- The Dutch Data Protection Authority warned on October 31, 2026, that debt collection agencies use AI to rank citizens without human review, a practice it flagged as potentially discriminatory.
- A 2025 Apteco analysis found Meta’s apps, including Facebook, Instagram and Threads, each track more than 150 data points per user, drawing on sensor data, browsing patterns and third-party broker records.
- Disabling “Smart features” in Google Workspace, setting social accounts to private and blocking third-party cookies each reduce the data available for AI profile-building.
On October 31, 2026, the Dutch Data Protection Authority disclosed that debt collection agencies were using AI to rank citizens for pursuit, scoring people by postcode, credit history and payment behaviour with no human review of the output. The authority flagged it as potentially discriminatory, and the mechanism it described, automated profiling from data people never knowingly shared, is not confined to Dutch debt collectors.
What AI Systems Actually See
A 2025 analysis by Apteco found that Meta’s apps, including Facebook, Instagram and Threads, each track more than 150 data points per user. That figure covers far more than posts and searches. AI systems pull in sensor data from smart devices, browsing patterns across sites the user never logged into, and records purchased from third-party data brokers who compile information from loyalty programmes, credit reports and public databases. The result is a profile capable of inferring political beliefs or financial stress from signals the user never typed anywhere.
Every prompt entered into a chatbot, along with metadata including IP address, device type and location, is typically logged and used to refine the underlying model. Cross-platform tracking then connects behaviour across apps and websites the user treats as entirely separate, stitching scattered signals into a single coherent picture. Meta’s Muse system, for instance, updates user and non-user profiles on an hourly cycle.
Profiling Beyond Click History
The Dutch Data Protection Authority’s warning made clear that AI systems do not need users to declare income or political views. Observable signals, postcode, shopping timing, installed apps, late-night queries, are sufficient to build actionable profiles. Third-party data brokers compound this by selling enriched records to AI companies, so what reads as a personalised experience on one platform is frequently built from data collected somewhere else entirely. The debt collection case is the sharpest illustration: citizens were ranked and pursued based on inferences they had no opportunity to contest or even see.
Reducing Your Footprint
Several steps can limit what AI systems can build from your activity. Review app permissions and revoke access to location, contacts, microphone and camera wherever it is not strictly necessary. Setting social accounts to private blocks external scrapers from reading your activity. In Google Workspace, disabling “Smart features” prevents Google’s AI from scanning email and documents. Where a platform offers an opt-out from using your data for model training, take it, though these options are rarely surfaced prominently.
Switching to a privacy-focused browser with tracking protection enabled and blocking third-party cookies cuts off a significant share of cross-site data collection. The Dutch Data Protection Authority’s October warning is a concrete illustration of why these steps carry operational weight: when automated inferences feed directly into decisions about debt pursuit, the gap between a strong digital footprint and a minimal one has measurable consequences for the people being scored.
