Does profiling require machine learning?

No. Automated rules can also evaluate personal aspects.

Is every profile a final decision?

No. A profile can be an intermediate assessment used by a recommendation system or a human reviewer.

Can profiling occur without a real name?

Yes. An account, device, or other identifier can still connect assessments to an identifiable person.

AI Glossary / Governance, ethics and safety / Intermediate

Profiling

Definition

Profiling, in the personal-data and AI context, is automated processing that evaluates or predicts aspects of an individual, such as preferences, behavior, interests, or likely needs. It uses recorded data to construct an assessment about a person. A profile can include inferred information that the person never directly supplied, and it can influence subsequent recommendations or decisions.

What it means

A collection of observations becomes profiling when it is used to assess personal characteristics or patterns. Recording that someone opened a page differs from inferring that the person is interested in a particular topic and using that inference to personalize their experience. The inference may be useful, inaccurate, sensitive, or unexpected. Profiling need not use a complex neural network; an automated rule can perform it. Here the term concerns people, not software performance profiling, which measures matters such as execution time, or data profiling, which examines dataset properties.

How it works

A system collects or receives relevant observations, connects them to a person or identifier, and applies rules or learned relationships to infer a characteristic or predicted behavior. The output may be a category, score, preference vector, or recommendation signal. A later process decides how to use that output. Profiling and automated decision-making are therefore related but distinct: an assessment can support a human decision, while some automated decisions need not involve a rich personal profile. Data quality, the inference method, the purpose, and the consequences all affect the risks. Identifiers that omit a person's name can still support profiling when they remain linked to an identifiable individual.

Three practical examples

A reading service infers preferred subjects from previous interactions and uses the profile to rank articles.
A support application estimates whether a customer may need help completing an onboarding process, then offers an optional assistance prompt.
A fraud-monitoring system compares account behavior with an inferred pattern to flag unusual activity for review. These examples describe possible uses, not automatic approval of the associated data collection or decisions.

Think of it this way

Think of a profile as a set of penciled notes in a service notebook: some record what happened, while others guess what the person might prefer next. The distinction between observation and inference should remain visible. The analogy is limited because automated profiling can combine many sources, operate at scale, and be reused outside the original context. A mistaken inferred label can therefore travel farther than an ordinary personal note.

Worked example

Suppose a fictional recommendation service labels a reader as interested in gardening when at least 6 of their last 10 article clicks concern that subject. A reader has 7 gardening clicks, so the rule assigns the label. This establishes only that the recorded behavior meets the rule. It does not establish why the clicks occurred: the reader might be researching a one-time gift or sharing a device. If four new non-gardening clicks replace four older gardening clicks in the rolling window, the count falls to 3 of 10 and the label no longer applies. The example shows how the observation window and update rule shape a profile. Neither the original 70% click share nor the later 30% share is a probability that the person's enduring identity is gardening-oriented.

Illustrative case study

Fictional case: Alder Learning personalizes tutorial suggestions from recent activity. A user reports receiving beginner material after helping a colleague with introductory exercises. The team adds controls to reset inferred interests, separates temporary activity from declared preferences, and explains why suggestions appear. It reviews whether the data is needed for the stated purpose. This invented case illustrates how profiling can misinterpret context and why correction and user control matter even when the immediate consequence is relatively modest.

Common misconceptions and mistakes

A profile is not a complete or objective description of a person. Inferred characteristics can be wrong even when the underlying observations are accurate. Removing a name does not necessarily make the data anonymous. A high-performing group-level model does not make every individual assessment correct. Profiling is also not synonymous with unlawful discrimination or with a legally prohibited automated decision; those judgments depend on the activity and applicable rules. Conversely, a human somewhere in the workflow does not automatically resolve concerns about intrusive collection, inaccurate inferences, or unfair treatment.

Business use

Specify what is being inferred, why it is needed, and how the result will affect people. Distinguish declared information, observed behavior, and model-generated assessments in documentation. Evaluate accuracy and harmful errors across relevant groups, including the effect of stale or shared-device data. Give people appropriate information and ways to correct or challenge consequential assessments. Set access and retention controls and review unexpected reuse of profiles. The EU GDPR provides a particular legal definition of profiling and additional requirements in relevant circumstances; organizations should assess their actual jurisdiction and use rather than treating a general glossary description as a compliance determination.

Check your understanding

A service accurately records several visits to a topic page and infers a lasting personal interest. Is the inferred interest necessarily accurate?

Answer: No. The visits are observations, while the interest is an inference. Context, shared access, and temporary goals can make the inference mistaken.

Related terms

Personal data
Inference
Automated decision-making
Consent
Sensitive attribute
Rectification
personalization
user model
behavioral data
data minimization

Learn next

Trace one personalized recommendation back to its inputs. Label each input as supplied, observed, or inferred. Identify the purpose, update rule, possible mistaken interpretation, and practical way a person could correct the resulting profile.

Sources

Aalto Dictionary of Machine Learning, profiling entry: https://aaltodictionaryofml.github.io/ADictML_Main.pdf European Data Protection Board, automated decision-making and profiling overview: https://www.edpb.europa.eu/topics/ai-and-technology/automated-decision-making-profiling-and-online-tracking_en

Previous: Productization Next: Program dependence graph