Data protection in Ecuador and AI agents on WhatsApp: what the LOPDP requires

Ecuador has had a personal data law since May 2021. The Organic Law on Personal Data Protection (LOPDP) was published in the Fifth Supplement of Official Register 459 on May 26, 2021, and its penalty regime took effect two years later. If your business serves customers on WhatsApp with an AI agent, the law applies just as if a person were replying, and since March 2026 there is also a rule from the Superintendency written for artificial intelligence.

Who is who?

The law calls the one who decides on the purpose and processing of data the controller, and the one who processes it in the name and on behalf of a controller the processor (article 4). The relationship between the two must be governed by a contract (article 34). If your company runs its agent on a platform, your company is the controller and the platform, the processor.

What does the law require in a conversation?

Obligation	Article	In a chat with an agent
Legal basis	7	Consent, contract, legitimate interest or another of the eight
Consent, when it is the basis	8	Free, specific, informed and unambiguous, withdrawable without justification
Inform when collecting data	12	Purpose, legal basis, controller and automated decisions, at the start
Access, correction, deletion and objection	13 to 16	Answer within 15 days
Automated decisions	20	The person may ask for an explanation and challenge it
Sensitive data and minors’ data	21, 25 and 26	Prohibited save exceptions, with specific rules for children and adolescents
Security	37	Measures suited to the risk, at the processor too
Security breach	43 and 46	Notice to the Authority in 5 days and to the data subject in 3
International transfer	55 to 61	To adequate countries, with safeguards or under the exceptions

Article 12 lists seventeen items to disclose to the data subject. They include the purposes, the legal basis, the retention period, the controller’s identity and contact details, transfers and the existence of automated assessments and decisions, including profiling. When data is collected from the data subject, they are informed at the very moment of collection.

What changes when an AI agent is the one replying?

1. You have to say it is automated. The Superintendency’s general rule on personal data in the use of artificial intelligence systems, signed on February 12, 2026 and published in Official Register 240 on March 10, calls whoever provides a service through an AI system a «deployer». It requires informing the data subject, clearly, specifically and transparently, of the processing done with AI, including its purposes and its automated nature, and calls for risk management and impact assessment.
2. Decisions with consequences go through a person. Article 20 lets people refuse decisions based solely or partly on automated processes. If your agent decides something that affects someone, such as denying a service, leave the final decision to your team.
3. Data leaves the country. An AI agent usually relies on providers in other countries, and the law regulates that transfer in articles 55 to 61. Say so in what you tell the data subject.

How Meteor does it

• Roles in writing. Meteor’s Terms state that the customer is the Controller and Meteor the Processor, handling data only under the customer’s documented instructions (clause 16.1). Clause 16.2 places on the customer the legal basis to process data with AI and send it to model providers located outside the country, and clause 16.6 says it may be processed in the United States and other jurisdictions.
• You tell the Met how to greet. The Met’s prompt is content in your workspace: that is where you instruct it to say in the first message that an AI agent is answering, what the data is used for and where your policy is.
• The record, on the contact. The Met can leave a note or a tag on the contact in the CRM with what they were told and when. Clause 17.1 of the Terms keeps conversation records while the account has an active plan and for up to 30 days after, unless the law requires another period or you configure a different retention.
• Incidents. Clause 16.8 requires Meteor to notify you within 72 hours of confirming an incident affecting data under its control. Notifying the Superintendency and the data subjects stays with you, within the deadlines of articles 43 and 46.
• Objecting to advertising. Broadcasts leave out contacts whose «Suscrito» (subscribed) field is off on their profile, and a contact who stops promotions from WhatsApp is marked that way on Meta’s first rejection.
• Handing over to a person is a Met tool: a data rights request or a decision that should not rest on the agent alone goes to your team, as the WhatsApp agent page explains.

The Ecuador page (in Spanish) shows the connections available in the country. What Meteor does not do for you: write your policy, keep your record of processing activities or appoint your data protection officer.

What this is not

This is not legal advice. The law is cited by article from its text published on gob.ec, together with the May 2026 amendment to article 43 and the Superintendency’s resolutions, accessed on October 28, 2026. Before adjusting your policy, review it with a lawyer in Ecuador.