected
UK users of AI services from the ten companies are directly affected, as the commitments aim to provide clearer explanations of how their personal data is used in AI training and easier processes to exercise data rights such as access and deletion requests. The broader changes may influence how these global companies handle personal data for users in other jurisdictions as well.
Why It Matters
This marks one of the first major regulatory actions requiring AI developers to improve transparency and user control over personal data used in model training under existing data protection law. The ICO identified unresolved challenges including how to remove personal data from already-trained models and prevent extraction of sensitive information, issues that will require ongoing collaboration between industry, regulators, and government. The regulator's separate investigation into autonomous AI agents signals that compliance expectations will extend to emerging AI capabilities.
What You Should Do
Check the privacy information and data control settings for AI services you use from the ten named companies, as they are updating their explanations of data use and rights request processes. If you want to exercise your data rights - such as requesting information about how your data was used or asking for deletion - use the updated processes these companies are implementing. Watch for further guidance from the ICO as it develops its statutory code of practice on AI and automated decision-making.
Summary generated from verified sources and reviewed before publication. How we summarize.