In October 2026, the Organisation for Economic Co-operation and Development (OECD) published a policy brief, “Enhancing user control and privacy protections in the context of AI.” It notes that building machine-learning models often requires large volumes of high-quality data, which may purposefully or inadvertently include personal data, creating a dual need to keep data accessible while protecting privacy and users’ control over their information.
The brief identifies two major sources of training data: user interactions with generative AI systems such as consumer chatbots, and the scraping of publicly available web content. It also points to the growing use of Retrieval Augmented Generation, which brings external information into AI systems in real time.
Among its key messages, the OECD says chatbots should tell users how their prompts are processed and whether they will be used for training, and it sees scope for more granular controls with “just-in-time” transparency. It warns that personal data can become embedded in model weights, making correction and erasure difficult, and that increasingly autonomous AI agents will challenge traditional data-protection principles.
The brief offers a practical lens on protecting the dignity of persons whose data shapes AI systems.
