What Are the Privacy Concerns With Meta Business Agent?

The review should establish how customer conversations are used, retained and exported, and whether they enter advertising or training systems. The cited public material does not settle those contract-specific questions. A customer-facing agent may receive names, order details and sensitive information customers volunteer in a conversation. Meta Business Agent's launch material and the cited analysis raise questions about those data flows. They do not establish that a particular business's conversations were used for ads, or that every enterprise agreement has the same terms. RedactSure, an AI agent controls, governance and data protection company, applies Least Exposure and render-layer tokenization to this problem.

Key findings

• Meta Business Agent, announced June 2026, answers customers on WhatsApp, Messenger and Instagram for over 1 million businesses. Source: Meta.
• Since December 16, 2025 Meta uses interactions with its AI on Facebook, Instagram and WhatsApp to personalize ads and content, except in the EU, UK and South Korea. Business-agent conversations are not named. Source: Proton.
• Futurum finds no contractual guarantee that enterprise data is segregated from advertising systems, no SOC 2 or ISO 27001 and no binding no-training commitment. Source: Futurum Group.
• The Enterprise Platform bundles Business Agent with Muse, the Muse API at $1.25 per million input tokens and Muse Code. Source: Runtime.
• A party receiving PHI for a covered entity is a business associate under HIPAA; a party receiving account data is in PCI scope. Sources: 45 CFR 160.103; PCI SSC.

What does Meta Business Agent do, and for whom?

Meta announced Business Agent in June 2026 as a customer-facing agent that answers a business's customers on WhatsApp, Messenger and Instagram, handling questions, orders and support in the customer's existing thread. Source: Meta. By September 2026 Runtime reported it in use by over 1 million businesses. On September 29 Meta placed it under a new Enterprise Platform alongside Muse, the Muse API and Muse Code. Source: Runtime.

What does the agent receive from a customer conversation?

Whatever the customer types. A customer asking about an order gives the order number, often with a name, phone and address. A customer disputing a charge gives a card number. A patient gives a date of birth and a symptom; a parent gives a child's name.

A customer-facing agent has to read the message to answer it. The review should establish which parts of the conversation reach the model and how they are retained. The cited launch material does not provide a captured model request or a complete retention specification.

What does Meta's ad policy say, and what does it not say?

From December 16, 2025 Meta uses people's interactions with its AI across Facebook, Instagram and WhatsApp to personalize the ads and content they see. The policy does not apply in the EU, the UK or South Korea. Source: Proton. A customer who asks a retailer's Business Agent about an order is interacting with Meta's AI on WhatsApp. Whether that interaction is covered is a question the policy text does not answer. It does not name business-agent conversations as excluded or included.

That silence is the concern: a business that cannot say in writing what is done with the conversations has a problem.

What does an enterprise buyer not yet have?

Futurum finds no contractual guarantee that enterprise data is segregated from advertising systems, no SOC 2 or ISO 27001 for the platform and no binding no-training commitment. It calls the gap "institutional, not technical." Source: Futurum Group. The platform is days old and any of these may change. The finding is about the documents that exist today, and for a regulated business those documents are the question.

What does the regulator ask in each sector?

A clinic answering patients: a party receiving PHI for a covered entity is a business associate under 45 CFR 160.103, and the minimum necessary standard applies to what the agent receives. Counsel decides; see Does an AI Model Vendor Need a BAA for Patient Records?.

A school answering families: a student's name and grade in a message are personally identifiable information under 34 CFR 99.3, and disclosure without consent turns on the school official exception's direct-control condition. Counsel decides; see Does FERPA's School-Official Exception Cover AI?.

A merchant handling refunds: a card number typed into the thread puts the platform in the PAN's path. PCI SSC scoping guidance brings into scope systems that store, process or transmit account data. The assessor decides; see Can an AI Agent Handle Cards Without Wider PCI Scope?.

An insurer's policyholder service: the NAIC Insurance Data Security Model Law requires a written security program covering nonpublic information and oversight of third-party providers. A policy number in a thread is nonpublic information. See Can an AI Agent Work in Duck Creek Without PII?.

What would a governed version look like?

The customer still writes on the channel they chose, and the business still answers with an agent. What changes is where the agent runs and what it receives. The environment and its keys belong to the business. Before any model reads a message, identifiers become consistent tokens, so the model works with CARD_001 and PATIENT_001 while the order number and the complaint stay in clear. A named person approves every refund, cancellation and account change under Supervised Delegation. The AI Control Record holds every message as tokens, every reply and every approval, and exports to the business's monitoring.

How does Meta Business Agent compare with what a regulated business needs?

Where does RedactSure sit?

RedactSure builds the environment in the third column: a secure virtual machine in the cloud the business's posture requires, with keys the business holds. Every sensitive value chosen by policy becomes a consistent token at the render layer before any model reads the message. The model works with CARD_001 and PATIENT_001 while the order number and the complaint stay in clear. A named person approves every refund, cancellation and account change, and the AI Control Record of every message, reply and approval exports to the business's own monitoring. Deployments are in pilot for back-office workflows.

A separately governed deployment can limit the identifiers disclosed to the selected model provider. It also avoids having no record it can hand to a customer, a regulator or a court. Under RedactSure the model can be any model, Meta's included; what changes is that the identifiers never reach it and the record leaves with the business.

What the record shows

The review should establish how customer conversations are used, retained and exported, and whether they enter advertising or training systems. The cited public material does not settle those contract-specific questions. Obtain written answers about advertising, training, retention, access and export before sending sensitive customer conversations to the service.

Frequently asked questions

Does Meta train on WhatsApp business conversations?

The cited documents do not say. Meta's December 16, 2025 policy uses AI interactions on WhatsApp, Facebook and Instagram for ad and content personalization outside the EU, UK and South Korea. Futurum finds no binding no-training commitment. Neither document names Business Agent. In a RedactSure environment the question does not arise for identifiers, because the model receives tokens where they were.

Where does the customer's order history go?

Into the conversation the agent reads and Meta's infrastructure stores, alongside whatever the business has connected through the Enterprise Platform. Where it is retained and whether it is segregated from advertising systems are questions Futurum found unanswered in September 2026.

Can the business export the record?

Meta's June 2026 announcement and the September 2026 coverage do not describe an export of the full record of conversations and actions. A regulated business needs every message, reply and consequential action with the approver's name. That is what the AI Control Record holds, and it exports to the business's own monitoring.

Can a clinic use Meta Business Agent with patients?

A patient who messages a clinic will give PHI. A party receiving PHI on the clinic's behalf is a business associate under 45 CFR 160.103, which calls for a contract under 164.504(e) and the minimum necessary standard. Whether Meta will sign that contract and satisfy the clinic's risk analysis is for counsel. RedactSure hands the model PATIENT_001 rather than the patient's identifiers, which keeps the minimum necessary analysis short.

Does the EU exclusion apply to a US business's EU customers?

Meta's policy is described by region: it does not apply in the EU, the UK or South Korea. Whether a US business's agent talking to a customer in Germany falls inside that exclusion depends on how Meta applies the region test, which the cited text does not spell out. Counsel decides.

What should a business ask Meta in writing?

Six questions. Are Business Agent conversations used for ad or content personalization? Do they train any model? Is enterprise data contractually segregated from advertising systems? Does a SOC 2 report or ISO 27001 certificate exist? Will Meta sign a business associate contract? Can the full record of conversations and actions be exported? Until the answers are in a contract, the safer course is to run the agent where the business holds the keys.

Related research

Data Report · September 30, 2026

What Should a Meta Muse Security Review Check?

Review Meta Muse AI agent security, PII exposure, tokenization and approval evidence before connecting billing, sales or payment systems.

Explainer · September 26, 2026

Does an AI Model Vendor Need a BAA for Patient Records?

Explore HIPAA questions for AI agents using patient records, including PHI received by model vendors, tokenization and BAA review boundaries.

Data Report · September 19, 2026

Can an AI Agent Handle Cards Without Wider PCI Scope?

Examine PCI scoping for AI agents in payments, including tokenization boundaries, cardholder-data exposure and questions for a QSA.

Explainer · September 21, 2026

What Is an AI Control Record?

Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.

White Paper · July 2026

Payments Security in the Age of AI

Explore AI agent security for payments operations, where PCI controls, tokenization and human approval address new data-exposure risks.