From privacy policies to machine-readable governance: Rethinking data control in the age of AI

For decades, privacy programs have relied heavily on documentation to communicate how personal data is collected, used and shared. Privacy notices, consent banners and internal policies have served as the primary interface between organizations, regulators and individuals. 

This model worked reasonably well when data processing was relatively stable and systems were largely human-operated. But the rapid adoption of artificial intelligence and automated data processing is placing increasing strain on that approach.

Today, a growing share of data interactions are initiated and executed by machines like web crawlers, large language models and autonomous agents among them. These systems do not interpret privacy expectations the way human readers do. The result is a widening gap between how privacy requirements are expressed and how data is actually accessed and used.

A growing disconnect between policy and practice

Regulatory expectations continue to emphasize transparency, purpose limitation and user control. At the same time, modern digital systems are becoming more dynamic and distributed and that combination creates real challenges for privacy teams.

Privacy policies are often written at a fixed point in time, while the underlying systems they describe evolve continuously. Third-party integrations can introduce new data flows that existing disclosures never anticipated. Consent mechanisms may not always align with the technical behavior of scripts, trackers or application programming interfaces operating on a site. These gaps are not necessarily the result of intentional noncompliance. More often, they reflect the difficulty of keeping legal documentation synchronized with complex, rapidly changing technology.

The persistent question for privacy programs is this: how can organizations ensure that what they say about their data practices accurately reflects what their systems are doing in real time?

Lessons from earlier internet governance models