Artificial intelligence is becoming more deeply integrated into everyday life, while public confidence in the technology remains unsettled. In a June 2026 survey, Pew Research Center found that 52% of Americans felt more concerned than excited about the increasing use of AI in their daily lives. Only 9% said they felt more excited than concerned. Rather than interpreting this concern as resistance to technological progress, it may be more accurately viewed as a reasonable question about what individuals are giving up in return for convenience.
The privacy challenge goes far beyond the risk of a conventional data breach. The National Institute of Standards and Technology has warned that generative AI systems can leak, generate, or infer sensitive information. NIST also highlights how AI systems can combine information from different sources to derive details that an individual may never have directly disclosed. In this environment, protecting an account remains important, but it does not address the broader question of how much information an AI system should have access to or retain.
This issue applies across both professional and personal settings. A request to summarize a confidential document, interpret a medical record, or draft a message involving a family disagreement can reveal substantially more context than a user intended to share. The way that information is handled can vary depending on the service, subscription, configuration, and contractual arrangement. For that reason, sweeping claims about every AI platform would be misleading. The more important consideration is whether users can understand and effectively control what happens to their information.
Privacy regulation already provides one useful principle for approaching this issue. The U.K. Information Commissioner’s Office recommends determining the minimum personal information required for a specific purpose and processing no more than necessary. Its AI and data-minimization guidance also encourages organizations to map where personal data enters machine-learning processes. This reframes privacy as a design consideration that should be addressed before information is accessed, rather than simply a notice provided after collection.
Mark Alicz, an AI research and security consultant, believes this principle should play a central role in the next phase of AI adoption. His philosophy prioritizes privacy and security before simply expanding technological capabilities. From his perspective, organizations often begin by focusing on what an AI model can accomplish and address governance only after the system has already been connected to documents, workflows, and networks. Alicz believes that process should be reversed.
For Alicz, controlling access is an essential starting point. An AI system created for a specific task may not need unrestricted visibility into an organization’s files or a household’s wider digital environment. Instead, access can be limited according to a clearly defined purpose, while particularly sensitive information can remain separated from routine AI use. He also sees local or otherwise tightly controlled processing as one potential approach for reducing the amount of information transmitted to external systems, while acknowledging that it cannot eliminate every privacy concern.
“Local processing, however, should not be regarded as an automatic guarantee of privacy,” Alicz says. He acknowledges that security can still depend heavily on how a device or system is configured, maintained, and managed. NIST likewise recognizes that privacy-enhancing approaches can involve tradeoffs, including potential effects on accuracy under certain circumstances. The broader objective, Alicz explains, is to ensure users have a clearer understanding of what an AI system can access, when information may leave their environment, and how long that information may remain available.
For businesses, these considerations are likely to become increasingly important during procurement and implementation. Alicz encourages organizational leaders to assess the sensitivity of the information involved, examine system permissions, review retention and training policies, and determine whether the requested level of access is appropriate for the intended use. Depending on the application, businesses may also consider stronger technical protections or contractual limitations. Addressing these questions early, he believes, can create clearer expectations before an AI system becomes deeply embedded within everyday operations.
Consumers face a comparable challenge when deciding what information they are willing to share with an AI service. Alicz believes individuals should be able to recognize when an interaction could involve health, financial, or family-related information without needing specialized knowledge of the technology behind it. As AI becomes increasingly common, he expects privacy and user control to become more important factors in how people evaluate these services. In his view, this could encourage providers to make decisions involving storage, connectivity, and deletion more transparent and easier for users to understand.
For Alicz, greater model capability should not be the sole measure of progress in artificial intelligence. He believes privacy and user control should also play a larger role in evaluating how these systems evolve. From his perspective, meaningful progress would mean developing AI that remains useful and capable while requiring less unnecessary information and giving individuals clearer, more understandable choices about what they share.
