Privacy Expectations When AI Joins a Group Text

An AI scheduling assistant in iMessage group chats can help a group pick a date without taking the chat somewhere else. Maverick helps groups pick a date, while another assistant joins group iMessage conversations as well as working as a private assistant. Privacy depends on what AI reads, what it retains, and what it shares back when it enters the thread.

Why group chats were never built for coordination, and what that gap invited

Group messaging platforms such as iMessage, WhatsApp, and Instagram DMs were designed for conversation. Their conversational format lacks persistent planning state, deadlines, and a visible decision record that separates commitments from passing reactions. The burden falls back on the participants. An open-ended request for availability asks each recipient to scan a calendar, weigh personal energy, and formulate a useful reply. Non-response becomes the path of least resistance even when someone wants the gathering to happen.

Enthusiasm does not resolve that coordination burden because reacting and committing are different acts. Plans get stuck between people showing interest and agreeing to meet when nobody wants to be the pushy organizer. Even a yes can fade as the conversation scrolls past a plan without a settled time, place, or reminder. The thread preserves conversation while leaving usable commitments uncertain. That gap invited AI agents into text conversations to handle the work people keep avoiding, bringing a new participant into what had been a human exchange.

Is there an AI assistant that can find a time for everyone in a group text?

The iMessage-native AI agent is a new product category as of late 2026, but the products within it do not perform identical jobs. Maverick describes itself as “an AI companion that lives in your texts” and can schedule meetings from voice notes and help group chats settle on a date. It asks for user permission before taking action. That permission requirement is a concrete product feature, although approval to act is not the same question as permission to read.

Tomo distinguishes itself by joining group iMessage conversations rather than operating only as a private, one-on-one assistant. Ollie is designed around family coordination. Those descriptions establish different contexts of use, with scheduling capabilities and privacy guarantees still to be assessed. An agent’s presence in the conversation says where people interact with it, while its actual capabilities determine what information and authority the task requires.

Instinct extends delegation beyond arranging a meeting. In September 2026, it began giving users dedicated email addresses so the AI could create and manage accounts on their behalf. That autonomy has raised privacy and security concerns of its own. Underdog is built differently: it launched an invite-only beta in early October 2026 with its model running entirely on the user’s device to keep personal data off external servers. Local processing, permission-gating, and availability-only sharing limit different kinds of exposure, so they cannot be treated as interchangeable privacy protections.

Why encryption alone does not settle the privacy question once AI enters the thread

End-to-end encryption protects messages as they pass between devices. It does not protect content from a cloud service to which a participant deliberately hands the conversation. The boundary changes when the assistant receives the text. At that point, evaluating privacy requires an account of what the service reads, retains, and discloses, rather than reassurance about how the original messages travelled.

University of Washington and Rutgers researchers found that users saw their chats with chatbots as more sensitive than email or social media posts. Yet users often shared health information, personal finances, and relationship details, with mistaken ideas about how their data was processed. The gap between perceived sensitivity and sharing behavior helps explain why informed expectations about an assistant require more than a familiar messaging interface. Someone can recognize that a conversation is personal without understanding where its contents go after AI is invoked.

UC Davis researchers examined tracking on 20 AI chatbots and found that most shared information with at least one third party during a normal chat session. Three shared plaintext conversation text, including prompts and responses, through session replay tools. This is a separate layer of exposure. The finding applies to the chatbots studied and leaves open whether other group-text assistants use the same tracking tools. It still shows why checking privacy means looking at analytics and who else gets the data, as well as the model provider.

Researchers at IT:U, the University of Vienna, and SBA Research identified another weakness in major end-to-end encrypted messengers, including iMessage. Their work showed that these systems do not guarantee transcript consistency, meaning that every participant sees the same conversation. A malicious group member can selectively alter or omit content for particular recipients without a warning in the interface. The researchers demonstrated the problem through a meeting arrangement. One participant receives an altered meeting time, while another is skipped entirely, with no warning shown.

That finding concerns the integrity of the shared record. Encryption can protect delivery without establishing that everyone received the same account of the plan. AI access, third-party tracking, and transcript manipulation each pose their own risks and have different causes. Having an assistant in the chat does not by itself cause any of them. But none is resolved simply by pointing to the thread’s end-to-end encryption, either.

The consent problem is structurally asymmetric in groups

In a one-on-one AI exchange, the person choosing to submit information is also the person directly participating in that handoff. A group changes the relationship between choice and exposure. One member can invoke an assistant on a conversation containing other people’s contributions, without those people individually agreeing to the transfer. The initiating action belongs to one person. Its privacy consequences can extend across the group, depending on the access the agent receives.

This is a structural asymmetry rather than evidence of any one company’s good or bad faith. Where invocation makes the thread readable to a service, adding the assistant can change the audience for messages that others wrote under different expectations. Being in the group does not mean agreeing to every later use of its conversation. Consent to speak among participants and consent to AI processing are separate decisions.

Research on group administrator attitudes found that many administrators did not believe they had the right to grant AI access to group data unilaterally. They favored explicit, revocable consent from members rather than approval only from the person adding the bot. Participants also described circumstances in which access should be time-bound or reversible, including emotionally charged discussions. Group privacy changes with the conversation’s context. A rule that seems fine for everyday scheduling may not suit every discussion that comes up later in the same thread.

The Washington and Rutgers study found that users prioritized procedural safeguards, including informed consent, anonymization, and removal of personally identifiable information, over the identity or trustworthiness of the recipient. The process of sharing shaped their judgments. For groups, this points to a problem that a trusted brand alone cannot resolve, because the disputed question is who has authority to authorize the handoff. A consent mechanism must account for the people whose contributions become accessible, including the person requesting assistance.

The specific distinction that actually resolves the privacy question is what the AI reads versus what it shares back

Reading a conversation and disclosing information into it are different operations. An assistant may need information to schedule a meeting without needing to share it with everyone in the group. Availability provides a concrete dividing line. Sharing that someone is free at 3 p.m. on Thursday is categorically different from sharing that they have a recurring therapy appointment at noon. Both statements relate to a calendar, but only one reveals the personal reason behind a scheduling constraint.

Availability-only sharing therefore addresses the content returned to the group. An agent might read more information than it publishes. A useful assessment separates the thread content the agent can read, the calendar information it can access, and the details it returns to participants. The fact that its reply contains only availability does not, by itself, answer what happened before that reply.

Retaining preferences and patterns can save people from repeating themselves, but those records can also expose inferred work hours, regular commitments, and social habits. Retention’s risks depend on whether memory is scoped, editable, and transparently governed, as well as how retained information can later surface.

Underdog’s local model addresses where processing takes place by keeping model processing off external servers, with a tradeoff against the personalization that cloud memory enables. Maverick’s permission-gating instead addresses when the assistant may act on information it has read. These controls operate at different points. Neither should be treated as a substitute for explaining what enters the system and what leaves it. The Washington and Rutgers findings support making those transmission rules visible and controllable beyond the privacy policy.

The question group members should ask of any agent is not “Is this private?” but “What does it read, and what does it put back into the chat?”

What group members can actually control, and what remains outside their hands

For group members evaluating an assistant, the practical starting point is its stated access and disclosure rules. Users can choose which agents they invoke and read privacy policies for how information is transmitted and retained. In many cases, they can also adjust or disable memory and use training opt-outs. These are meaningful controls, but they are incomplete. They do not determine which assistants another participant may invoke on a shared conversation.

The evaluation checklist begins with the scope of access. Does the assistant read the full thread or only what is explicitly addressed to it? Does it return availability or personal event details? Memory needs its own questions about whether retained information is editable and deletable, while follow-ups and data use need clear off switches. They also need to check whether processing is on-device or cloud-based, and whether the agent asks for approval before each action or assumes it has approval when it joins.

Those controls also have limits beyond the conversation itself. Most companies do not clearly explain whether their training data includes personal information from websites, social media, or other public sources. A training opt-out is not an account of all prior data use. Likewise, choosing not to invoke an assistant personally does not settle how other group members will handle shared messages. Individual settings govern only part of a system whose inputs can come from several people.

Native coordination features offer a partial alternative. The iOS 26 polling feature works directly within iMessage group chats, keeping that activity within Apple’s existing privacy framework rather than routing it through a third-party AI service. A poll can do only some of the work an agent might do to help a group make plans. Whether native features reduce the need for external assistants remains an open question, but they distinguish the need to reach a decision from the decision to grant AI access.

As long as group architecture allows one participant to invoke AI, each member’s privacy depends partly on the choices of others. The practical standard is a clear account of access, disclosure, retention, processing location, and consent, applied to the particular agent.