AI user profiling risk detector
Personalisation, scoring, recommendation, churn prediction, dynamic pricing — many AI features quietly meet the legal definition of profiling without their builders realising it. Under GDPR that definition is broad and the consequences are real: transparency duties, a lawful-basis requirement, and in some cases the strict limits of Article 22 on solely automated decisions. This tool walks you through the test so you know where your feature stands.
How it works
You describe the feature, its data inputs, and its outputs, then answer a short test that mirrors GDPR Article 4(4): does it process personal data, is it automated, does it evaluate or predict something about the person, do the outputs affect them, and could that effect be significant or reveal special-category data? The tool scores those answers, returns a plain-language verdict — not profiling, possibly profiling, or likely regulated profiling — and lists the obligations that follow, including the heightened duties when Article 22 or special-category inference is in play.
Tips and notes
- Aggregate-only is your escape hatch. If outputs are purely statistical and never linked back to an individual, you are usually outside profiling — keep the data that way where you can.
- Watch unintended inferences. A model trained on purchase history can infer pregnancy or health; the regulator cares about what the system can infer, not what you intended.
- A DPIA is almost always expected. Profiling with significant effects sits squarely in the territory where a data protection impact assessment is required — do it early and keep it current.