Behavioural inference can reach information the user never disclosed

What it is

The user never ticked “pregnant,” never entered an age, never stated a politics. The model can still write those into internal labels from search, dwell, and purchase sequences. Inferred undisclosed attributes are personal facts the user never handed over, estimated from behaviour, then used in ranking or ads — an expansion of the file without their knowledge.

Active disclosure is a field on a form. Behaviour is residue from doing a task. Those are not the same consent.

Why it happens

Behaviour is statistically associated with latent attributes: hour, category combinations, repeated queries can be classifier inputs. Recommenders and ad systems have a motive to run those classifiers, because the labels lift short-term clicks. Inference happens in the back; the interface still says “based on what you watched,” not “based on who we think you are.”

People give data under a task model: finish a purchase, finish an episode. The task model does not include “and be assigned a sensitive identity.” Once residue can be reused, inference walks through the consent boundary. Displaying the inferred label (that is a disclosure) and extra limits on sensitive classes are different layers. Here the claim is only that undeclared attributes can be reached from behaviour.

Studying it

The standard method is: train demographic or sensitive-attribute classifiers on behavioural logs, measure identifiability on held-out users (accuracy, calibration, recall on minority classes). Independent variables: kinds of behaviour available (query / purchase / dwell), time window, whether explicit profile fields are stripped. Dependent variables: predictive power on attributes absent from the profile, surprise and rejection once people are told.

Do not read classifier accuracy as “users were willing to give this.” Accuracy only shows a leakage channel. A contrast should include: after telling people what is being estimated, how many still willingly contribute the same behaviour.

Where it stops holding

Content matching (“you just searched screwdriver, so screwdriver”) is in-session query expansion, not inference of an undisclosed identity. A public role (job level on an enterprise account) already lives in the profile and does not walk through consent. This entry does not treat what happens when a label is drawn on the interface, and it does not treat combining non-sensitive acts into a sensitive class — that is a later composition problem.

Applying it

• Keep an internal inventory of attributes the system estimates that have no corresponding profile field. No inventory means you do not know where you walked through.
• For each item: disable, keep session-scoped, or switch to an explicit ask. Ban a default of “if we can estimate, we do.”
• Check: take a behaviour sample with profile fields stripped, and see which demographic or identity labels the internal tag service still emits. If it emits labels the user never entered, undisclosed inference is running.

Related

• Same group: L6.06.2 Displaying an inference is itself a disclosure · L6.06.3 Inferences in sensitive categories need extra constraints · L6.06.4 Combinations of non-sensitive behaviours can yield sensitive attributes; item-wise compliance is not whole-system compliance · L6.06.5 Inferences on shared devices and shared screens disclose to third parties · L6.06.6 Wrong inferences also harm, and the misclassified often have nowhere to appeal · L6.06.7 Tolerance for inference depends on the setting; the same inference is judged differently across products · L6.06.8 Opting out of inference and opting out of data collection are different controls
• Nearby: L6.05 Turning Personalization Off · L6.10 Turning Personalization Off and Resetting It · L5.05 The Moderation Principle of Transparency
• Search terms: inferred undisclosed attributes · behavioural inference · sensitive attribute prediction