How AI Infers Sensitive Traits You Never Shared

Inference means estimating a characteristic or state from other information. A model may use page likes, purchases, browsing patterns, language, device behavior, or location to predict an attribute that the person did not directly disclose. Kosinski, Stillwell, and Graepel’s 2013 study found that Facebook “Likes” could predict some private traits and attributes in their research dataset. The study demonstrates a possibility under specific data and methods, not that every prediction about every person is accurate. A model’s output remains an estimate that can be wrong, biased, or overconfident. Sensitive inferences can matter even when a person never typed a health, political, or religious label. They may shape ad targeting, eligibility, pricing, or risk scoring. For example, repeated visits to a sensitive location or purchase patterns could be used to infer a health-related interest. The inference may be probabilistic and should not be treated as a clinical diagnosis. When models infer depression or pregnancy, the result can create privacy risks even before a consequential decision is made. The legal treatment depends on the data and use. California law includes certain inferences in personal information and has specific treatment for profiles reflecting sensitive categories. The EU GDPR restricts processing special-category personal data, including data revealing health, political opinions, or religious beliefs, subject to exceptions and legal bases. A business may also face consumer-protection rules if its privacy promises do not match its inference and sharing practices. No single rule means every inferred trait is automatically prohibited, and direct consent is not the only legal concept. People can reduce some collection by limiting app permissions, ad identifiers, and data sharing, but the available controls differ. Organizations should document what is directly observed, what is inferred, confidence and error, why the inference is needed, and who receives it. Give people meaningful access, correction, and appeal paths where applicable. Do not present a sensitive prediction as a verified fact.