A response to ICO’s AdTech 3.0: Online advertising in the age of LLMs and agentic AI
My comments on the ICO’s AdTech 3.0 Report, 13Nov’26:
The ICO is right that the law itself doesn’t need to change to accommodate LLMs and agentic AI. However, as advertising ecosystems grow exponentially more fragmented and complex (a natural rise in systemic entropy) the way we approach, measure, and enforce compliance must evolve dramatically. And this is doable, now.
Here are 3 core thoughts and critical gaps that require our immediate focus:
1. Turn the technology in on itself for “Privacy by Design”: Privacy by design isn’t just essential; it CAN – and therefore MUST – be engineered directly into the very AI systems driving this complexity. We should use agentic systems to manage, verify, and enforce privacy boundaries at scale, rather than treating compliance as an external bolt-on. We talk about privacy being built-in: it can be using the tech. (No alternative I’m aware of.)
2. Proactivity, policing, and human oversight: Because there are infinitely more moving parts to measure, passive guidance isn’t enough. Meaningful human input remains non-negotiable, and regulators must shift toward more proactive policy and standards and enforcement rather than simply issuing updated advice. The law doesn’t need to change, but policing does – more effort on how and what to report should be the focus.
3. Audience-specific guidance: Future regulatory documentation needs to account for the distinct users managing these systems. Guidance must be tailored to each each – and bridge the gap between – marketing, legal counsel, technologists (and the end-user public), rather than treating the ecosystem as a monolith. (This is more important than the relatively unhelpful distinction between “MarTech” from “AdTtech” in this context, as both disciplines require in principle the same privacy and governance solutions.)
[A note on curbing inference and enforcing proportionality: As systems gain the ability to infer sensitive personal data from complex, conversational inputs, the risk of “purpose creep” and personal harm rises. We naturally fear that autonomous AI will struggle with restraint; therefore, proportionate data use needs more emphasis and technical guardrails. This area needs more attention, but is a detail relative to the overall fundamental and structural standards necessary, and feasible now.]
An implementable – tactical – wave of standards possible to stem the flow; then a directional – strategic – approach to ‘prompt’ the flow. The answers lie within AI itself: the only thing that will keep pace with it.
You cannot govern an exponentially complex, autonomous ecosystem (that will grow worse, fast) with passive guidance and manual checklists alone. While UK data laws remain fit for purpose, AdTech 3.0 demands that we build privacy directly into the AI architecture itself – and this can be done now – and back-up the clear, role-centric guidance with active tangible specific regulatory standards for policing.”
How is this made possible now for Marketing and Legal? Just ask us.
RG
