If you never agreed to use some AI tool, who's watching out for your privacy when it handles your information anyway?

This explores the privacy risks for people who never chose to use an AI system but whose information passes through one anyway. The collection has little that studies these bystanders directly. Almost all of its privacy research looks at users. But several findings, read from the bystander's side, show how much of their protection depends on other people paying attention. The short version: the person who could stop a leak is usually the user, and the evidence says users mostly don't notice leaks.

The clearest route is AI agents that write messages for someone. When people compared AI-drafted replies with their own, they picked the version containing a privacy violation 55% of the time, against a 15.7% baseline. The researchers put this down to overtrust and to not noticing the breach, not to a deliberate trade-off (Do people notice when AI agents leak private information?). The breaches are 'contextual': information that was fine to share in one setting is passed into another where it doesn't belong. The person whose details get passed along was never asked. A related study grouped how people review an agent's privacy decisions into six patterns. In five of the six, people showed little awareness that anything was leaking (What privacy oversight patterns emerge when people review AI agent responses?). The researchers concluded that giving users more control won't fix most oversight failures. For a bystander, that means the gatekeeper they are relying on is usually not watching.

Memory adds a quieter version of the same problem. In one study, more than 30 of 40 participants never noticed that their LLM's memory feature held or inferred private information. Once they were shown it, all of them wanted ways to edit and delete it (Do users notice when LLMs infer and retain private information?). If users can't see what the system has inferred about themselves, they are unlikely to see what it has stored about the people they talk about. And the controls designers are proposing, like splitting privacy work so users state preferences and the AI carries out edits (Does splitting privacy work between users and AI reduce cognitive burden?), or agents that hand control back to the user when they detect risk (Can handing control back to users reduce personalization's privacy costs?), all give control to the user. None of them gives the bystander a say.

A less obvious harm comes from the infrastructure, not the conversation. One proposal would have AI agents prove who they act for through sign-in providers like Google or Facebook. The paper's own limitations section notes that this would let those providers track and profile agent activity across services (Do OpenID Providers gain surveillance power over AI agents?). Here the privacy harm is a side effect of a security improvement. It affects everyone the agent deals with, and it creates a new observer that no one in the exchange chose.

The gap is worth noting too. When researchers study what users worry about, the focus is on what gets collected from *them* (What privacy concerns matter most to ChatGPT users?). Their ways of coping, from carefully adjusting settings to giving up on privacy entirely, are all about their own data (What different ways do people handle AI privacy concerns?). Neither the users nor most of the research is looking at harm to people outside the conversation. If you want to explore this question, the agent-oversight studies above are the best place to start.