The Right Not to Be Inferred: Profiling, Disinformation, and the Limits of the Right to Data Protection

Abstract

Contemporary data protection regimes were designed to regulate the collection and processing of personal data, but increasingly fail to address epistemic and behavioral harms produced by algorithmic inferences. This article argues that profiling and micro-targeting of misinformation exploit a structural gap in frameworks, which prioritize control over inputs (collected data) while leaving inferential outputs (inferred attributes, profiles, models, and predictions) relatively ungoverned. By articulating the political economy of surveillance capitalism, cognitive vulnerabilities, and a legal analysis of the GDPR, LGPD, and Digital Services Act (DSA), it demonstrates how algorithmic inference erodes informational self-determination and, consequently, democratic autonomy. Empirically, 1) the analysis of 856 GDPR fines indicates a predominance of organizational and technical violations centered on early stages of the data lifecycle, with less regulatory traction on profiling and inference harms ( Saemann et al., 2022 ); 2) large-scale evidence shows that fake news spreads faster and reaches more people than true news ( Vosoughi, Roy, & Aral, 2018 ); and 3) political advertising data map the global expansion of microtargeting ( Votta, Kruschinski, & Hove, 2024 ). Finally, it is proposed that a normative limit to inference be recognized, formulated as the right not to be inferred (under specific conditions and categories) as a necessary evolution of data protection law in societies mediated by artificial intelligence.