Data protection in Argentina and AI agents on WhatsApp: what Law 25,326 requires

Argentina has had a personal data law since 2000. Law 25,326 was regulated by Decree 1558/2001, and its enforcement authority is the Agency for Access to Public Information (AAIP). If your business serves customers on WhatsApp with an AI agent, the law applies just as if a person were replying: processing covers electronic or non-electronic operations used to collect, store or communicate data (article 2).

Who is who?

The law calls the owner of the database the controller and separately regulates computerized data services: whoever processes data on behalf of someone else may not use it for a purpose other than the one in the service contract (article 25). Decree 1558/2001 adds that the contract must set the security levels. If your company runs its agent on a platform, your company is the controller and the platform provides the service.

What does the law require in a conversation?

Obligation	Article	In a chat with an agent
Inform before collecting data	6	Purpose, who the controller is and how to exercise rights, at the start
Consent	5	Free, express and informed, in writing or an equivalent means, with exceptions
Sensitive data	7	No one can be forced to give it: the agent does not demand it
Security	9	Technical and organizational measures, at the provider too
Sharing data with a third party	11	Prior consent of the data subject
Transferring data abroad	12	To countries with adequate protection, or with express consent
Access	14	Answer within 10 calendar days
Correction, update or deletion	16	Within 5 business days
Registering the database	21	Private databases meant to provide reports go to the AAIP registry
Advertising	27	Withdrawal or blocking at any time, stated in each message

Article 6 spells out what is disclosed: the purpose and who may receive the data, the existence of the database and the controller’s identity and address, whether answering is mandatory or optional, the consequences of giving or refusing the data, and the option to exercise access, correction and deletion.

What changes when an AI agent is the one replying?

Three points weigh more than the rest:

1. Automated decisions. AAIP Resolution 4/2019 set binding guiding criteria. Its criterion 2 says that, when the controller makes decisions based solely on automated processing that produce adverse effects for someone, that person may ask for an explanation of the logic applied. If your agent decides something with consequences, such as turning down a request, that decision should go through a person.
2. Data leaving the country. An AI agent usually relies on providers in other countries. Article 12 bans transfers to countries without adequate protection, with exceptions such as the data subject’s express consent. Say it in your notice; do not take it for granted.
3. Advertising on the same channel. If you later use WhatsApp for promotions, each advertising message must state, expressly and prominently, that the person can ask for their data to be withdrawn or blocked.

How Meteor does it

• Roles in writing. Meteor’s Terms state that the customer is the Controller and Meteor the Processor, handling data only under the customer’s documented instructions (clause 16.1). The customer obtains the data subjects’ authorization, including the one covering AI model providers located outside the country (clause 16.2), and clause 16.6 says data may be processed in the United States and other jurisdictions.
• You tell the Met how to greet. The Met’s prompt is content in your workspace: that is where you instruct it to state the purpose in the first message and link your privacy policy.
• The record, on the contact. The Met can leave a note or a tag on the contact in the CRM with what they were told and when. Do not rely on the history alone: clause 17.1 of the Terms keeps conversation records while the account has an active plan and for up to 30 days after, unless the law requires another period or you configure a different retention.
• Opting out of advertising. Broadcasts leave out contacts whose «Suscrito» (subscribed) field is off on their profile. If the person stops promotions from WhatsApp, the contact is marked that way on Meta’s first rejection, without anyone removing it by hand.
• Handing over to a person is a Met tool: an access or deletion request, or a decision that should not rest on the agent alone, goes to your team. The WhatsApp agent page explains how that happens without losing context.

The Argentina page (in Spanish) shows the connections available in the country. What Meteor does not do for you: write your policy, register your database with the AAIP or answer an access request. That stays with the controller.

What this is not

This is not legal advice. The law and its decree are cited by article from their consolidated text on InfoLEG, accessed on October 28, 2026. There are bills to replace Law 25,326: before adjusting your policy, confirm the rule in force with a lawyer in Argentina.