OpenAI wants agents to tell websites where you are (joost.blog)

OpenAI engineers have proposed a draft to enhance the way AI agents communicate with websites by allowing them to share user network information, including a masked IP address, country, locale, time zone, and user agent. This Internet-Draft aims to improve interactions by enabling websites to identify the context of user requests better, potentially solving issues where agent traffic faces barriers like CAPTCHAs due to appearing atypical. However, it raises significant privacy concerns as it effectively reduces the anonymity currently enjoyed when AI agents browse on behalf of users. The draft introduces six new optional parameters to the existing Forwarded header, which could result in agents inadvertently compromising user privacy for the benefit of companies managing these agents. It lacks mechanisms for validating the authenticity of the reported signals, posing risks of misuse and raising questions under GDPR guidelines, as these data points combine to constitute personal data. Critics argue that the draft should be more stringent, requiring explicit user consent and signatures for data transmission, effective only in relevant scenarios like logins or transactions. The discussion underscores the need for careful consideration of privacy as AI agents increasingly become integral to web interactions.