Telltale

Telltale checks who your AI agent is about to give your data to, marks what it shares, and proves who leaked it (if it ever is).

Comment

Inspiration

Personal AI agents now fill in forms for people: insurance quotes, sign-ups, bookings. They type a name, an email and a home address into whatever form is in front of them. Nobody reads who is on the other side.

We went looking at who is on the other side. Since January 2026, California requires every registered data broker to answer yes or no, under oath, to questions like "did you sell consumer data to a generative AI developer?" and "did you share it with law enforcement without a subpoena?". The registry has 603 companies in it. We could not find a single consumer tool that uses those answers.

One example made the problem concrete. bestautoinsurance.com looks like a helpful quote comparison site. Its operator, Apollo Interactive, LLC, is a registered data broker that reported denying 13,539 of 15,040 deletion requests in 2024. Nothing on the page tells you that, and nothing tells your agent.

What it does

Telltale sits between a personal agent and every website it touches. Every disclosure goes through four steps:

  1. Intercept. When the agent reaches a form, it asks Telltale for field types (email, zip, ...), never values. The model provider never sees the person's details.
  2. Inspect. Telltale matches the site to its registry filing and adds findings from Daylight, our live audit of every broker's opt-out page.
  3. Sanitize. Ordinary sites pass without a prompt. For a registered broker, the person decides each field: send the real value, send a working value tagged to that site, or leave it out. Fields the law expects to be accurate, like an SSN or date of birth, are never altered.
  4. Release. Only approved values are typed, under a tag unique to that site, with an Ed25519-signed consent receipt. Telltale then sends the broker an opt-out of sale and sharing.

The tag is what makes enforcement possible. Each site gets its own real inbox and a four-character code. If a tagged identifier $k$, issued only to recipient $r$, is later used by a different sender $s$, the data moved:

$$ \text{evidence} \iff s \neq r \;\land\; t_{\text{contact}} > t_{\text{due}}, \qquad t_{\text{due}} = t_{\text{sent}} + 15 \text{ business days} $$

The 15 business days come from 11 CCR §7026(f), the deadline for honouring an opt-out. When both conditions hold, Telltale assembles the timeline, the signed receipt and the broker's own filing into a draft complaint for the California Privacy Protection Agency. The person reviews it and decides whether to file.

Daylight is the second half of the product. It visits the rights page every broker lists and records whether a person can actually find it. In our sweep, 55 of 603 brokers had a privacy-rights page hidden from search engines, and 18 hid their own opt-out page. For each one we store the exact noindex tag, X-Robots-Tag header or robots.txt rule.

How we built it

  • Agent: Claude Sonnet 5.5 through the Anthropic API, in a tool loop with six tools (navigate, read_page, fill_form, set_field, click, finish). fill_form takes field kinds only; the consent gate decides each value and types it into the page itself.
  • Browser: Playwright, driving a hosted Kernel browser, with a bundled Chromium as fallback. The console streams screenshots so the audience can watch the agent work.
  • Recipient intelligence: the CPPA registry CSV (603 brokers, 77 columns) parsed into a domain index, with Exa company search for brand domains a broker did not list.
  • Tagged identities: one AgentMail inbox per recipient. Incoming mail is polled and attributed to the disclosure that created the address.
  • Storage: Neon Postgres in the cloud and PGlite locally, behind one query interface. Personal details are encrypted with AES-256-GCM, and the key is held separately as a deployment secret.
  • Interface: Next.js 15 and React 19 with Tailwind CSS 4. Live updates arrive over server-sent events. There is a public overview, an animated seven-step tour, light and dark themes, and the console.
  • Deployment: one Fly.io machine next to the Neon database, plus a separate static site for the fictional dental office used in the demo.
  • Tests: 44 Vitest tests covering the policy, the gate, receipts, the vault, leak attribution, the Daylight parser and the browser tools.

Each agent turn resends the system prompt, the tools and the pages read so far. With prompt caching, a run's cost is

$$ C = \frac{p_{\text{in}} I + p_{\text{cache}} I_{\text{cached}} + p_{\text{out}} O}{10^6} $$

and since $p_{\text{cache}}$ is a tenth of $p_{\text{in}}$, a typical run dropped to about 1.5 cents. Every run reports its own token use and cost in the activity log.

Challenges we ran into

  • A leak takes weeks, a demo takes three minutes. We could not wait 47 days for a broker to resell an address. The demo replays "day 47" from a fictional sender on a reserved .example domain, and everything it produces is stamped SIMULATION. Real company names only ever appear quoting their own filings.
  • Fairness of findings. Our first sweep counted brokers whose opt-out page sits on a third-party portal as "hiding" it. That overstated the case. We now classify each page as the broker's own opt-out page, its privacy policy, or a vendor portal, and word each finding to match.
  • Cloud sweeps see more bot walls. From a datacenter, more broker sites answer with a block page. A block says nothing either way, so each broker keeps its last conclusive result, and the board says how many were carried over.
  • One website crashed the hosted browser. The insurance site crashed Kernel's browser on load, with or without stealth mode, even with 8 GB of memory. Telltale now reopens the page in a bundled Chromium mid-run and remembers which sites need it.
  • Multi-step forms. Quote funnels ask for a ZIP code first and contact details later. Each step on the same site reuses the same tag and only asks again when a new kind of personal data appears.
  • Never touching real companies with fake data. With the synthetic demo persona, Telltale never emails a real company and stops before submitting contact details to a real business.

What we learned

  • The most useful privacy data is already public. Companies file it under oath, and almost nobody reads it.
  • "Allow or deny" is the wrong consent model for agents. People need to decide per field, and they need to be asked only when it matters. Ordinary sites should never interrupt.
  • An alias tells you who leaked. Proof needs more: a dated opt-out, a deadline, and contact after it.
  • Every number on screen needs its limitation next to it. Registry answers are self-reported, the registry covers California only, and a blocked page may be bot protection.

What's next

  • Reporting texts and letters that quote a tag, not just email.
  • Registries from Vermont, Texas and Oregon.
  • A browser extension that brings the same consent card to forms people fill in themselves.
  • Daylight as a compliance feed for companies that buy or share data.

Built With

Share this project:

Updates

Submission history