Profiling

Legal Framework

Profiling is defined in Article 4(4) GDPR as a form of automated processing that evaluates personal aspects of an individual. The definition is deliberately broad, encompassing both analysis and prediction of characteristics ranging from economic situation to behaviour and location.

Profiling triggers layered transparency obligations. Where data is collected from the data subject, Article 13(2)(f) requires information about automated decision-making. Where data is obtained indirectly, Article 14(2)(g) imposes a parallel duty. The right of access under Article 15(1)(h) entitles the data subject to meaningful information about the logic involved, the significance, and the envisaged consequences of such processing.

Key Developments

The CJEU's January 2025 ruling in Mousse (C‑394/23) confirms that the right to object under Article 21 GDPR expressly encompasses profiling based on Article 6(1)(e) or (f), requiring controllers to cease processing unless they demonstrate compelling legitimate grounds.

"The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions."
— CJEU, C‑394/23 (Mousse), ¶10

The EDPB's consent guidelines reinforce that where profiling forms part of automated decision-making under Article 22, explicit consent may be required, reflecting the heightened risk to data subjects.

"Explicit consent is required in certain situations where serious data protection risk emerge, hence, where a high level of individual control over personal data is deemed appropriate."
— EDPB Guidelines 05/2020, §91

Dutch enforcement has also reached the profiling ecosystem. The AP's action against Microsoft and Xandr regarding cookie-based tracking without prior consent illustrates how profiling infrastructure built on tracking cookies falls squarely within the GDPR's scope when it enables evaluation of personal aspects.

Status of the Debate

Profiling as a legal concept is contested in court. While the definition in Article 4(4) is settled, its boundaries — particularly where profiling shades into automated decision-making under Article 22 — remain actively litigated. Courts diverge on whether profiling that supports (but does not itself produce) a solely automated decision triggers Article 22's safeguards. The Mousse ruling clarifies the objection right but does not resolve the threshold question: at what point does profiling become "solely automated" decision-making with legal or similarly significant effects. A future CJEU reference explicitly addressing that boundary would resolve the open question.

Practical Guidance

• Map your profiling activities against Article 4(4). Any automated evaluation of personal aspects — credit scoring, behavioural advertising, performance monitoring — falls within the definition and triggers transparency duties under Article 13 or Article 14.
• Provide meaningful logic information. Under Article 15(1)(h), data subjects must receive not just notice that profiling occurs, but meaningful information about the logic, significance, and envisaged consequences.
• Assess Article 22 applicability. If profiling produces decisions with legal or similarly significant effects without meaningful human intervention, explicit consent or another Article 22(2) condition is required.
• Honour objection rights promptly. Per Mousse, an objection under Article 21 halts profiling based on legitimate interests unless the controller demonstrates compelling legitimate grounds overriding the data subject's rights.
• Verify consent quality for tracking-based profiling. The Microsoft/Xandr enforcement confirms that profiling infrastructure relying on cookies without valid prior consent is unlawful — ensure consent is freely given, specific, and informed per EDPB Guidelines 05/2020.