A consumer types into her browser: "Find me the best fertility clinic my insurance covers and book an appointment."

Then she goes to make coffee. While she is gone, the browser's AI agent reads her email for the insurance card; pulls her location; visits six clinic websites; clicks "Accept All" on five cookie banners; enters her name, date of birth, member ID, and reason for visit into two intake forms; and accepts a patient portal's terms of use.

When she returns, a confirmation email is waiting. Who consented to all of that?

Nearly every mechanism in U.S. privacy law, including notice, consent, opt-out, and "consumer-directed" disclosure, assumes a human being is on the other side of the screen.

Google's help documentation for Chrome's auto-browse feature says the agent can reach every site the user can, including sites where she is signed in, chooses which sites to use, draws on connected apps such as Google Workspace, and may share her information, including information she would consider sensitive, with those sites.

Google also warns that the agent may misread the request or the site and take unintended actions.

Mozilla's Smart Window carries its own privacy notice describing an assistant that processes browsing activity to learn how the user uses the web. NIST's February 2026 concept paper, "Accelerating the Adoption of Software and AI Agent Identity and Authorization," asks the infrastructure version of the question: how an agent proves its authority and how its actions are bound back to a human's authorization.

Privacy law must ask the doctrinal version. Contract law settled this long ago.

Under Uniform Electronic Transactions Act § 14 and the E-SIGN Act, 15 U.S.C. § 7001(h), a contract may be formed by electronic agents even if no individual reviewed their actions, so a terms-of-use box checked by the consumer's AI has a path to enforcement. Privacy consent is built differently. The California Consumer Privacy Act defines consent as a "freely given, specific, informed, and unambiguous indication of the consumer's wishes" by the consumer or by a guardian, attorney-in-fact, or conservator, and other states' opt-in sensitive-data provisions use similar formulations.

These are state-of-mind standards: "informed" describes what a person knew; "specific," what she contemplated. Agency law does not close the gap. The Restatement (Third) of Agency treats a computer program as an instrumentality, not an agent, so imputation of an agent's knowledge to its principal does not run between people and their tools.

Whether software can be "informed" on the consumer's behalf is a question no statute answers. The best current authority is Amazon.com Services LLC v. Perplexity AI, Inc., 184 F.4th 1083 (9th Cir. Aug. 4, 2026), where the Ninth Circuit vacated a preliminary injunction against Perplexity's AI agent, concluding that the user, not Perplexity, "accessed" Amazon's computers under the Computer Fraud and Abuse Act.

The panel treated the assistant as a tool, not a person, while confining its ruling to the record before it.

If that reasoning carries into privacy law, the consumer made every disclosure in the hypothetical, and the CCPA's exclusion for disclosures the consumer "intentionally" directs starts to fit. But she intended an outcome, not the path. She did not choose the six clinics or decide that her member ID should go to the two that were out of network. A disclosure strictly necessary to the task is probably authorized; one merely convenient for the agent probably is not.

Nobody has litigated where the line falls. Sensitive data sharpens the problem. Washington's law requires consent to collect consumer health data and separate consent to share it, rejects consent buried in general terms, and carries a private right of action.

A clinic that receives an agent-populated fertility intake form holds health data on the strength of consent no human ever expressed to it. For litigators, banner clicks may be the most immediate problem.

The standard defense to a California Invasion of Privacy Act § 631 or pen- claim is consent, proven by a consent-management-platform log, and an agent's "Accept All" looks identical to a human click in that log. Plaintiffs will argue that consent must come from a party to the communication, and the consumer never saw the banner.

Defendants will respond, citing Perplexity, that the agent is a tool, so its click is the user's click. Both arguments are credible, and at $5,000 per violation, uncertainty is expensive. An agent can transmit a GPC signal.

The harder question is whether it can override one. California's regulations require businesses to honor the signal but allow them, when it conflicts with a financial incentive program, to ask for consent to override. A helpful agent that meets the prompt "Allow sharing to keep your loyalty discount?" on the way to a purchase may click yes, erasing a choice the consumer deliberately set.

The stakes rise January 1, 2027, when California's Opt Me Out Act (AB 566) requires browsers to offer built-in opt-out signals. The browsers shipping the signal will ship the agents capable of overriding it.

Under the CCPA, an "authorized agent" is a natural person or business entity. An AI model is neither, so the company operating it must fill that role and answer for every request its software submits.

Several other states allow consumers to designate an agent through technology, such as a browser setting or extension; those provisions contemplated static signals, but their text covers a system that actively submits requests.

A privacy notice read only by software still satisfies the posting obligation and binds the business under Section 5 of the FTC Act and state UDAP law, but it does not inform the consumer.

Notice-and-choice has long rested on the fiction that people read these documents; agentic browsing replaces the fiction with a record showing that no human read anything. Website operators should:

•Stop treating a banner click as conclusive proof of human consent. Detect and log agent traffic.

•Require human confirmation for sensitive-data collection and any consent that must be "separate" or "specific."

•Avoid GPC-override and financial-incentive prompts that an agent can dismiss with a single click.

•Build an intake path for agent-submitted opt-out and deletion requests. Companies building agents should:

•Default to data minimization, disclosing only what the task strictly requires.

•Preserve existing privacy signals and escalate to the user, not around her, before accepting tracking, agreeing to terms, or transmitting sensitive data.

•Maintain an auditable log tying each disclosure to the user's instruction; it will be the first thing a regulator asks for.

Consent, direction, and choice describe human behavior. They can survive an intermediary, as they survived guardians and powers of attorney, but only where the intermediary's authority is defined, its actions are attributable, and the human's actual wishes remain the measure.

The law does not yet supply those conditions for the browser that speaks for us. Until it does, the prudent assumption is that the consumer authorized the task and nothing more.

Sara H. Jodka is a partner at Dickinson Wright PLLC, where she practices data privacy and cybersecurity law. She is based in Columbus, Ohio, and can be reached at sjodka@dickinsonwrighm.