What is data profiling?
Definition
Data profiling, in a privacy sense, is automated processing of personal data to evaluate things about a person, such as their interests, behavior, finances or location, and often to sort them into groups.
- Category
- Privacy
- Also called
- profiling, personal data profiling
- Last updated
Data profiling means using software to build a picture of a person from their data. The UK GDPR (Article 4(4)) defines profiling as automated processing of personal data to evaluate personal aspects, in particular to analyze or predict things like someone's economic situation, health, preferences, interests, reliability, behavior, location or movements. The ICO adds that it's often used to classify people into groups.
The word also has a second meaning in IT, where it means examining a dataset for quality. This entry covers the privacy meaning: profiling people.
How it works
A company collects data about you: purchases, browsing, location, public records, what other companies sell it. Software finds patterns and gives you a label, a score or a place in a segment, such as "likely to move" or "high spender". That label then decides what ads you see, what offers you get, or how a business treats you.
A concrete example: an advertiser buys a list from a data broker, matches your email to a profile that says you recently bought a house, and targets you with mortgage and insurance ads and calls.
Why it matters
Profiles can be wrong, and you rarely see them. They can also feed decisions about you. Under UK GDPR, Article 22 restricts decisions made only by automated means that have legal or similarly significant effects. The ICO also says you have the right to object to profiling.
Profiling vs. related terms
- Data mining looks for patterns in large datasets, not necessarily about one person.
- Data aggregation combines data from many sources. It's often the first step: a profile is what you build from aggregated data.
- Automated decision-making is a decision made by a system. Profiling can feed it, but they're not the same thing.
How to protect yourself
- 1
Object where the law gives you the right
If UK or EU data protection law applies, you can object to profiling by writing to the company's data protection contact.
- 2
Limit what feeds the profile
Turn off ad personalization and location history in your phone and account settings, and decline non-essential cookies.
- 3
Remove the source data
Profiles are often built from lists sold by data brokers. Serus finds the data brokers and people-search sites that list you and removes your data.
- 4
Ask what a company holds on you
A data subject access request makes a company tell you what personal data it has.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data profiling legal?
Often yes, but it has to follow data protection law. In the UK, the ICO says organizations must consider fairness, and Article 22 restricts solely automated decisions with significant effects.
What is an example of profiling?
Sorting shoppers into segments like "new parent" from their purchases, then showing each segment different ads or prices.
Can I stop companies profiling me?
You can object under UK or EU law, switch off ad personalization, and remove your listings from data brokers that supply the data.
Sources
Something wrong or out of date? Tell us and we'll re-check it.