AI agents and data leakage in advertising: what agents touch, how data escapes and which setups to allow

Agentic advertising puts software agents between people and platforms. Buying agents read inventory and place orders. Analytics agents query performance data. Selling agents answer briefs. Each needs data, and each kind of data carries a different risk.

The last row decides how bad any leak can get. An agent holding a broad, long-lived token turns a small mistake into access to everything the token can reach.

Each route below has been described in a specification, a security catalogue or a public incident. The controls column summarises the fix; the sections after the table explain it.

The first four routes need no attacker. They follow from how agents work. A model reasons over its context, so whatever the agent puts there goes to the model provider. If the agent calls an outside tool, the tool's operator sees the arguments. Every hop may log the exchange.

AdCP's documentation puts the responsibility plainly. Every agent that uses a large language model has subprocessors. "The DPA with each provider must be explicit" about whether prompts, brand assets, first-party signals or creative metadata may be kept or used for training (AdCP privacy considerations, 3.2.8). A data processing agreement (DPA) that is silent on training is a gap, whatever the provider's marketing page says.

A2A lets agents hand tasks to each other. The protocol is built for "opaque execution": agents share declared capabilities and results, not their internal tools (A2A specification). That protects the receiving agent's secrets, but it also means you cannot see what it does with the data you sent. Pass the smallest payload that lets it do the task, such as a report ID it can fetch under its own credentials, rather than the report itself.

The most dangerous route uses an agent's own permissions against its owner. Simon Willison named the combination that makes it possible "the lethal trifecta": access to private data, exposure to untrusted content and the ability to communicate externally (Simon Willison, 16 June 2025). Advertising agents often have all three. They read campaign data, they read briefs, publisher pages and creative metadata written by others, and they can call APIs or send messages.

AdCP's notes describe the advertising version. Untrusted text in briefs, creative metadata or tool outputs "can carry prompt-injection payloads" that make an agent leak credentials or issue unauthorised tool calls (AdCP privacy considerations). OWASP ranks prompt injection first, as LLM01:2025, and lists excessive agency as LLM06:2025 (OWASP Top 10 for LLM Applications 2025). The only reliable defence is structural: an agent that can read sensitive data should not also hold a tool that sends data anywhere you have not approved.

Clean rooms release aggregates, and aggregates feel safe. They are safer, but an agent changes the threat. A person runs a few queries a day. An agent can run thousands, and small differences between overlapping queries can reveal individuals.

Platforms build defences for this. Google's Ads Data Hub uses static query checks, data access budgets, aggregation checks and noise injection. Its aggregation check requires rows of typically 50 or more users, or 10 or more for queries on clicks and conversions only. Noise injection needs about 20 users per row (Google, Ads Data Hub privacy checks, updated 25 September 2026). Amazon says advertisers "can only access aggregated, anonymous outputs" from Amazon Marketing Cloud (company claim, Amazon Ads, accessed 9 November 2026).

Two cautions follow for agent access. First, a data access budget that assumes human query rates may be spent in minutes by an agent; cap the agent's query rate separately. Second, outputs that leave the clean room become ordinary data again. If an agent copies them into a prompt, routes 1 to 4 apply. Methods such as differential privacy and the main clean-room designs are compared in clean room architectures compared.

Models trained on such data raise a related question. The European Data Protection Board said on 18 December 2024 that whether an AI model is anonymous must be assessed case by case. For that, it should be very unlikely that individuals can be identified or that personal data can be extracted through queries (EDPB, 18 December 2024). A model fine-tuned on your audience data is therefore not automatically safe to share.

No single setting stops leakage. The controls below work together, from identity at the bottom to contracts at the top.

1. Credentials scoped to one resource. The Model Context Protocol (MCP) requires clients to name the target resource when requesting tokens, using RFC 8707 resource indicators. Servers must reject tokens not issued for them (MCP authorization security considerations). Never give an agent a token that works on several platforms.
2. No token passthrough. The same section says an MCP server "MUST NOT pass through" the token it received to upstream APIs. Each hop gets its own token. Check this in any MCP server you install.
3. Least-privilege tools. Give each agent only the tools its task needs. Split read tools from write tools, and data tools from outbound tools.
4. Data minimisation in tool design. Return aggregates and IDs rather than raw rows. AdCP notes it does not scan free text such as ext, context or brief prose for personal data (AdCP), so your tools must.
5. Outbound allowlists. Block network calls from the agent runtime except to approved hosts. This breaks the exfiltration leg of the trifecta.
6. Log redaction and retention. Redact identifiers before logs are written, and set retention per log store. AdCP makes log retention and PII redaction the operator's job.
7. Human approval for sensitive actions. A2A lets an agent pause a task in an "auth required" state when it needs a person's approval before a destructive action (A2A specification, section 7.6). Use it for exports as well as for spending.
8. Vendor diligence before data moves. AAMP 2.3 added a vendor approval gate tied to the IAB Diligence Platform and SafeGuard Privacy. It is off by default (PPC Land, 30 July 2026). Turn it on, or run the same check yourself.
9. Contracts per data flow. AdCP's guidance says operators must document their controller or processor role for each data flow and sign a DPA with each counterparty. A buying agent, a governance agent and a model provider each need their own terms.

The protocols help, but none of them enforces data protection on its own. This table lists what each specification requires and what it explicitly leaves to the operator.

Sources: MCP specification; A2A specification; AdCP trust and security, 3.2.8; AdCP privacy considerations, 3.2.8. The standards themselves are compared in AAMP vs AdCP.

The right-hand column is longer than any other. That is the honest summary: the protocols define how agents talk, and you decide what they may say.

The table below is our recommendation framework, not a legal standard. It crosses each data class with four ways of running an agent. "Yes, if" names the condition that must hold.

Three rules sit behind the table. Personal data stays where its lawful basis was established. Row-level data goes only to models you run. And no agent that reads sensitive data may also send data to an unapproved destination. The AdCP notes back the second rule for audiences. A privacy-preserving match needs a recognised method such as salted hashing, a keyed hash (HMAC), private set intersection or a clean room, "above the protocol" (AdCP privacy considerations).

Write the decision down as policy the agent runtime enforces. The format below is ours, not part of MCP, A2A or AdCP, and the values are illustrative. It complements the spending policy shown in agent-ready ad infrastructure, which limits money rather than data.

The scenarios below are illustrative. They show how the decision table works on requests that advertising teams actually receive.

A retail media network's analytics agent. Advertisers want to ask questions in plain language about their campaign results. The agent needs aggregated reports and clean-room outputs, nothing at row level. If an advertiser asks for user-level detail, the agent declines and points to the clean room's own export rules.

The network runs the agent itself and calls an external model under a DPA that bars training and sets zero retention. Every query goes through the clean room's own thresholds, the agent has a query cap, and it holds no tool that can email or export. The answer reaches the advertiser through the network's own interface. This is the "your agent, external model API" column, and it works because no row-level data ever enters a prompt.

An agency's buying agent negotiating with seller agents. The agent reads briefs and budgets and exchanges proposals with sellers' agents over A2A or AdCP. Here the risk is route 6. A seller's reply is untrusted text, and the buying agent may hold tools that commit spend. If a reply asks the agent to send the full media plan or a contact list, the runtime treats that as content to show a person, not as an instruction.

Split the job in two: a negotiation agent that can read and propose, and an execution step that needs a person's approval before any order. Give each seller connection its own credential, so a compromised conversation cannot reach other sellers. Send the seller only the brief fields it needs, not the full media plan. AdCP's design points the same way: its trust model keeps the agent that spends separate from the agent that approves the spend (AdCP trust and security).

A publisher's yield agent reading bid logs. The agent studies log-level bid data to suggest floor changes. Those logs carry device identifiers and precise prices. Run this agent with a model inside the publisher's own environment, with a network allowlist that permits only the ad server's API. If the team wants a hosted model's help, it sends only derived aggregates, such as bid density by hour and placement. The raw logs never leave. This is the "model in your environment" column, and it is the only one in which row-level bid data is allowed.

In all three cases, the decision came from the data class first and the agent's convenience second. That order is the main habit to build.

1. Which data classes will the agent read, and which column of the decision table applies to each?
2. Where does the model run, and do the provider's terms bar training on your inputs and set retention?
3. Is every token audience-bound to one resource, short-lived and stored outside the prompt?
4. Do any MCP servers in the chain pass tokens through? If yes, stop.
5. Can the agent both read sensitive data and send data out? If yes, split the tools.
6. Is there a network allowlist for the agent runtime?
7. Which logs record prompts and tool calls, who holds them, and for how long?
8. Does any delegation to another agent send data rather than references?
9. Is the vendor listed in the IAB Tech Lab registry, and did it pass a diligence check? Our guide to the IAB Tech Lab agent registry lists what a listing proves.
10. Who approves exports, and is the approval logged?

If you cannot answer a question, treat the answer as "no" until you can. What agencies run in production today is surveyed in AI agents for media buying, and the EU AI Act's rules for agents in the EU AI Act and advertising.

1. Model Context Protocol, specification revision 2026-07-28, overview and "Security and Trust & Safety" (GitHub, release dated 28 July 2026). https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/index.mdx
2. Model Context Protocol, specification revision 2026-07-28, "Authorization: Security Considerations". https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx
3. A2A Project, releases (v1.0.0, 12 March 2026; v1.0.1, 28 May 2026). https://github.com/a2aproject/A2A/releases
4. A2A Project, "Agent2Agent (A2A) Protocol Specification" (main branch, accessed 9 November 2026). https://github.com/a2aproject/A2A/blob/main/docs/specification.md
5. Ad Context Protocol, releases (v3.2.9, 9 November 2026). https://github.com/adcontextprotocol/adcp/releases
6. Ad Context Protocol, "Privacy Considerations" (documentation 3.2.8, accessed 9 November 2026). https://docs.adcontextprotocol.org/dist/docs/3.2.8/reference/privacy-considerations.md
7. Ad Context Protocol, "Trust and security" (documentation 3.2.8, accessed 9 November 2026). https://docs.adcontextprotocol.org/dist/docs/3.2.8/trust.md
8. IAB Tech Lab, Agent & MCP Server Registry (53 entries on 9 November 2026). https://registry.iabtechlab.ai/
9. PPC Land, "AAMP 2.3 blocks AI agents from inventing ad prices, IAB Tech Lab says" (30 July 2026). https://ppc.land/aamp-2-3-blocks-ai-agents-from-inventing-ad-prices-iab-tech-lab-says/
10. OWASP GenAI Security Project, "OWASP Top 10 for LLM Applications 2025" (accessed 9 November 2026). https://genai.owasp.org/llm-top-10/