FPF Launches Roundtable Series on Agentic AI, Privacy, and PETs

On October 19, 2026, the FPF Center for Artificial Intelligence launched a four-part virtual roundtable series on Agentic AI. In the first roundtable, Agentic Data Flows: Privacy, Data Minimization, and PETs in Agentic Deployment, guest experts explored a taxonomy of agentic AI privacy harms, and discussed implementation challenges and enterprise risks across the AI value chain.

The series is part of FPF’s Privacy-Enhancing Technologies Research Coordination Network, which is funded by the National Science Foundation (NSF) and the Department of Energy (DOE), and is presented in collaboration with Working Paper.

Stacey Gray, FPF’s Senior Director for Artificial Intelligence, opened the roundtable, which featured presentations from Bennett Hillenbrand, Co-founder and President of Working Paper and Adjunct Professor at Georgetown University’s McCourt School of Public Policy; Andrew Gruen, Principal Consultant at Working Paper and FPF Senior Fellow; Jaspreet Bhatia, Staff Privacy Engineer at Google; and Antigoni Polychroniadou, Executive Director at J.P. Morgan AI Research and the AlgoCRYPT Center of Excellence. Each took up a different piece of the problem:

• Agents, privacy risk, and PETs: Bennett Hillenbrand (Working Paper) offered a practical definition of an agent as a large language model that can call tools, and used a multi-agent shopping example to show how agents reshape existing privacy risks more than they create new ones. Hillenbrand also noted that relatively few AI developers were using advanced PETs even before agents arrived, leaving the field with ground to make up.
• A taxonomy of agentic privacy risks: Andrew Gruen (Working Paper and FPF) introduced a new taxonomy of 24 agentic privacy risks across five domains, ranging from data collection and aggregation to legacy consent and accountability. Released as version 0.1 for public feedback, the taxonomy is designed to support benchmarks that test AI systems against these risks before they are deployed.
• Implementation challenges: Jaspreet Bhatia (Google) explained why static, yes-or-no permissions fall short for autonomous, probabilistic agents. Bhatia highlighted consent fatigue, the absence of standard protocols for agents to negotiate privacy terms with one another, and deletion requests that never reach agents that have already received a user’s data.
• Enterprise risks across the application lifecycle: Antigoni Polychroniadou (J.P. Morgan AI Research) traced enterprise risks from agent identity and human approval through execution integrity and liability. Polychroniadou proposed specific controls, including cryptographically binding agents to the users who authorize them, machine-readable intent, deterministic enforcement, and zero-knowledge proofs, with data minimization applied first.

A common theme emerged across these presentations: many of the safeguards built for conventional software, such as one-time permissions, up-front consent, and free-text instructions, do not map neatly onto agents. Because what an agent shares, infers, remembers, or passes along is decided step by step, often out of the user’s view, controls must be built to apply to each action. As one presenter put it, “a login is not enough.” Speakers also pointed to a tension at the heart of agentic design: the broad context and persistent memory that make agents useful is in direct tension with the principle of data minimization.

Future roundtables will take up many of these open questions, including how agents should negotiate privacy terms with each other, how deletion and consent withdrawal can reach every downstream agent, how to confirm that a person actually approved an action, who is responsible when an agent makes a mistake, and how to incorporate privacy-enhancing technologies effectively. 

Interested in receiving more information about events like this? Email us at [email protected].

The Research Coordination Network (RCN) for Privacy-Preserving Data Sharing and Analytics is supported by the U.S. National Science Foundation (Award #2413978) and the Department of Energy (Award #DE-SC0024884).