<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-unauthorized-profiling
description: >-
  Detect automated profiling of individuals in violation of GDPR Art. 22 and equivalent regulations, including undisclosed decision-making systems and behavioral tracking beyond consent scope.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - gdpr
  - profiling
  - automated-decision-making
  - consent
  - data-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  frameworks: ["GDPR Art. 22", "CCPA", "EDPB Guidelines 04/2022"]
---

# Detecting Unauthorized Profiling

## Overview

GDPR Art. 22 restricts automated decision-making that produces legal or similarly significant effects on individuals. "Profiling" (Art. 4(4)) is any automated processing of personal data to evaluate aspects of a person — including behavior, interests, location, or reliability. Unauthorized profiling can trigger enforcement, injunctions, and fines up to 4% of global revenue.

Mode: `[MODE: PRIVACY]` — Map data flows before assessing compliance. Ambiguity is a finding.

## Profiling Risk Classification

| Profiling Type | Regulatory Status | Risk Level | Required Safeguards |
|---|---|---|---|
| Automated decisions with legal effect (credit, employment) | Art. 22(1) — restricted | Critical | Explicit consent or legal basis, human review right |
| Behavioral tracking beyond stated purpose | Art. 5(1)(b) — purpose limitation | High | DPIA required, consent refresh |
| Cross-context personal data correlation | Art. 9 if sensitive categories | High | Explicit consent, no inference from sensitive data |
| Analytics with aggregate output only | Generally permitted | Low | Anonymization verification |
| Personalization within disclosed scope | Permitted if in consent | Medium | Consent wording must match actual use |

## Detection Signals

| Signal | What It Indicates | Investigation Step |
|---|---|---|
| Database joins across unrelated data sets | Cross-context correlation | Map join logic to disclosed purpose |
| ML model training on personal identifiers | Individual profiling | Review model inputs, outputs, legal basis |
| API endpoints returning individual scores | Decision automation | Check if scores affect access, pricing, or services |
| Tracking pixels / fingerprinting scripts | Behavioral tracking | Verify against disclosed consent categories |
| Data sharing with ad networks beyond consent | Third-party profiling | Audit data flows vs. consent text |
| User ID linkage across products | Identity graph building | Check if disclosed in privacy notice |

## Assessment Checklist

| Check | Compliant | Non-Compliant |
|---|---|---|
| Profiling disclosed in privacy notice | Yes — specific description | Missing or vague |
| Legal basis documented per processing purpose | Yes — per Art. 6 + 9 | Bundled or absent |
| Automated decisions have human review option | Yes — accessible to subject | No override mechanism |
| DPIA completed for high-risk profiling | DPIA on file, dated | No DPIA or outdated |
| Data minimization applied to profile inputs | Only necessary attributes | Excessive data in model |
| Subject rights (access, objection) implemented | Functional self-service | Not implemented or broken |

## Workflow

1. Inventory all systems that process personal data at scale (ROPA review)
2. Identify any automated decision-making with individual-level outputs
3. Map data flow inputs: what personal attributes feed each model or decision system
4. Compare disclosed purposes (privacy notice) against actual processing
5. Assess legal basis per Art. 6/9 for each profiling activity
6. Check for high-risk indicators requiring DPIA (Art. 35)
7. Test subject rights: can individuals access their profile, object, or request review?
8. Document findings with specific article citations and risk ratings

## Audit Query Pattern

When database audit logging is available, query for cross-dataset PII joins that fall outside documented processing purposes:

```sql
-- PostgreSQL pg_audit — find joins across PII tables not from known app accounts
SELECT statement_timestamp, session_user, query
FROM pg_audit_log
WHERE query ILIKE '%JOIN%'
  AND query ILIKE '%user_id%'
  AND query ILIKE ANY(ARRAY['%behavioral_events%','%purchase_history%','%location_data%'])
  AND session_user NOT IN ('analytics-service', 'reporting-svc')
ORDER BY statement_timestamp DESC;
```

Route results to DPO review queue — these are compliance findings, not SIEM detections.

## Related Techniques

- [Implementing Privacy by Design](../implementing-privacy-by-design/SKILL.md)
- [Performing Data Protection Impact Assessment](../conducting-data-protection-impact-assessment/SKILL.md)
