Yes, one AI buying agent can run deals across the UK, the EU and the US, but it cannot run them on one set of rules. Consent, targeting limits and AI transparency duties differ in each market, so a single agent needs an explicit rulebook for every jurisdiction it buys in. The software can be shared; the mandate cannot.

In short: privacy law generally follows the audience, not the buyer's head office. The EU and UK begin with consent for cookies and similar technologies, California begins with a right to opt out of sale or sharing, and the EU AI Act became applicable on 2 August 2026. A multi-market agent therefore needs per-market rules, a jurisdiction check before every deal and a record of which rules applied.

Can an AI buying agent run campaigns across multiple countries?

Technically, yes. Nothing in how an agent negotiates or submits a deal is tied to one country, and the emerging agentic standards, led by IAB Tech Lab's Agentic Advertising Management Protocols (AAMP) alongside the Ad Context Protocol (AdCP) published by AgenticAdvertising.org, describe how buyer and seller agents exchange proposals and terms. They do not replace national law.

The harder question is whether the agent knows which rules apply to the deal in front of it. A UK, a German and a Californian campaign can share a brief and a creative, yet each sits under different privacy law and consent signals. The useful framing is one agent, several mandates, each stating the market, the consent or opt-out signal the agent must see before it uses audience data, the targeting it must never request and the approval level the agent holds there.

Those mandates can be tested before any budget is at risk. The Alkimi Gym, as one worked example, lets buyers and sellers build their own agents, set the rules those agents work to and spar against counterparty agents before any real money moves. A team could run one agent against a UK and an EU rulebook and see where its behaviour changes.

Which country's law applies to an agent-bought deal?

In privacy law, jurisdiction usually follows the person being reached rather than the location of the buyer or its software. Article 3 of the GDPR applies to a controller outside the EU where processing relates to "the monitoring of their behaviour as far as their behaviour takes place within the Union" (GDPR Article 3). A US brand whose agent buys behaviourally targeted impressions in Germany is likely to be in scope, wherever the agent runs.

California works from the consumer side too. The California Attorney General's CCPA guidance sets out rights for California consumers, including the right to opt out of the sale or sharing of their personal information, and explains that sharing refers specifically to sharing for cross-context behavioural advertising.

The UK has its own regime, the UK GDPR, which the Data (Use and Access) Act 2025, given Royal Assent on 19 June 2025, amends in stages. The practical consequence is that the agent must resolve the audience's market before it touches audience data.

How do consent and cookie rules differ between the UK, EU and US?

The EU and the UK both start from consent. The ICO's cookie guidance says consent "must be actively and clearly given", with an exception for cookies essential to a service the user asked for. In the EU the equivalent ground is covered by the ePrivacy Directive alongside the GDPR.

The UK is now diverging at the edges. The government says the DUAA "allows the use of storage and access technologies without explicit consent in certain, low-risk situations", and the ICO's summary of the Act gives examples such as cookies used for statistical purposes or to improve a website's functionality. Neither summary lists advertising among those examples, so an agent should not treat a UK analytics exemption as permission to target.

California starts from the other end. Consumers can ask businesses to stop selling or sharing their personal information, including through a user-enabled global privacy control such as GPC, and businesses cannot sell or share after receiving that request unless the person later authorises it again, according to the Attorney General. Beyond California, comprehensive privacy law is being written state by state, as the IAPP's US State Privacy Legislation Tracker shows.

The industry has standard signals for both models. IAB Europe describes its Transparency & Consent Framework as an accountability tool that facilitates compliance with certain provisions of the ePrivacy Directive and the GDPR, while IAB Tech Lab's Global Privacy Protocol (GPP) is a transport layer that carries consent and preference signals through the supply chain. An agent should treat these signals as conditions, not metadata.

What targeting can a buying agent request in each market?

The EU adds advertising limits that sit on top of privacy law. Article 26(3) of the Digital Services Act says online platforms "shall not present advertisements to recipients of the service based on profiling" that uses special categories of personal data, and the European Commission's DSA summary describes a complete ban on showing targeted advertisements to children. Those duties fall on platforms, but they belong in a buying agent's EU exclusions all the same.

California gives consumers the right to limit the use and disclosure of sensitive personal information, a right the Attorney General says took effect on 1 January 2023.

In the UK, the DUAA makes the rules on solely automated decisions with legal or similarly significant effects more permissive, but keeps safeguards that include the right to obtain human intervention (DSIT guidance). Whether an advertising decision meets that threshold is a legal question, but the safeguard signals that human review is expected to stay in the design.

Does the EU AI Act apply to buying agents, and what about the UK and US?

The EU AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions, according to the European Commission. Article 50 requires providers to ensure that AI systems intended to interact directly with people inform them that they are interacting with an AI system (Article 50). Which duties land on a buyer or a publisher depends on the role each plays, covered in more depth in The EU AI Act and Agentic Advertising.

The UK has taken a different route. In its response to the AI regulation white paper consultation, the government set out five cross-sectoral principles for the UK's existing regulators to interpret and apply within their remits. A UK buying team should therefore expect AI questions from regulators it already deals with, such as the ICO on personal data. In the US, the first constraints on agent-bought audiences usually come from state privacy law, covered in How AI Agents Handle Audience Data Under US Privacy Laws.

How do UK, EU and US rules compare for a buying agent?

Question for the agent	UK	EU	US (California as the example)
Main privacy law	UK GDPR, as amended by the Data (Use and Access) Act 2025	GDPR, with the ePrivacy Directive	CCPA as amended by the CPRA, alongside other state laws
Starting point for cookies and similar technologies	Consent, with some low-risk exemptions under the DUAA	Consent	Right to opt out of sale or sharing, including via GPC
Sensitive data in targeting	Special category data remains more protected	DSA bars platform ads based on profiling with special category data	Right to limit use of sensitive personal information
AI-specific rules	Principles applied by existing regulators	EU AI Act, applicable from 2 August 2026 with exceptions	Check state by state
What the agent checks before using audience data	A valid consent signal, unless an exemption clearly applies	A valid consent signal and a lawful basis	Any opt-out of sale or sharing, including a GPC signal

The table is a starting checklist, not legal advice; confirm each row with counsel in the market.

How should one agent be set up to buy across three markets?

Resolve the market first: where the audience is, not where the budget sits.
Load that market's mandate: required signals, excluded targeting and approval thresholds.
Fail closed: if a signal is missing or ambiguous, the agent stops and asks a person.
Record which rulebook applied: market, mandate version and signals checked, held by both sides.
Set autonomy per market. Earned autonomy runs through five stages (Observe, Recommend, Draft, Human-approved action, Bounded automatic action), and one agent can sit at different stages in different markets.

As a hypothetical, a team with a clean UK track record might allow bounded automatic action on UK renewals while keeping the same agent at Draft for its first EU deals.

What should stay the same in every market?

Two things should not vary by country: who can approve, and what was agreed. Human approval at the deal level keeps a named person accountable in each market, and a shared record of terms means a regulator's or client's question can be answered without rebuilding the deal from two sets of logs. In the Agree. Transact. Verify. simulation, 95.3% of deals had mismatched records when each side kept its own, against 0.19% with a shared record.

What does this mean for teams planning cross-market agentic buying?

The real cross-market question is whether anyone can show which rules the agent followed in each market. Alkimi's Marketplace is built around that point: it is neutral, works within IAB Tech Lab's AAMP framework today, is being built to be AdCP compatible, uses AAMP identity checks and keeps human approval rights at the deal level. Its DealSheet is written at agreement, timestamped, held by both parties and retrievable by either side independently, giving each market a record of what was agreed.

Frequently asked questions

Can one AI buying agent legally buy media in the UK, EU and US at once?

It can, provided it applies each market's rules to each deal rather than one global rule set. Privacy law generally follows the audience, so the agent must know the market before it uses audience data.

Does the GDPR apply to a US company's buying agent?

It can. Article 3 of the GDPR reaches controllers outside the EU when their processing relates to monitoring the behaviour of people in the EU, which behavioural targeting can involve.

What does a buying agent need to honour in California?

It must respect a consumer's opt-out of sale or sharing, including one sent through a user-enabled global privacy control. California consumers also have the right to limit the use and disclosure of their sensitive personal information.

Should a multi-market agent have the same autonomy everywhere?

No. Autonomy is best set per market, so an agent can act more freely where its rules are proven and stay at Draft where they are new.

Can One Buying Agent Run UK, EU and US Deals? What Changes Across Markets