Profiling isn't just about the data you collect; it's about the impact of your automated decisions. Privacy laws in the US and Europe distinguish between automated decisions with "legal or similarly significant effects" and those without. If you're involved in Behavioural Advertising or content personalization, you're generally safe. However, decisions affecting credit, employment, or eligibility fall into restricted areas.
This distinction is crucial because your compliance obligations depend on the outcome, not the method.
What Changed
Profiling is now defined by three elements: automated processing of personal data to evaluate personal aspects of an individual. This definition appears in Virginia Code Ann. § 59.1-575 and EDPB Guidelines WP 251. The focus has shifted to consequences rather than methods.
Profiling is divided into two categories:
High-impact decisions trigger opt-out rights in the US (Virginia Code Ann. § 59.1-577(A)(5)) and are prohibited in Europe unless specific conditions under GDPR Article 22(1), (2) are met. These decisions affect legal rights, financial standing, or access to essential services.
Low-impact decisions, like product recommendations and content curation, are allowed without special consent, provided you meet transparency requirements.
The gap between US and European approaches is significant. Virginia allows opt-outs for significant effects, while GDPR prohibits them unless you can prove contractual necessity or obtain explicit consent. This isn't just semantics; it's a compliance challenge.
Key Findings
1. "Significant effect" lacks a clear definition
Neither US state laws nor GDPR precisely define "similarly significant effect." EDPB Guidelines WP 251 provide examples like loan denials and recruitment screening but leave gray areas. If your profiling affects insurance premiums or account access, document your legal analysis for each case.
2. European prohibition requires justification
Under GDPR Article 22(2), high-impact automated decisions are only allowed if necessary for a contract or if explicit consent is obtained. "Necessary" means the contract can't be fulfilled without automation. Most marketing uses won't meet this standard.
3. US opt-out rights add complexity
Virginia Code Ann. § 59.1-577(A)(5) requires honoring opt-out requests for significant effects. You need a system to identify these decisions, flag affected individuals, and route them to non-automated processes. Decision-specific controls are essential.
4. Profiling consent differs from processing consent
For GDPR compliance, consent for high-impact profiling must be separate from general data collection consent. It should specifically address automated decision-making and its logic. Bundling it into a general category won't suffice.
5. Transparency obligations apply universally
Even low-impact profiling requires Purpose Disclosure under GDPR Article 13(2)(f) and similar US provisions. You must explain the logic, significance, and consequences. If you can't explain your algorithm's conclusions, you can't use it legally.
What This Means for Your Team
Your profiling activities likely fall into three categories:
Clearly permissible: Content personalization, product recommendations, and A/B testing that don't affect pricing or access. These need transparency but no special consent.
Clearly restricted: Credit scoring, employment screening, and insurance underwriting. In Europe, you need contractual necessity or explicit consent. In the US, you need an opt-out mechanism.
Uncertain: Dynamic pricing, loyalty tiers, and personalized search results. These require legal analysis specific to your implementation. The key is whether the outcome affects legal rights or life circumstances.
If you're in both US and European markets, you can't default to the lower standard. GDPR's rules are stricter than Virginia's opt-out rights. You'll need jurisdiction-specific controls or a global policy meeting European standards.
Action Items by Priority
Immediate (this quarter):
Inventory all automated decisions using profiling. Document data inputs, decision logic, and outcomes. Flag decisions affecting eligibility, pricing, access, or status.
Audit your Consent Management Platform. If you're collecting consent under a generic category, you're likely non-compliant for high-impact decisions. Create separate consent requests for automated decision-making.
Near-term (next two quarters):
Develop opt-out mechanisms for significant profiling decisions. This requires a workflow change. When someone opts out, use a non-automated process for their case. Document routing and train teams for manual review.
Draft Legal Basis for Processing documentation for each profiling use case. In Europe, state whether you're relying on contractual necessity or consent. In the US, document why the decision does or doesn't have a significant effect.
Ongoing:
Review new profiling implementations before deployment. Legal and privacy teams should approve any automated decision affecting access, pricing, or eligibility.
Monitor regulatory guidance on "similarly significant effects." Update your internal classification as enforcement actions clarify boundaries.
