Profiling

Scope

The GDPR defines profiling as any form of automated processing of personal data used to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movements (Article 4(4)). The same Regulation gives the person the right not to be subject to a decision based solely on automated processing that produces legal effects concerning the person or similarly significantly affects the person, and provides for exceptions such as a contract, the legal order or explicit consent (Article 22). Law No. 6698 does not regulate profiling separately; because profiling is a personal data processing activity, the general principles and processing conditions in the Law apply, and the data subject may object to a result arising against them from exclusively automated analysis (Articles 4, 5, 11/1-g). Article 25/A of the Regulation on Commercial Advertising and Unfair Commercial Practices, which entered into force on August 1, 2026, prohibits targeted advertising through profiling methods based on personal data where it is known, or can reasonably be expected to be known, that the consumer is a child.

Practical importance

Credit assessment, insurance pricing, recruitment, fraud detection and targeted advertising are common areas of use for profiling. A data controller that engages in profiling must state this purpose specifically and clearly in the privacy notice, identify the processing condition on which it relies, and assess whether profiling indirectly generates special categories of personal data (for example, health information). For companies operating in the EU, the EU Artificial Intelligence Act treats AI systems that profile natural persons in the areas listed in Annex III of the Regulation as high-risk in every case (Article 6(3)).

Commonly confused concepts

Profiling and automated decision-making are not the same thing: profiling is a processing activity that evaluates a person; making a decision on the basis of that evaluation without human intervention is a separate stage, and the right to object is of particular significance with respect to this outcome. Profiling is also not identical to targeted advertising; targeted advertising is one of the practices in which profiling can be used. The algorithm used in profiling, in turn, is the technical tool of the activity.