Spain's data protection authority, the AEPD, published a 12-page, ten-point guide on October 27, 2026 for people who let AI assistants and agents read email, manage calendars or buy on their behalf. It recommends giving agents only the access a task needs, avoiding blanket "always allow" permissions and keeping a confirmation step before an agent sends, pays, signs or accepts terms. The agency's press release sums up the principle: the agent prepares and the individual approves.
The guide says limits written into an instruction "do not replace permissions and confirmations." It warns that websites, emails, PDFs and calendar invitations can carry hidden instructions and says no measure completely eliminates that risk. It also tells users that records created when an agent uses a third-party service, such as an online shop, fall outside the assistant's controls and must be deleted at each service, and to switch off marketing uses of their data where allowed.
A final page lists seven controls the AEPD says providers should offer, including understandable permissions, configurable confirmation, a history of agent actions and clear information on data sharing and AI training. PPC Land notes the list cites no GDPR article or AI Act provision, names no company and sets no deadline, and the guide is advisory.
The press release cites a case in which an agent with "always allow" permissions closed a sale and gave the seller's address to the buyer. The AEPD did not name the platform; PPC Land reports the account matches an Associated Press report about Meta's Muse agent on Facebook Marketplace.