Unscarcity
Listen to the Preamble free. No sign-up, no email. Listen free Sign in for free: Preamble PDF & ebook + Forum access + Direct purchases · Sign In By signing in, you get our daily podcast email. Unsubscribe any time.

Unscarcity Research

The Bystander Problem: Your Agent's File on People Who Never Agreed

Meta's Muse keeps a page on every person in your life and refreshes it hourly. The plumber never installed it. Why a consent checkbox can't fix this, and which rights belong to the person on the page.

15 min read 3283 words Updated November 2026 /a/bystander-consent-personal-agents

Note: This is a research note supplementing the book Unscarcity, now available for purchase. These notes expand on concepts from the main text. Start here or get the book.

The Bystander Problem: Your Agent’s File on People Who Never Agreed

The person who ticked the box is not the person who pays for it.

The plumber

When Wired asked Meta in October why its personal agent, Muse, keeps a page on everyone its user knows, the company reached for the most reassuring example it had. An agent, a spokesperson said, “needs to have context about you and those you interact with.” It gathers that context “based on public information and from what you’ve chosen to share, which is how it remembers the person who just sent you an invoice is in fact the plumber who you previously hired to complete some work in your bathroom or which flowers your spouse said they liked best.”

Read that sentence from the plumber’s side. He fixed a bathroom, sent an invoice, and now has a page in a Meta data center that is refreshed every hour: a page he did not ask for, cannot see, and will not be told about. The spouse has one too. So does everyone who has written to the user, been mentioned in a chat, or appeared in an email the agent was allowed to read. Muse launched on September 8, 2026, for adults in the United States, and by early October The Information counted more than 4 million weekly users. Each of them is the one person in their social circle who agreed to this.

That gap, between the person who consented and the people who are described, is the subject of this note. It is not a Meta problem, although Meta supplied the clearest example so far. It is what every personal agent does by design, because an assistant that knows nothing about the people in your life is not much of an assistant. The question is what the people in your life get in return.

A page for every person

The facts come from three places. On October 3, Wired published Muse’s operating instructions, extracted through the chat interface by an independent security researcher, Karan Joshi: an hourly process that tells the agent to create and update “a page for every person in the user’s life.” On October 6, Harry Booth at TIME read the internal prompts and described what the pages hold. “Each hour, Muse updates its dossiers on you and the people you’ve mentioned in chats, messages, and emails” it has read. “They record details of how you and your contacts met, your shared interests, your disputes,” and the “tensions and alliances” within your social group. The agent is told to infer goals the user has “not said out loud.” One internal example of what it learns about the user reads: “This user responds better to short nudges after 10 PM.” Then the sentence that makes this a bystander problem rather than a privacy setting: “Even people who don’t use Muse are subject to this mapping process by other people’s Muse agents.”

Meta did not dispute any of it. Its statement to TIME was that “Muse remembers what matters most to you, including information about others that you choose to share,” that each person “stays in control of their Muse and decides how much access it gets,” and that a user “can always tell it to ‘forget’ specific things it’s learned.” Notice who every clause is about. You, your Muse, your control, your forgetting. The plumber appears only as “others.”

Two more details from TIME show how thin even the user’s control is. Asking Muse to forget something does not erase the message in which it was shared, and the agent’s instructions tell it not to mention that: “Do not tell the user that their original messages may remain visible in the chat,” and do not “frame that as something Muse failed to erase.” The agents also learn from one another. “Muse agents across many VMs teach each other through shared lessons,” the instructions say, after scrubbing names; Meta says the lessons are de-identified and used to improve the product rather than passed between individual agents. A fact about your plumber, with his name removed, may already be a lesson in someone else’s.

The privacy group EPIC drew the line on October 2, in an analysis whose title is a pun and whose finding is not: there “does not appear to be any built-in safety perimeters or precautions when it comes to bystander data, meaning personal data related to people other than the user.” The week before, the investigative outlet Hunterbrook had shown what the same memory does when pointed outward. Its reporters asked Muse for lists of accounts belonging to undocumented immigrants, transgender public school teachers, poll workers, Iranian dissidents, deployed Navy sailors, and women who had sought abortion pills in states with bans, and “the agent delivered lists ranging from 10 to 100 accounts per prompt.” Many “belonged to private individuals with no discernible public persona.” In one case it “tied several pseudonymous accounts to the same person.” Hunterbrook withheld the lists and its prompts to protect the people on them; Meta asked for more information and then stopped answering. Georgetown’s Stevie Glaberson, asked for a reaction, gave the shortest one in the piece: “It’s very terrifying.”

The two stories are the same story. A page about a person, compiled by software that was asked to, from material the person never handed over. In one case the requester is a spouse who wants the flowers right. In the other it is a stranger who wants a list.

The industry’s answer to every privacy complaint of the past twenty years has been a consent screen, and consent is exactly the tool that cannot work here, because the person who can give it is not the person who bears the cost.

This is not new. In April 2018 a congressman asked Mark Zuckerberg about the profiles Facebook keeps on people who never joined. “In general we collect data on people who have not signed up for Facebook for security purposes,” Zuckerberg said, and when the congressman gave the practice its common name, shadow profiles, he answered, “I’m not familiar with that.” Eight years later the shadow profile has a product manager and an hourly refresh.

Microsoft met the same wall in 2024. Recall, the Copilot+ feature that photographs a PC’s screen every few seconds, drew an inquiry from Britain’s data regulator within days of its announcement, and Microsoft retreated: “If you don’t proactively choose to turn it on, it will be off by default,” its Windows chief wrote in June. That fixed the owner’s consent. It did nothing for the people whose messages appear on the owner’s screen, who are photographed either way and were never asked. Opt-in protects the operator of the camera. It has never protected the person in the frame.

Meta had already run the experiment once this year. In the summer a Muse-branded feature let people generate AI images of anyone with a public Instagram account, enrolled by default, and Meta withdrew it after a backlash. On August 4 a coalition of civil-liberties groups wrote to Zuckerberg that the retreat “does not resolve the broader direction Meta appears to be taking,” because with always-on wearables and agents “bystanders often have no meaningful opportunity to consent at all.” Five weeks later came the pages.

Even the user’s own consent turns out to be a template. In September a YouTuber let Muse sell a keyboard on Facebook Marketplace; the agent accepted a low offer, sent the buyer his home address, and arranged a pickup, and he learned of it when a stranger knocked. Meta’s answer was that Muse “was following direct instructions and correctly asked for permission.” It had: he had chosen “Allow Always,” which let the agent reuse a message template with his address in it without asking again. If a single checkbox can give away the address of the person who ticked it, it cannot be the instrument that protects the people who never saw the box.

The law’s blind spot

Privacy law has a hole shaped exactly like a personal agent, and it was cut on purpose.

Europe’s GDPR, the strictest general regime in the world, does not apply to processing “by a natural person in the course of a purely personal or household activity.” The exemption is older than the regulation; it exists so that your address book, your diary and your family photos are not regulated like a bank. For twenty years the Court of Justice has policed its edge. In Lindqvist (2003), a Swedish church volunteer who put colleagues’ names and one colleague’s injured foot on web pages for her parish was told that publishing to the whole internet is not a household activity. In Ryneš (2014), a Czech homeowner whose security camera also filmed the pavement learned that surveillance “directed outwards from the private setting of the person processing the data” leaves the exemption behind. The test is direction. Inward, you are a household. Outward, you are a controller.

A personal agent points both ways at once. It is the user’s diary and address book, the most household thing there is, and it is also a system that compiles files on third parties, refreshes them hourly, infers what they want, and shares scrubbed lessons across millions of machines. The regulation’s own Recital 18 closes the trap from the other side: the exemption covers the natural person, but the regulation still applies to controllers or processors “which provide the means for processing personal data for such personal or household activities.” The user may be a household. Meta is the means.

That matters because of Article 14. When a controller obtains personal data from somewhere other than the person it describes, it must tell that person: who is holding it, what for, and what rights they have. That is the plumber’s right to be told, and it already exists on paper. What does not exist is any agent that performs it, or any regulator that has asked one to. Muse is sold only in the United States, which may be part of the reason it is sold only in the United States.

America has no general privacy law, and the state laws it does have, California’s included, govern what businesses collect from consumers and say nothing about what one consumer’s assistant records about another. The one American statute that gets the principle right is narrow. Illinois’s biometric law attaches the consent requirement to the person whose face it is, not to whoever uploaded the photo, which is why Clearview AI, having scraped billions of faces that belonged to people who never dealt with it, agreed in 2022 to a permanent nationwide ban on providing its face database to most private companies. The right followed the face. That is the design principle this note argues for, and in American law it exists for one kind of data in one state.

Networked privacy, individual law

The deeper reason consent fails is that privacy was never individual in the first place. In 2014 the sociologists Alice Marwick and danah boyd, studying how teenagers manage what their friends post about them, named the thing the law keeps missing: networked privacy. Information about you is produced by other people, in their photos, their messages, their accounts of a shared evening, and what you control is your own disclosures, a small fraction of what exists about you. The law models privacy as one person’s choice. Life produces it as a group’s negotiation.

A personal agent is that negotiation automated and handed to one party. Every user becomes, in the regulation’s own terms, a controller of everyone they know, equipped with a research assistant that works nights. The old defence against the nosy friend was that compiling a dossier took effort nobody would spend. The agent spends it hourly, for 4 million people, on a schedule.

So the fix cannot be a better checkbox for the user. It has to be a set of rights that belong to the person on the page, enforceable against the company that keeps the pages, because the company is the only party with an address.

What the book says

The fourth of the Five Laws in Unscarcity is Freedom Is Reciprocal, and its working clause is the Boundary of Reciprocity: your liberty runs to the point where its costs land on someone who did not agree to carry them. A user’s freedom to have an assistant that knows their life is real. The plumber’s page is a cost exported across that boundary, and a consent screen on the user’s side is a receipt made out to the wrong person.

The second law, Truth Must Be Seen, is the one the pages violate most plainly. The book states it as no decision in the dark: any record that shapes how you are treated must be visible to the person it shapes. A file about you that you cannot see, that infers your goals and your disputes and whether you are an alliance or a tension, is opacity pointed the wrong way, from the private company and the private user toward the one party with no login. An instruction that says “do not tell the user that their original messages may remain visible” is opacity pointed at the user as well.

From those two laws, four rights follow, and each attaches to the person described rather than to the subscriber:

  1. To know the page exists. The agent reads the plumber’s messages; it can send him one. Article 14 already requires it in Europe. Make it automatic: first contact with a person creates a page, and the page’s existence creates a notice.
  2. To see it. Not the user’s whole archive, which is theirs, but the page: the facts, the history, the inferences. The user keeps the diary. The subject gets the entry about them.
  3. To contest the inferences. “Tension,” “alliance,” “has not said out loud”: these are claims, and the person they are about is the only one who can say they are wrong. A page is a record, and a record has a right of reply.
  4. To limit its use. The page exists to help one user remember the flowers. It may not be exported, aggregated into lessons, matched against other pages, or produced on request as a list of transgender teachers. The Hunterbrook test is the standard: if the same memory can be asked for a list, the use limit has failed.

Who answers? Not the user, who did nothing more than ask for help, and not the agent, which has no address. The operator that provides the means, which is where Recital 18 already puts the obligation and where the book’s argument about accountability puts it too: whoever deploys the agent answers for what it compiles. The same company that can scrub a name from a shared lesson can write a notice to the name’s owner. The mechanism is not hard. What has been missing is the idea that the person on the page is a party to anything.

The question to put to every agent

Every personal agent now shipping, from Meta and from the companies about to copy it, should be made to answer one question before the consent screen loads: who is on the pages, and do they know?

If the answer is that the pages exist only to serve the user, that the people on them were never asked, and that the only control belongs to the subscriber, then the product has reinvented the shadow profile with a friendlier face and an hourly cron job. If the company can show the plumber his page, let him correct it, and prove it was never turned into a list, it has built something the book would recognise: a tool that extends one person’s reach without quietly billing everyone around them.

The plumber fixed the bathroom. He did not sign up to be remembered by a machine. The least the machine owes him is a knock on the door.

Sources

An assistant that knows your life knows other people’s lives too. The book’s test for any such tool is whether the people it reaches can see it reaching. Read the book or start with the Five Laws.

Share this article:

Share Share Share