What Is Profiling in the California Privacy Rights Act?

Profiling under the California Privacy Rights Act (CPRA) is explicitly defined as “any form of automated processing of personal information … to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements” (Cal. Civ. Code § 1798.140(z)). The statutory language clarifies that profiling is not limited to one type of data but encompasses a wide array of personal characteristics that are subject to automated analysis.

Consumer rights related to profiling under the CPRA are notable for their scope and specificity. The law grants individuals the right to opt out of profiling decisions where such decisions are based on the automated processing of their data to evaluate or predict their characteristics. The categories of profiling mentioned include:

• Work performance
• Economic situation
• Health
• Personal preferences and interests
• Reliability
• Behavior
• Location and movements

The operational impact of these rights on businesses is substantial. Organizations subject to CPRA must implement mechanisms to identify profiling activities in their data processing operations and provide clear methods for consumers to exercise their opt-out rights. This includes updating privacy notices to define profiling and explain its use, as well as maintaining technical controls to stop profiling for consumers who opt out.

The results of the CPRA’s approach to profiling indicate an increased emphasis on automated decision-making transparency and consumer autonomy. Businesses are required not only to disclose the existence of profiling but also to respect consumer preferences regarding such data practices. The law’s requirements reflect a shift toward individual control over algorithmic predictions and categorizations, marking a significant regulatory development in U.S. privacy law (Greenleaf, 2023; California Office of the Attorney General, 2023).

Key findings:

• Profiling under CPRA is broadly defined and covers a wide range of personal characteristics.
• Consumers have explicit opt-out rights regarding automated profiling.
• Businesses must provide clear notice and actionable opt-out mechanisms.
• There is a regulatory focus on transparency and consumer choice in automated data processing.

The CPRA’s profiling provisions represent a meaningful step in regulating the use of personal data for algorithmic evaluation and prediction within California’s privacy law framework.