Profiling

Profiling is the automated processing of personal data to evaluate certain things about a person — and often to predict them. Under the European Union's General Data Protection Regulation (GDPR), the reference definition, profiling means any automated processing of personal data used to evaluate personal aspects of an individual, in particular to analyze or predict things such as their performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. In plain terms, it is using data a system holds about someone to infer or forecast characteristics it was not directly told. A retailer predicting what you will buy from your past purchases, a lender scoring your creditworthiness, and an ad platform inferring your interests from your browsing are all profiling. The defining features are that it is automated and that it evaluates or predicts personal aspects, rather than simply storing facts you provided. This section describes the concept and is not legal advice.

Profiling matters because it sits at the center of both modern marketing and modern privacy concern. On one side, it powers personalization, targeting, segmentation, and recommendation — much of what makes digital advertising and product experiences feel tailored depends on inferring characteristics and predicting behavior. On the other side, because profiling makes consequential inferences about people, sometimes without their awareness, it raises real risks: inaccurate inferences, discrimination, opacity, and decisions made about someone by a system they cannot see or challenge. This is why data-protection law treats profiling as a distinct, regulated activity rather than ordinary data use, imposing transparency duties and special limits when profiling feeds automated decisions with significant effects. For any organization that segments or targets people, understanding what counts as profiling — and the obligations that attach to it — is now part of doing it responsibly, though the specifics are a legal question for qualified counsel.

The most cited legal touchpoint is Article 22 of the GDPR, which addresses automated decision-making, including profiling. Broadly, it gives people a right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them, such as an automatic loan refusal or an automated hiring rejection, except in defined circumstances and with safeguards like the ability to obtain human intervention and to contest the decision. It is important to be precise about scope: Article 22 does not ban profiling. It restricts a narrow category — solely automated decisions with significant effects — and much everyday profiling for marketing does not fall under that specific prohibition, though it is still governed by the GDPR's general rules on lawfulness, transparency, and purpose. This is a summary of a complex provision, not legal advice, and the exact application depends on facts and jurisdiction.

Beyond Article 22, profiling under the GDPR carries the regulation's general obligations, and understanding them keeps the concept grounded. Profiling requires a lawful basis, must be transparent (people should be told meaningful information about the logic involved where automated decision-making applies), and must respect purpose limitation and data minimization. Individuals have rights that touch profiling directly, including a right to object to profiling for direct marketing. Special-category data — health, ethnicity, and the like — attracts stricter conditions when profiled. The practical upshot for marketers is that profiling is permitted but conditioned: you generally need a valid basis, clear notice, and respect for objection and access rights, and heightened care when profiling feeds significant automated decisions or uses sensitive data. Because rules differ by jurisdiction and evolve, and enforcement turns on specifics, organizations should treat this as an area for qualified data-protection advice rather than rules of thumb.

Profiling responsibly means being deliberate about what you infer, why, and with what safeguards, rather than collecting and predicting because you can. Start with a clear, lawful purpose and tell people, in plain language, that profiling happens and broadly how it works. Minimize the data you use to what the purpose needs, and be especially careful with sensitive characteristics, which carry stricter conditions and higher risk of harm. Respect the rights people have — including the ability to object to profiling for direct marketing — and, where profiling drives significant automated decisions, build in meaningful human review and a route to contest the outcome. Test profiles for accuracy and for discriminatory effects, since a confident but wrong or biased inference can harm the person and the brand. Throughout, treat the legal specifics as a matter for qualified counsel, not guesswork.

The failures are profiling people without a lawful basis or clear notice, inferring sensitive characteristics without the stricter care they require, assuming Article 22 either bans all profiling or permits anything (it does neither — it targets a narrow class of solely automated, significant decisions), and treating inferred profiles as fact when they can be inaccurate or discriminatory. Another failure is offering no human review or route to contest when profiling drives consequential automated decisions. The discipline is to profile with purpose, transparency, and restraint — lawful basis, plain notice, data minimization, respect for objection rights, extra care for sensitive data, and human oversight where decisions matter — while remembering that the precise obligations depend on jurisdiction and facts, so this is a summary for orientation and not legal advice.

Profiling, from the idea of drawing a person's profile, names automated processing of personal data to evaluate or predict individual characteristics, defined in EU data-protection law.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where profiling is a core concern: