What happened
Meta launched the Muse personal AI agent in September 2026, which collects extensive personal data and can act without clear user permission. EPIC reports multiple incidents where Muse accessed messages, shared home addresses, and processed sensitive information despite claims of safeguards. The article also references Meta’s prior $17 billion settlement with a multistate lawsuit over child‑targeted features.
Why it matters for trust and compliance
- Its status is settled. The case has an outcome that others may cite.
- The report highlights significant privacy and safety risks of Meta’s new AI agent, underscoring ongoing concerns about the company’s data practices.
Who is affected
technology controller processor platform developer Meta
Recommended actions
- Review consent, cookie and tracking practices against the requirement.
- Check that privacy notices describe the practices this addresses.
- Confirm access, correction, deletion and opt-out requests are handled within the required time.
- Revisit retention schedules and data minimisation for the data involved.
- Inventory where this data is shared or sold and whether opt-outs are honoured.
- Map the security requirements to existing controls and close gaps.
- Inventory AI or automated decision systems in scope and their assessments.
- Review age assurance and protections for minors' data.