The x402 payment protocol enables autonomous AI agents to access API services using cryptographic payments. These agents operate without traditional authentication, presenting unique data protection considerations.
When an AI agent calls the Armour Cart Recovery API via x402:
| Traditional API | x402 Agentic API |
|---|---|
| Known merchant identity | Wallet address only |
| Signed DPA | No individual agreement |
| Clear Controller/Processor | Agent's principal may be unknown |
| Contact for data subject requests | No direct contact mechanism |
The European Data Protection Board has acknowledged that:
"Where the identity of the controller cannot be reasonably ascertained, traditional controller obligations may need to be adapted to the technological context."
The UK Information Commissioner's Office has indicated:
"Organisations should apply data protection principles in a way that is practical and proportionate to the processing activity."
Regulatory bodies recognise that:
For x402 agentic traffic, we implement:
| Measure | Implementation |
|---|---|
| Data Minimisation | Same transient processing as standard API |
| No PII Storage | No data retained regardless of traffic type |
| Consent Enforcement | Three-tier model applied to all requests |
| Security | Same TLS, rate limiting, validation |
| Scenario | Treatment |
|---|---|
| Identifiable Agent Principal | Standard DPA applies; principal is Controller |
| Pseudonymous Agent | Deemed to accept DPA by API usage |
| Unidentifiable Controller | Processing limited to request-response; no storage |
By calling the API via x402, agents:
The following clause is incorporated into our Data Processing Agreement:
AI Agent Exemption (x402 Traffic)
Where the API is called by autonomous AI agents via the x402 payment protocol:
(a) The agent's principal (wallet owner) may be unidentifiable at request time.
(b) Per EDPB and ICO guidance on AI agents, where the Controller cannot be reasonably identified, the Processor's standard DPA obligations apply to the extent technically feasible.
(c) Agents are deemed to accept this DPA by virtue of API usage.
(d) Agents warrant they have appropriate authority to process the submitted data.
(e) The agent (or its principal, where identifiable) assumes Controller responsibilities including obtaining lawful basis for processing.
(f) No data subject rights requests can be fulfilled against unidentified Controllers; however, as no data is stored, this is moot.
| Obligation | How Fulfilled |
|---|---|
| DPA | Deemed accepted by usage |
| Consent accuracy | Agent must pass accurate flags |
| Data subject rights | N/A - no storage |
| Breach notification | N/A - no data to breach |
If an agent acts on behalf of an identifiable business:
Rights are protected because:
| Factor | Assessment |
|---|---|
| Data sensitivity | Standard commercial data |
| Processing duration | Milliseconds |
| Storage | None |
| Risk to data subjects | Minimal |
Our transient processing architecture means:
Despite the exemption, we maintain:
| Measure | Purpose |
|---|---|
| Anonymised Logging | Service monitoring, no PII |
| Wallet-Level Analytics | Usage tracking, not personal data |
| Consent Enforcement | Technical compliance regardless of traffic source |
| Rate Limiting | Abuse prevention |
As regulatory guidance evolves:
For B2B Direct Clients using the internal bypass (X-Armour-Internal header):
| Scenario | Treatment |
|---|---|
| Identified Client | Full DPA applies; client is Controller |
| Client Tracking | Optional X-Armour-Client-Id for analytics |
| Payment | Bypassed; included in subscription |
Internal bypass clients are always identifiable and subject to full DPA terms.
| Traffic Type | Controller Identification | DPA Status |
|---|---|---|
| Standard API | Known merchant | Signed/accepted |
| x402 Agentic | Pseudonymous (wallet) | Deemed accepted |
| Internal Bypass | Known B2B client | Full DPA applies |
Regardless of traffic type:
For questions about x402 agent compliance:
Email: hello@armourconsortium.ai
This document explains how Armour Consortium AI handles data protection for autonomous AI agent traffic under the x402 payment protocol.