When you tell an AI about your health, you may expose your family

Ask an AI tool about an eye disease, and you may end up telling it about your family. Catherine Tucker, a professor of management at MIT Sloan, says that is a weakness in how privacy rules work today. Relatives who never agreed to share their health history can be exposed by one person's question.

What the researchers found

Tucker and Rozhina Ghanavi, a PhD candidate at MIT Sloan, gave an example. A person asking about macular degeneration, an eye condition, might mention a family history to get a useful answer. That reveals information about relatives. As Tucker put it, the person who gets the benefit does not necessarily bear all the costs.

Most privacy rules were built around one person approving each disclosure. Tucker said they focus on data that is sensitive by itself. But ordinary details can point to personal traits when combined with other details.

Agents and deleted files

AI agents are programs that act for you, with access to things like email, calendars, customer records or payment systems. Ghanavi said that with these tools, consent does not go directly to data. It goes to a permission. That raises questions about how long access lasts, how it ends, and what the agent keeps.

Deletion is also murky. Ghanavi used artwork submitted to an AI model as an example. Removing the original after the model was trained on it does not necessarily remove what the model learned from it.

Why it matters for competition

The researchers say privacy rules will also shape who can build competing AI products. Compliance costs can favor companies that already have established customer relationships. Ghanavi studied how California's consumer privacy law affected mergers in advertising technology. Firms without their own customer data sought deals with companies that had it.

She expects a similar pull in AI. Companies that build the large AI models may buy apps to get user interactions directly. Tucker said regulators should look at how first-party data (collected directly from users) and third-party data (obtained from others) are treated. Buying an app changes the business relationship, even if the information stays the same.

What to do

• Think before sharing family health details with an AI tool, since they involve other people.
• Be careful with work details too, for the same reason.
• Before giving an AI agent access to email, calendars or records, check what it can see.
• Find out how to end that access before you grant it.

What is not known yet

The material describes research and views, not new rules. It does not say whether regulators will act, or how any company currently handles deletion requests.