In 2013, Cambridge University researcher Michal Kosinski published a paper demonstrating that Facebook "likes" alone could predict a person's political views, sexual orientation, religion, and IQ with surprising accuracy. His methodology used a model trained on 58,000 volunteers. The paper was academic. What came next was not.
Cambridge Analytica obtained profile data on 87 million Facebook users through a personality quiz app. They used that data to build psychographic profiles — scores on the "OCEAN" personality model — and then delivered micro-targeted political ads calibrated to each person's psychological vulnerabilities. The operation ran across the 2016 U.S. presidential election and the Brexit referendum.
A behavioral profile is an AI-constructed model of an individual person derived from their digital activity. It is not a simple list of facts — it is a predictive instrument. Profiling systems do not just record what you did; they infer what you will do, what you believe, what you fear, and what you want.
Modern profiles are assembled from dozens of signal streams simultaneously: search queries, scroll behavior, purchase history, app usage patterns, location data, social graph connections, content engagement timing, and even mouse movement speed. Each signal is weak individually. Combined, they are remarkably powerful.
Cambridge Analytica's psychographic targeting used the OCEAN personality framework — a standard psychological model measuring Openness, Conscientiousness, Extraversion, Agreeableness, and Neuroticism. Each person received a score on each dimension, derived not from a survey they consciously completed, but from their behavioral data.
The resulting system allowed advertisers to show a "neuroticism" variant of an ad — emphasizing fear and threat — to high-Neuroticism users, while showing a "conscientiousness" variant — emphasizing duty and tradition — to high-Conscientiousness users. The content was tailored not to what you said you believed, but to how your mind processes information.
Profiling does not require your cooperation. It does not require your knowledge. It requires only your behavior — and in the digital world, behavior is recorded continuously. The profile built from your activity may describe you more accurately than any description you would give of yourself.
The most important word in AI profiling is inference. AI systems routinely infer characteristics you never disclosed. A 2013 study by Kosinski and colleagues showed that Facebook likes predicted whether a user was Black or White with 95% accuracy, Democrat or Republican with 85% accuracy, and Christian or Muslim with 82% accuracy — all from data the users shared for entirely unrelated reasons.
A 2018 study published in PNAS found that AI could infer sexual orientation from facial images with accuracy significantly above chance — a finding that prompted significant debate about the ethics of such systems, but also confirmed that AI inference reaches into domains people believe are private and self-controlled.
Your name is not private. Your employer is not private. Your neighborhood is not private. Your daily commute time is not private. But combined — with your health searches, your app usage patterns, and your social network — they become a profile that can predict your credit risk, your political susceptibility, and your likelihood of responding to a particular kind of persuasion. This is the aggregation problem: individually harmless data combines into something with genuine power over your life.
The AI assistant below is briefed on AI profiling techniques, the OCEAN model, and the Cambridge Analytica case. Use it to explore how behavioral data is converted into psychographic profiles — and what that means for everyday users.
In June 2014, Facebook published a paper in PNAS documenting an experiment they had run in January 2012. For one week, 689,003 users had their News Feeds algorithmically manipulated — some saw more positive content, some saw more negative content — without their knowledge or consent. The finding: the emotional tone of content in your feed measurably shifts the emotional tone of the content you subsequently produce. The algorithm could modulate mood at scale.
The public reaction was intense. But the experiment revealed something more significant than the ethics controversy: Facebook's targeting algorithm already had sufficient fidelity to reliably alter emotional states in a controlled experiment. This was not a bug. It was evidence of precision.
Every major platform uses a recommendation algorithm — YouTube's, TikTok's, Instagram's, Facebook's — that is fundamentally a targeting engine. It does not simply show you things you will like. It shows you things that will maximize your engagement, which is a subtly different objective. Engagement is driven by emotional activation: outrage, fear, desire, and surprise generate more clicks, shares, and watch-time than calm satisfaction.
The distinction matters because a system optimizing for engagement will systematically bias toward emotionally activating content — including content that is false, divisive, or anxiety-inducing — not because anyone intended harm, but because that is what the objective function rewards.
Below algorithmic recommendation lies an even more precise layer: micro-targeting. This is the practice of delivering a specific message to a specific audience segment defined by behavioral, psychological, or demographic criteria — often an audience of one, or near-one.
In advertising, micro-targeting allows a pharmaceutical company to show a drug ad only to people whose search and browsing behavior suggests they may have a specific condition — without ever asking whether they have it. In political campaigns, it allows showing a candidate's immigration position only to voters whose profile suggests that issue will be persuasive, while showing a different issue to a different voter profile in the same household.
Vote Leave, the official Brexit campaign, used targeted Facebook advertising with over 1,000 different creative variants — different images, headlines, and copy — each delivered to a specific audience segment. The campaign spent 98% of its digital budget through a data analytics firm that used behavioral profiling to determine which emotional message would be most persuasive to each voter segment. This was not mass communication. It was individualized psychological targeting at national scale.
What makes algorithmic targeting distinctively powerful — and distinctively concerning — is its opacity. When a newspaper runs an advertisement, every reader sees the same ad. When a television network broadcasts a political message, the content is public and subject to scrutiny. Micro-targeted digital content is invisible to everyone except its recipient. No opponent can rebut a message they cannot see. No regulator can assess content that exists for a fraction of a second on a screen only you see. No journalist can report on ads that disappear after serving their purpose.
This opacity is not incidental. It is a feature that makes micro-targeting uniquely effective — and uniquely difficult to hold accountable.
This lab focuses on algorithmic targeting — how recommendation engines optimize for engagement, how micro-targeting works in political campaigns, and how the "rabbit hole" effect operates. The AI assistant is briefed on the Facebook emotional contagion experiment, the Vote Leave targeting operation, and the Frances Haugen whistleblower documents.
When Google launched AdWords in 2000, it did something new: it did not sell advertisements. It sold predictions about user behavior. Advertisers did not pay for ad impressions — they paid when a prediction proved correct, when a user clicked. The accuracy of those predictions depended entirely on the quality of Google's behavioral data about each user.
Over the following two decades, Harvard Business School professor Shoshana Zuboff documented in meticulous detail how this model — which she named surveillance capitalism — spread from Google to Facebook to virtually every major digital platform. The core logic: human behavioral data is the raw material; behavioral prediction is the product; the buyers are any entity wanting to influence human behavior. By 2021, global digital advertising revenue exceeded $455 billion annually.
Surveillance capitalism's most advanced form is not mere prediction — it is behavioral modification. Predicting that you will buy running shoes is valuable. But nudging you toward buying running shoes by showing you content that activates relevant desires, creating urgency, and removing friction at the moment of purchase is worth far more. The difference between prediction and modification is the difference between a weather forecast and cloud seeding.
Google's patents from the 2000s and 2010s described techniques for this precisely — including systems to detect emotional states from browsing behavior and deploy emotionally calibrated content to influence purchasing decisions. These were not theoretical. They were engineering specifications for shipped products.
Pokémon GO, the augmented reality game played by hundreds of millions worldwide, secretly contained a business model few players understood: "Sponsored Locations." Businesses paid Niantic — and by extension Nintendo — to have Pokémon appear near their establishments, driving foot traffic. McDonald's Japan paid to become the game's first major sponsored partner, making its restaurants PokéStops and Gyms. Players believed they were following the game. They were following a commercially directed attention economy without knowing it.
Beneath the platforms lies an entire invisible economy: data brokers. Companies like Acxiom, Experian, and LexisNexis compile profiles on hundreds of millions of people from hundreds of sources — purchase records, public records, social media, loyalty programs, location data, and purchased data from apps. Acxiom alone claims to hold 1,500 data points on 2.5 billion people.
These profiles are sold to insurance companies, banks, employers, political campaigns, and anyone else willing to pay. The person profiled typically has no knowledge this transaction occurred, no right to see the full profile, and in most U.S. jurisdictions, no legal right to have it deleted. The broker ecosystem operates entirely outside the user relationships people understand — your data flows to companies you have never heard of, whose decisions then shape your life.
Zuboff's analysis identified a disturbing trajectory: surveillance capitalism's most advanced forms are not about selling products — they are about guaranteeing outcomes. An advertiser who can guarantee that a specific person will purchase a product, vote a specific way, or hold a specific belief is delivering something far more valuable than a targeted impression. The system's economic incentive is not just to predict behavior but to eliminate its unpredictability — to transform free human choice into a predictable, manageable input.
This is not conspiracy. It is the straightforward logic of a business that sells behavioral predictions and is therefore financially motivated to make those predictions as accurate as possible — which means making human behavior as predictable as possible.
The economic logic of surveillance capitalism is simple: you receive a service at zero monetary cost. In exchange, your behavioral data — continuously collected, indefinitely retained, and commercially exploited — is the payment. The service is not the product. The behavioral data is the product. You are not the customer. You are the raw material. This arrangement was never disclosed clearly, was never meaningfully consented to, and the terms have never been renegotiated even as the value of behavioral data has grown exponentially.
This lab is briefed on surveillance capitalism theory (Zuboff), the data broker ecosystem, Google's prediction product model, and the distinction between behavioral prediction and modification. Use it to dig into how the "free" internet economy actually works — and at whose expense.
In 2013, Austrian law student Max Schrems filed a complaint against Facebook Ireland under EU data protection law after revelations about NSA surveillance through social media platforms. His case eventually reached the Court of Justice of the European Union twice — in 2015 and 2020 — invalidating two successive US-EU data transfer frameworks (Safe Harbor and Privacy Shield). By 2023, the CJEU's decisions had forced a fundamental restructuring of how US tech companies transfer and store European user data.
Schrems' organization, noyb, subsequently filed hundreds of complaints across EU member states, resulting in €2.9 billion in total GDPR fines against major tech companies by 2023. One law student's complaint became the most consequential privacy litigation in digital history — demonstrating that legal mechanisms, when pursued persistently, can impose real costs on surveillance capitalism.
The regulatory landscape changed significantly in the 2010s and 2020s. Understanding your legal rights is a precondition for exercising them:
The EU General Data Protection Regulation (GDPR, 2018) gives European residents the right to access all data held about them, correct inaccuracies, request deletion ("right to be forgotten"), object to profiling for automated decision-making, and receive their data in portable format. Maximum fines are 4% of global annual turnover.
The California Consumer Privacy Act (CCPA, 2020) and its 2023 amendment (CPRA) give California residents the right to know what data is collected, the right to delete it, and the right to opt out of its sale. The CPRA adds the right to correct inaccurate data and restricts use of "sensitive personal information."
The EU AI Act (2024) prohibits certain AI practices entirely: real-time biometric surveillance in public spaces (with narrow exceptions), AI systems that exploit subconscious vulnerabilities to manipulate behavior, and social scoring by public authorities. It is the first binding regulation of AI targeting systems as such.
Understanding which technical measures are effective requires understanding what data is actually being collected. Most tracking operates through three channels: browser cookies and fingerprinting, account-based tracking, and device identifiers. Each requires different countermeasures.
1. Visit optoutprescreen.com to opt out of prescreened credit and insurance offers from the major bureaus. 2. Visit the Data & Marketing Association's Consumer Choice page (DMAchoice.org) to limit data broker marketing use. 3. Submit a CCPA data deletion request to the five largest data brokers: Acxiom (acxiom.com/optout), Spokeo, Whitepages, BeenVerified, and Intelius. 4. In your Google account, go to myaccount.google.com and disable Web & App Activity, Location History, and YouTube History. 5. In your Facebook settings, disable "Off-Facebook Activity" data sharing — this stops Facebook from receiving behavioral data about you from third-party websites and apps.
Individual technical measures reduce exposure but cannot eliminate it. Data brokers compile profiles from sources you cannot opt out of — property records, court records, voter registration, and purchased data from apps you have never used. Cross-device tracking can link behaviors even across different browsers and devices using probabilistic matching.
More fundamentally, the incentive structure of surveillance capitalism means that whatever technical defense individuals adopt, the industry will work to circumvent it. The most effective privacy protections are therefore structural — regulations that change the economics of data collection rather than relying on individuals to resist it. This is why the Schrems litigation and GDPR enforcement matter: they impose costs that individual opt-outs cannot.
The deepest defense against AI profiling and targeting is informed awareness — understanding that these systems exist, how they work, and what they can infer. An informed user who understands that their search history generates psychographic data, that their engagement patterns are behavioral predictions, and that their "free" services are paid for with behavioral surveillance is a user who can make genuinely informed decisions about where to draw personal lines. That is the purpose of this entire course — and of this module specifically.
This lab is briefed on the legal frameworks (GDPR, CCPA, EU AI Act), the Schrems litigation, technical defense options, data broker opt-out mechanisms, and the structural limits of individual resistance. Use it to build a realistic personal defense strategy — or to explore the policy implications of surveillance capitalism.