Profiling is the automated use of personal data to evaluate a person or predict how that person will behave. The General Data Protection Regulation (GDPR) defines it in Article 4(4) as "any form of automated processing of personal data" used "to evaluate certain personal aspects relating to a natural person", in particular to analyse or predict "performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements." It exists because organisations want to treat people differently according to what the data suggests about them, from a lender pricing risk to an advertiser deciding which impression is worth a bid. In advertising, profiling is the step that turns a log of clicks and visits into a statement such as "likely to buy a car within 90 days". Most targeting rules in Europe, and increasingly elsewhere, turn on it.

How profiling works

The Article 29 Working Party, the body of European data protection regulators that preceded the European Data Protection Board (EDPB), described profiling in guidelines adopted on October 3, 2017 and revised on February 6, 2018 as three linked stages: collection of data, automated analysis to find correlations, and application of those correlations to an individual to infer present or future characteristics.

In the ad stack the stages map onto familiar machinery. Collection runs through cookies, pixels, software development kits (SDKs) and logins. Analysis takes place in a data management platform (DMP), customer data platform (CDP) or a platform's own models, which sort users into segments ("auto intenders", "new parents") or assign propensity scores, numbers expressing the likelihood of a conversion. Application happens at the auction. A supply-side platform can pass segment IDs in the user.data.segment objects of an OpenRTB bid request, and a demand-side platform (DSP) scores each impression against its own model of the user before bidding.

The Transparency and Consent Framework (TCF) run by IAB Europe makes the split explicit. Purpose 3 is "create profiles for personalised advertising" and Purpose 4 is "use profiles to select personalised advertising", and since TCF v2.2 neither can rest on legitimate interest, as PPC Land's consent management platform explainer sets out. Inferences count too: the Dutch regulator's 2026 draft guidance puts derived scores within the right of access.

The label does not ban anything; it switches on obligations. Profiling needs an Article 6 legal basis like any other processing, and where the data comes from cookies or SDKs, Article 5(3) of the ePrivacy Directive separately requires consent before anything is stored on or read from the device. Article 21(2) and (3) give an absolute right to object to direct marketing "which includes profiling to the extent that it is related to such direct marketing". Article 35(3)(a) demands a data protection impact assessment for "systematic and extensive evaluation" of people based on profiling.

The strictest rule is Article 22, which gives a person the right not to be subject to a decision "based solely on automated processing, including profiling", that produces legal or "similarly significant" effects. The automated decision-making explainer covers that regime. For advertising, the Working Party guidelines say most targeted ads will not meet the bar, but some may, citing someone in financial difficulty repeatedly shown high-interest loan offers.

The Digital Services Act (DSA) goes further. Article 26(3) bars online platforms from presenting ads "based on profiling" that uses special categories of data such as health, religion or sexual orientation. Article 28(2) bars profiling-based ads to users a platform knows with reasonable certainty to be minors. The EDPB's Guidelines 3/2025, adopted on September 11, 2025, confirmed the Article 26(3) bar applies even where a GDPR exception for sensitive data would otherwise be available. Political ads carry a parallel ban: the regulation on transparency and targeting of political advertising (Regulation (EU) 2024/900), applicable since October 10, 2025, prohibits targeting based on profiling with special category data such as political opinions.

US state laws take a narrower route. Virginia's Consumer Data Protection Act, in force from January 1, 2023, created the template copied by most later states: a right to opt out of targeted advertising, and a separate right to opt out of profiling "in furtherance of decisions that produce legal or similarly significant effects". Ad profiling is therefore usually reached through the first.

Origin and evolution

Article 15 of the 1995 Data Protection Directive already restricted decisions "based solely on automated processing of data intended to evaluate certain personal aspects". The Council of Europe gave the first formal definition in Recommendation CM/Rec(2010)13, adopted on November 23, 2010, describing profiling as "an automatic data processing technique that consists of applying a 'profile' to an individual."

GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, made the term binding, and California's Privacy Rights Act added a near-identical definition on November 3, 2020. The DSA's advertising bans applied to the largest platforms from August 25, 2023 and to all online platforms from February 17, 2024.

In SCHUFA (C-634/21), decided on December 7, 2023, the Court of Justice of the European Union (CJEU) held that a credit score can itself be an Article 22 decision, and in Dun & Bradstreet Austria (C-203/22), on February 27, 2025, it set limits on how the logic must be explained. On October 4, 2024, in a case brought by Max Schrems, the CJEU limited how much data Meta can use for profiling-based ads, applying data minimisation regardless of legal basis.

Why it matters for marketers

Interest audiences, lookalikes and bidding models all evaluate individuals, so the legal basis question attaches to the product itself. Meta's Less Personalised Ads option, introduced in November 2024, uses 90% less data according to Meta's own filing, and exists largely because the European Commission fined Meta 200 million euros on April 23, 2025 under the Digital Markets Act (DMA) over its pay or okay model.

Italy's Garante fined Intesa Sanpaolo 17.6 million euros on March 12, 2026 after it profiled about 2.4 million customers to choose who would move to a digital subsidiary. Ireland's Data Protection Commission fined LinkedIn 310 million euros in October 2024 over behavioural analysis and targeted ads. Reach figures reflect consent rates as much as audience size, as the ad personalization explainer sets out.

Limitations and disputes

The definition catches almost any analytics, yet the strongest protection, Article 22, is narrow. Critics say that leaves ad profiling to slowly enforced general rules; industry groups say "similarly significant effects" was never meant to cover a banner ad.

Inference is the second fault line. Sensitive traits are rarely collected directly; they are predicted. The Commission's draft Digital Omnibus, reported in November 2025, would limit Article 9 protection to data that "directly reveals" sensitive characteristics, which critics say would exempt inferred health or sexuality segments. The same draft recast Article 22 from a right into a permission. Courts are leaning the other way: on September 17, 2026, the Cologne Regional Court held that Article 9 covers what users tell Snapchat's My AI chatbot whether or not Snap meant to collect sensitive data, barring Snap from using those chats for ads without a legal basis.

Jurisdictions also disagree on where the line sits. California's privacy agency dropped behavioural advertising from its draft rules, with the board voting on May 1, 2025 to keep advertising outside "significant decisions", according to Squire Patton Boggs' Privacy World blog. Colorado's SB 26-189 likewise excludes advertising from consequential decisions, and the federal SECURE Data Act, introduced on April 21, 2026, would limit the profiling opt-out to significant decisions and preempt state laws.

Not the same as

Automated decision-making is the act of deciding by machine. Profiling can feed it, but profiling without a decision, such as building a segment, is still profiling, and a machine decision need not involve profiling at all.

Targeting and personalisation are uses of a profile: choosing who sees an ad or what it says. Contextual advertising selects ads from the page rather than the person and falls outside the definition, provided no user data enters the decision.

Performance profiling in software measures code execution, and criminal or racial profiling belong to policing; they share the word but not the legal framework.

Recent developments

After two postponed votes, member state ambassadors in the Committee of Permanent Representatives (Coreper) agreed the Council's Digital Omnibus mandate on October 21, 2026. Building on a September 3 presidency text leaked on September 21, it keeps Article 22 as a right and strikes the Commission's clause allowing solely automated decisions "regardless of whether the decision could be taken otherwise", moving a softer version into a recital. Its cookie exemption for ad measurement applies only where no profiling is involved. As of November 2026 talks with the European Parliament have not begun, and the Parliament committee vote is expected in early 2027, according to the nicfab procedural analysis.

On October 21, noyb published Berlin data protection authority notices, dated September 24, finding that the CDU, SPD, Greens and Left broke GDPR by targeting Facebook users on political interests in 2021. The parties were reprimanded, not fined, and an authority spokesperson told netzpolitik.org on October 23 the decisions are not yet final. The AfD case is still open while the party contests the authority's information demands on appeal.

On September 25, 2026, the High Court of Lagos State ruled that Meta profiled Nigerian users for ads without a lawful basis, rejecting contractual necessity and awarding the naira equivalent of 100,000 US dollars. Joint EDPB and Commission DMA-GDPR guidelines, whose consultation drew more than 100 published submissions, are expected to settle whether cross-service audience selection needs consent. The Commission told Agence Europe in May 2026 it expected the final text by the end of the year.

Timeline

  • October 24, 1995 - Data Protection Directive 95/46/EC adopted; Article 15 restricts solely automated evaluations of individuals.
  • November 23, 2010 - Council of Europe adopts Recommendation CM/Rec(2010)13, the first formal definition of profiling.
  • April 27, 2016 - GDPR adopted, defining profiling in Article 4(4).
  • October 3, 2017 - Article 29 Working Party adopts guidelines on automated decision-making and profiling (revised February 6, 2018).
  • May 25, 2018 - GDPR becomes applicable.
  • November 3, 2020 - California voters approve the CPRA, adding a statutory definition of profiling.
  • January 1, 2023 - Virginia Consumer Data Protection Act takes effect, with opt-outs for targeted advertising and for significant-decision profiling.
  • August 25, 2023 - DSA bans on profiling-based ads using sensitive data or targeting minors apply to very large platforms.
  • December 7, 2023 - CJEU rules in SCHUFA (C-634/21) that a credit score can be an Article 22 decision.
  • February 17, 2024 - DSA applies to all online platforms.
  • October 4, 2024 - CJEU applies data minimisation to Meta's ad profiling in Schrems (C-446/21).
  • October 24, 2024 - Irish DPC fines LinkedIn 310 million euros over behavioural analysis and targeted ads.
  • November 2024 - Meta introduces Less Personalised Ads in the EU.
  • February 27, 2025 - CJEU rules in Dun & Bradstreet Austria (C-203/22) on explaining the logic of automated decisions.
  • April 23, 2025 - Commission fines Meta 200 million euros under the DMA.
  • May 1, 2025 - California agency advances rules dropping behavioural advertising from automated decisionmaking scope.
  • July 14, 2025 - Commission publishes DSA Article 28 guidelines on protecting minors.
  • July 30, 2025 - UK Information Commissioner's Office publishes guidance on profiling tools for online safety.
  • September 11, 2025 - EDPB adopts Guidelines 3/2025 on the DSA and GDPR.
  • September 25, 2025 - Austrian authority rules KSV1870's automated credit scoring unlawful.
  • October 10, 2025 - EU political advertising regulation (2024/900) applies, banning profiling-based political ads using special category data.
  • November 19, 2025 - Commission publishes the Digital Omnibus proposal.
  • January 1, 2026 - California automated decisionmaking regulations take effect.
  • March 12, 2026 - Garante fines Intesa Sanpaolo 17.6 million euros over customer profiling.
  • April 21, 2026 - SECURE Data Act introduced in the US House, proposing a federal profiling opt-out and preemption of state laws.
  • April 25, 2026 - Dutch regulator opens consultation on explaining automated decisions.
  • September 3, 2026 - Council presidency compromise restores Article 22 as a right.
  • September 24, 2026 - Berlin data protection authority closes complaints against four parties over political-interest targeting on Facebook.
  • September 25, 2026 - Lagos High Court rules against Meta over ad profiling.
  • September 17, 2026 - Cologne Regional Court bars Snap from using My AI chat data for advertising, applying Article 9 to chatbot disclosures.
  • October 11, 2026 - Planned Coreper vote on the Digital Omnibus does not take place.
  • October 21, 2026 - Coreper agrees the Council's Digital Omnibus mandate, keeping Article 22 as a right; noyb publishes the Berlin decisions.
  • January 1, 2027 - California obligations for automated significant decisions apply.

Summary

Who: Advertisers, ad platforms, data brokers, lenders and any organisation scoring individuals; regulated by EU and national data protection authorities, the European Commission under the DSA and DMA, and in the US by agencies such as the California Privacy Protection Agency.

What: Profiling is automated processing of personal data to evaluate or predict aspects of a person, such as interests, behaviour or economic situation, defined in GDPR Article 4(4) and underlying segment building and bid scoring in advertising.

When: First defined by the Council of Europe on November 23, 2010, made binding by GDPR from May 25, 2018, restricted for ads to minors and on sensitive data by the DSA from 2023 and 2024, and under revision through the Digital Omnibus, with the Council's mandate agreed on October 21, 2026 and Parliament's position pending as of November 2026.

Where: Across the EU and the UK under GDPR-based law, in Virginia, California, Colorado and other US states under state statutes, and in other jurisdictions such as Nigeria, where courts have applied privacy rights to ad profiling.

Why: Profiling lets organisations treat people differently based on predictions, which is the basis of targeted advertising and also the source of risks around opacity, sensitive inferences and decisions people cannot contest.