Year: 2025
Type: article
Abstract: Age assurance is an increasingly relevant topic from a socio-legal perspective and behavioural profiling, that is, determining the age of users by profiling their online behaviour, is one method of age assurance. While behavioural profiling for age assurance might be a relatively frictionless method of implementing age assurance, it poses concerns from a privacy, accuracy, and non-discrimination standpoint. Legislation, including the General Data Protection Regulation, the Digital Services Act, the Audio Visual Media Services Directive, and the Artificial Intelligence Act, apply in different manners to behavioural profiling for age assurance, and there are legitimate grounds to conclude that behavioural profiling should be subjected to strict scrutiny and may not be a proportionate and thus lawful form of age assurance. Despite several concerns regarding behavioural profiling for age assurance, digital service providers such as TikTok, Meta, and Google employ this practice, possibly leveraging existing commercial profiling mechanisms for this purpose. Even if behavioural profiling is convenient for digital service providers owing to reduced user friction, this cannot be a justification for employing such age assurance methods instead of privacy-friendly and effective age verification techniques, particularly when age verification is legally mandated. The fact that today we are living in an online environment where digital service providers extensively mine, collect, and use the data of users and build their profiles for commercial, and at times even political purposes, is an extensively written about topic.1 However, profiling of users need not always be for commercial or political purposes, and may also be for ascertaining the age of an online user, and this is where age assurance comes in. Age assurance, that is, the various methods used for finding the age of online users, has emerged as a contemporary topic of socio-legal relevance.2 Various stakeholders view age assurance as a tool to protect children online, including by preventing them from accessing harmful content and services. Behavioural profiling is one such method of age assurance whereby algorithmic analysis is employed to study the online activities of users and estimate their age.3 While age assurance in general is legally relevant in different ways as per European Union (EU) law,4 whether behavioural profiling is a legally acceptable form of age assurance is less clear. On the one hand, behavioural profiling as a method of age assurance has certain benefits over other age assurance methods, while the other hand, behavioural profiling also poses several to the of online users, including behavioural profiling particularly to is the fact that it an for digital service providers to the profiling of users, including the and of online be from the that at of the online and employ behavioural profiling for age assurance, that of users are subjected to this the a analysis of behavioural profiling as a method of age assurance, including an of the socio-legal of the this the profiling as a method of age an of age assurance is and behavioural profiling to age assurance. also the and of behavioural the analysis of behavioural profiling for age assurance the and various the General Data Protection the Digital Services the Audio Visual Media Services and the Artificial Intelligence legally behavioural profiling for age assurance. The is the of the is to that the where digital service providers users to estimate their of whether that profiling is for age assurance or is of a profiling including for commercial times an the topic of age assurance by and is from the perspective of age assurance be used to the of children digital to age assurance should also not the to be The European in for that it a for a European age verification online, as to children from online and their and The European also has a to the for age and a age assurance that when age assurance is or may be legally and of and for age assurance age assurance as a to protect children online the and or to be used by and online in the and the an there are different ways in age assurance be as legally that to be of a age to certain and or to certain age assurance for and that service providers and protect children from harmful it comes to harmful content strict such as effective age verification be that a of digital service providers to protect children may age assurance as an a online to to a of privacy, and to this of age assurance may be an it is not as the in the and the or to be to users of certain may age assurance for a might the online to a that the be to users a certain to and this is not by be is also that may to age assurance in the of or the digital service it as an owing to the by children the other for age assurance is and are that may digital service providers to age assurance. the the certain digital service providers to age assurance to protect children The also the of and such age assurance the several at the age verification to be by that content that is harmful to The such is that children from accessing and from accessing in the by children in the online in the Act, to to to children are in and while there are the age assurance methods that be the is to a in implementing this online age and various the to age assurance. in the of data and content of the of age assurance in The age assurance that it is a topic cannot be as a for online and the of age assurance the and online and their the socio-legal contemporary of age assurance is from the it be to the topic of this profiling, a method of age assurance used by online Age assurance is used as an for the various employed to an age or age are of age assurance, that is age age and The age to of age assurance where the age of a user is methods such as analysis and online behavioural to age where the is to the age or age of a user, age in an age or age Age be employed at the of an to use the or for while are the are several methods of age and behavioural profiling is one of the methods, other such methods age and the behavioural profiling and age assurance. age assurance and behavioural profiling profiling in the online is the by data is by to about users or their The profiling as a method of of to or of a such as their or or their or or of a age profiling is not in this the of that analysis also to The of profiling is and not profiles to be and of and is by the online activities are to estimate their age in this method of age is behavioural The of such algorithmic analysis may be and a digital activities this various data may be that online behaviour, including content and activities and a and and behavioural profiling is a of a age an that and are also service providers such behavioural to estimate age that of the user and other The of such age the employed and the of the used to the is by of by digital service providers regarding the of such and their that it to estimate age by at online user behaviour, the of and is is data that of a user and the user other users and user such as age is from the by the user and whether there is in the in different such as and is by the to this a of data from as in However, not in that such data is used for ascertaining the age of users, such a possibly the by of and by user is also data the of users subjected to such behavioural profiling and the of the behavioural profiling is used as a method of age assurance, it is not in or as a method of age assurance to be in where age verification is legally behavioural profiling, a form of age not be a to such Behavioural profiling be for different that may be in the profiling may be by a the of the age of the users to or users the age However, profiling activities may also be by a digital service for for commercial and purposes, and profiles may an estimate of the be used for age assurance the of in the of digital service providers user behaviour, user and users content and it is that it to increasingly Data from and user are data to user this has several to and digital profiles of users, a of about the users, including their and age The such commercial profiling is to and user and children this behavioural profiling and commercial profiling as an to be of behavioural that the profiling activities that online is and employing profiling for age assurance is also not The has that at of the and behavioural profiling for age assurance. is whether this is of a commercial profiling of However, the commercial profiling it is or even that behavioural profiling as age is of commercial profiling of users digital behavioural profiling for age is relevant that commercial profiling of children is the of that if behavioural profiling is for age a profiling for commercial purposes, may be in the of the may that data of children for the of their online such as for age assurance, may not also be used for commercial purposes, such as the of that for commercial profiling, age is The of this is to legally behavioural profiling as age when the or is age and also when it is as of a of profiling Behavioural profiling as age has and are certain to behavioural profiling as age assurance as to other it the of children not from the online if children to their age this children not such to the in that behavioural profiling may be privacy-friendly for age as the data to such need not be However, behavioural profiling is to such an from a perspective in as this method be a tool in children the age when the children age assurance if the age assurance method employed by the is that of or at the of children may this the of an behavioural profiling not for users while a as to other methods where the age assurance users to certain the in user be an from the perspective of it the of users to where may the age assurance less However, behavioural profiling also poses certain be that is and profiling may an of the in online is to age the method may different of user from content to in an of a to and data is a of of the is also the of such profiling data or used for commercial or political for or for their political for behavioural profiling to be effective in to the of users and not users, thus a to users, of whether are digital service providers and behavioural age may be to of data to the of their a to online may in fact data and profiling of users even is the is also the that behavioural profiling may a to such as may that their profiling activities are for user be to the of commercial profiling and behavioural profiling, and to that the is not used as a to the study that children and their behavioural profiling, to the of the are when and as to are for profiling is also such are used and are this in in the that the that the profiles of the users, including by to whether the age of the user in the age by the users the to their to that may users or for users if the that the age are not it is that one of the ways in the such that an existing user is not of age is by the online and their age the that the by users is used to and and that the content is for the European Data Protection the age verification of as of the Data Protection the of the employed not in the age assurance is is an as the of online not be an the the of the that is used to the to online it is for such algorithmic analysis to be this is from a to the of in The for is also as online may not be of the age of a the of the age of users their activities and not the of such methods a when the of data is not the of assurance by behavioural profiling be the of such an analysis of online may also be when user and are by as children and their and of may in users to and children to and to is that the age assurance behavioural profiling may to of users, behavioural that a online their not and are not to use a thus them to services. a even for or is also the that such online age are not to and the that users from certain may be by algorithmic in behavioural profiling methods the to non-discrimination in and the of the to the behavioural profiling has to be to the of the and a method of age However, that behavioural profiling is not as an age assurance and may even be in certain The has that behavioural profiling is an acceptable method of age assurance method that it is in a proportionate that there is in the and of the and that the data used for profiling is not used for other The also to that the by such behavioural profiling methods also be used to the of children a The in has also that behavioural profiling may be as a of age assurance at the of and that and are is that behavioural profiling be an tool certain to the method or to age assurance used at the However, the users may as a of behavioural profiling, it is to such at The Data Protection has even that user profiling is not for age age assurance not behavioural profiling as an effective or an age assurance and the of different stakeholders behavioural profiling view by However, that it not behavioural profiling of users as a method for to if a of their users are be relevant to at the behavioural profiling, in to whether there is justification for it as a method of age assurance. this the behavioural profiling is by the the the and the whether behavioural profiling for age assurance is a proportionate a analysis of age assurance should be Age assurance may be to the the of age age assurance also the to the age assurance is to a to the and of data in thus a Data Protection as per is the use of data in behavioural profiling for age assurance and the of whether and this form of age assurance the particularly in view of the of data for children the profiling as age assurance the while the that age assurance is a to protect privacy, and online and them certain in the of online it is also that age assurance should user the profiling as age assurance the The age verification as a relevant to children from accessing while that data of used for such should not be used for the profiling as age assurance the behavioural profiling for age assurance it to to the has an this method of age assurance the profiling as age assurance the the is also in to behavioural profiling as age assurance. a behavioural data be from and the to this behavioural profiling is by the of profiling in the the profiling as age of the when profiling has or data and when data that are are children and that should be when the data is a behavioural profiling for age assurance users of a digital in this we the where children are for age assurance of their of the to the strict that the the of data in to behavioural profiling and when the the is to including behavioural profiling, be to to The of TikTok, Meta, and that is online that we in behavioural profiling for age not to if the is at data that to behavioural profiling for age assurance is the data also that data use in to the of not to be that behavioural profiling is a method that is to of data is for age Data should also be that privacy-friendly age assurance methods for age methods use to users to their age other to the as there is an as an that the in has this as a privacy-friendly method of age and the has this method when there is a to by the that it is for age assurance to such as and data to that the age assurance not in profiling of users for commercial or The of data be in the where data are age is this may the that data be and if be and in the and of behavioural profiling as age behavioural profiling for age assurance may be in of the algorithmic analysis is, the of users may also not be that behavioural profiling for age assurance is the are and whether the are cannot or and users are in by and is an if to the or is the user is to be the when behavioural profiling is not to users, including or in or even the and of behavioural profiling as age the also not to the of The in the age assurance of is to if that age assurance not it to the users the for age assurance and the of the such is to be or that the should not be as or that is a is also be as that is the or of a is behavioural profiling, this that not should the of data for the profiling the also that such should not in for of users are of The of that data be if the is one of the grounds in it to to that is data is for the of a there is a the digital service and user, this a the of be legally the and in not the to to data for the of age assurance this whether the data is to to and thus age assurance, to conclude a in the Age assurance in the form of that is the user or age or of in the to if are to use the service to the and be by this it might that is in to at the of the data to a in the of behavioural profiling as age assurance, the user an and thus be in a the digital service in to behavioural data for this and the the data may also to data for the of behavioural profiling as age assurance this is to the as legally need to whether the data in has the age of digital is is to strict as that it be and and may be to in the of there may be a in or digital service providers age assurance, for of data is in the of age the may to be of a certain age a service or a or at that age assurance is this a for the of a digital service may a legitimate to data for the of age assurance even if in or a digital service may in their general and that to the service is to a The digital service a in such a the service may not be for users of that the of data may be for the of age assurance to whether a user is the age for for an that is and thus in a for age assurance by digital service However, are the to the of data is proportionate and whether the method used is in the of it is that the is for the that is age assurance, a is The that age assurance this that legitimate data cannot be as by other less of the and of data that there are less the is not The to concerns also the of in for the of in we the behavioural profiling as age and commercial and and of behavioural profiling as age age assurance behavioural profiling is a method that is and is to data and data other privacy-friendly methods that or are behavioural profiling as age assurance is a method of age and thus whether has the The may not be and the method not as not by other methods may also be is the data be of Even if the is for to the legitimate of the digital service also be the and of data to whether the is also the data and for data that The profiling for age assurance and data of this that behavioural profiling for age assurance may not the of data accuracy, and relevant in the the users behavioural profiling may in of or the of the data that is behavioural profiling may the of or the and methods of behavioural profiling may of of and the of data and to the of the data children a of regarding the of their not may of the of the may also be in their behavioural profiling as age assurance is not effective children are not the age by online use even if are not or for practice, this is the for if not online used by should be in the where the is a profiling children is not as in the of the the the of the data data not or not the data this may to them not should also are to different and may different or while age assurance may a legitimate of for data the and the relevant may the and of the age assurance in this is behavioural profiling for age assurance, and may to the that the data is The of the analysis of is that data for age assurance be if there is a or if there is such the digital service has a legitimate However, it is whether behavioural profiling as age assurance the of and the of behavioural profiling as age assurance data and in is the of and the of the of or the of whether this form of profiling is in a including profiling, if it or for the data the of may be for data Behavioural profiling as age assurance may such Google user if Google that the user is not of the age that owing to that users be of Google about in when in to a Google or and use to if are over the behavioural profiling by Google the of users not to their Google the and such in for by the of of behavioural profiling may in the of the the digital service and of a be a of age assurance, as a user may not the age to an to the and of a digital service if this age assurance by the a user may a and content the of the are also it should also be that age assurance is the of the be to use of or data may be of behavioural profiling for age user the age may be their age is behavioural profiling be the and of behavioural profiling as age behavioural profiling as age assurance has it is the of of that is for the of or a and are to the in the of behavioural profiling for age to and The is that behavioural for age assurance are by or as we such a not to and to a of of the of in their be the should be if in the of the Despite the fact that age assurance may be in the of it is that the an to behavioural profiling as age assurance the of data profiling for age assurance and data an online to protect children is in that if a user is to be a the user should not be subjected to profiles profiles of data as in are for users the by online and online However, are in the of profiling for and not at behavioural profiling be as in the behavioural profiling as age and commercial While the not behavioural profiling, may an such profiling by that online should employ and proportionate to a of privacy, and of if be by The not a of privacy, and the European a for to for the of online as per to in to age should be in However, it is to conclude that even if profiling of children is for purposes, such as it should be to the particularly the various behavioural profiling as in the and of behavioural profiling as age and analysis of behavioural profiling as age assurance the in the profiling as age assurance the The of that in to online may not data to whether a user is a to this While the of is not it is possibly an that age assurance should be is that the European this as The to behavioural and service providers and to to protect from harmful including age verification However, the data of to such may not be for commercial purposes, such as profiling and and this that service providers and are legally not to use the data of children for behavioural profiling for commercial purposes, even behavioural profiling for age assurance purposes, as is not The by this view in and that age verification in this age methods as such a data for commercial is in the of data of that is in as data of other However, behavioural profiling data of as to whether such data be used for commercial profiling, one to the in the profiling as age assurance the behavioural profiling it is relevant to that is, the Act, this form of age assurance. the is an that for different of and their and use The use of for behavioural profiling not to one of the as in However, the be to behavioural profiling in different are several by the when it comes to including to and the for the of there are ways in an be the is by one of the in and it is to to be in the or the is in the of in behavioural profiling be as if of an are used by the for a and such is the of the or the of to behavioural profiling, it is relevant to the of data as data from to the or behavioural of a are to this the of of a is also is particularly relevant to behavioural profiling, where online user is while the of data in that data be in the of an for the data to as this is not in the Behavioural data that is used for purposes, also as such as and a the of their be to whether the and has to a the of of a be used in behavioural for behavioural online and to that in the profiling as age including and are also used for age behavioural in the of online user behaviour, it has that a online such as their of or should behavioural data and it be that the Act, data in the of behavioural profiling the of is particularly as the not data to the of a as in the a as is to certain their if behavioural profiling and if data are used to users their age it be that behavioural profiling is a a is or the and the behavioural the of of or from data to political or a and are as data in While at behavioural profiling not to this is from if the an that users certain political or are to be of a certain the European of of and the that be from such it for behavioural profiling to be as it might be that for age assurance are in this this is an that even where an is as certain from this However, such not apply when the user as in the of behavioural behavioural profiling to as by may apply even if the not use to certain that may be and one such in the is a of such should users that such a is used thus in the of and in the that apply to the of data by such the profiling as age assurance the if a is used to profiling to such may also be The in and the and of children online to of their users are children for that and or to that are for children or children cannot use them if cannot be there are different of age assurance, that is age and age for digital service providers cannot be age even when it is not by the and a of for children that be if of users the relevant age is also the the and implementing privacy-friendly online age verification methods is behavioural profiling for age assurance used by at online and concerns for users, and analysis that are not is behavioural profiling as age assurance is in a the this form of profiling not the data of data accuracy, and thus the of of data there may possibly be a or legitimate to data for age assurance, behavioural profiling for age assurance is to be a proportionate and effective of age assurance and not the of the the The in this is also that if behavioural profiling for to of online user for commercial profiling of behavioural profiling as age assurance is to be a the if are to the apply to this form of behavioural profiling as a this relatively frictionless as of their profiling is to the it is that users are in their age and methods the for age assurance the digital service providers to regarding the behavioural profiling employed by as to user and to a the of this in where age verification is by it might be to and the user of the by them to in a and that a age to use certain digital or or age in of age for the of user friction, may thus not be a age verification when it is that age assurance the behavioural profiling for age assurance. other age verification for age assurance methods that may be to by from a user not that to and the of users should be of The that or or other of that to the in this
Source: International Data Privacy Law
DOI: 10.1093/idpl/ipaf012
Authors: Mohammed Raiz Shaffique, Simone van der Hof
Institution: Leiden University
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: hybrid
Estimated APC paid: $4,850
OpenAlex ID: W7106163768