Inferred Profiling of Age, Gender, and Interests

What it is

TikTok uses your behavior and content on the platform to infer personal attributes about you, including your estimated age range, gender, and interests, even if you have not provided this information directly.

Why it matters (compliance & governance perspective)

Inferred profiling can result in a detailed personal profile being built from behavioral signals, which may be used for ad targeting and content personalization without your explicit knowledge of the specific inferences made about you.

This document changed recently

Consumer impact (what this means for users)

TikTok builds inferred profiles about your demographic characteristics and interests from your behavior on the platform; these inferences are used to personalize both content and advertising, and you may not know what specific attributes have been inferred about you.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 22 (rights related to automated decision-making and profiling), GDPR Article 6 (lawful basis for profiling), CCPA/CPRA (which treats inferences drawn from personal information to create a profile about a consumer as personal information subject to access and deletion rights), and the EU AI Act (regarding automated profiling systems). The Irish DPC and other EU supervisory authorities have addressed profiling practices under GDPR. The CPPA is the relevant California enforcement authority. (2) GOVERNANCE EXPOSURE: Medium. Behavioral profiling for content personalization and advertising is standard in the social media industry, but the explicit disclosure of gender and age range inference without user input creates a specific transparency and data accuracy consideration. GDPR Article 22 rights around profiling and CPRA rights to access inferences both require operational mechanisms to fulfill. The accuracy of inferred attributes is not addressed in the policy. (3) JURISDICTION FLAGS: EU/EEA (GDPR Articles 15 and 22, right to access personal data including inferences, and right to object to profiling), California (CPRA right to know about inferences, right to correct inaccurate inferences), and Colorado, Connecticut, Virginia (state privacy laws with profiling opt-out rights). Minor users present additional exposure if age range inferences result in misclassification of adults as minors or vice versa. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertisers using TikTok's interest and demographic targeting should be aware that the audience segments they target are partly built on inferred rather than declared attributes. This has implications for the accuracy of targeting and for regulatory representations about how audience data is derived. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should ensure that mechanisms exist for users to access, correct, or delete inferred profile attributes, particularly in jurisdictions where this is a legal right. The policy does not describe the specific data inputs used to make inferences, which may be insufficiently transparent under GDPR Article 13 and CPRA disclosure requirements. A data protection impact assessment for profiling activities at scale may be required under GDPR.

Applicable agencies

Provision details

Other risks in this policy

• Face and Body Feature Data Collection high
• Off-Platform Behavioral Data Ingestion for Ad Targeting high
• Machine Learning and Algorithm Training Using Personal Data medium
• User Content Used in TikTok Advertising Campaigns medium
• Keystroke Pattern and Device Sensor Data Collection high
• Phone and Social Network Contact Syncing medium