The Right to Object to Profiling by an AI System

Article 22 is about a decision. Article 21 is about processing. A system can be entirely outside Article 22 — no decision, no significant effect, nothing automated in the operative sense — and still be subject to an objection that stops it, because the objection right does not require anything to be wrong.

Two rights, commonly confused

Article 21 of Regulation (EU) 2016/679 gives the data subject the right to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) (public task) or 6(1)(f) (legitimate interests), including profiling based on those provisions. On objection the controller must stop unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or that the processing is for the establishment, exercise or defence of legal claims.

The differences from Article 22 are worth setting out plainly:

• Trigger. Article 22 needs a decision with legal or similarly significant effect. Article 21 needs only processing on one of two bases.
• Who acts. Article 22 was treated by the Court of Justice in Case C-634/21 as a general prohibition rather than a right to be invoked. Article 21 does nothing until the data subject objects.
• Effect. Article 22 requires safeguards or an exception. Article 21 requires the processing to stop, unless the controller wins the override argument.
• Reach. Article 22 catches a narrow class of consequential decisions. Article 21 catches the recommendation engine, the propensity model, the personalisation layer and the enrichment pipeline — everything that runs on legitimate interests.

The threshold question for Article 22 is set out separately on what counts as a solely automated decision.

When Article 21 is available

The lawful basis is the gate. If your profiling runs on consent, Article 21 does not apply — the person withdraws consent under Article 7(3) instead, which is simpler for them and stricter for you, since there is no override argument to make. If it runs on contract necessity, neither route applies, though whether the processing is genuinely necessary for the contract is then the live question. If it runs on legitimate interests, which is where most profiling and most model training sits, Article 21 applies in full.

This creates a dependency that teams often discover late: the lawful basis you chose for training determines which rights attach afterwards. A legitimate-interests basis is generally easier to establish at the outset and brings both the Article 21 objection right and, for training specifically, the obligations traced on writing a legitimate interest assessment for AI training. A consent basis brings a withdrawal right with the harder downstream consequences described on what happens when consent is withdrawn. There is no basis that avoids both.

Article 21(6) adds a variant for processing for scientific or historical research or statistical purposes under Article 89(1): the data subject may object on grounds relating to their particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest. That exception is narrower than the research framing in which a good deal of model development is presented.

“Compelling legitimate grounds” is a high bar

The wording of Article 21(1) is deliberately stronger than the Article 6(1)(f) balancing test. Under 6(1)(f) the controller’s interest must not be overridden by the data subject’s; under 21(1) the controller must demonstrate compelling grounds that override them. The burden and the standard both move. Having passed your original balancing test is therefore not an answer to an objection, because the objection is made on grounds relating to that person’s particular situation and those grounds were not in the original assessment.

What that means operationally is that an objection has to be assessed individually. A blanket policy of refusing objections because the legitimate interest assessment concluded the processing was lawful is a policy of not applying Article 21. Grounds that have a chance of being compelling tend to be ones where the processing protects somebody else: fraud detection, safety and abuse prevention, security. Grounds that rarely succeed are commercial — the model is more accurate with this person’s data in it, the personalisation drives revenue. The Court of Justice held in Case C-621/22, decided 4 October 2024 and available from the Court’s case register, that a purely commercial interest can be a legitimate interest for Article 6(1)(f) purposes; that is a finding about the lower threshold, and it does not make a commercial interest compelling under Article 21(1).

Direct marketing: no balancing at all

Article 21(2) and (3) create an absolute right. Where personal data is processed for direct marketing purposes, including profiling to the extent related to that direct marketing, the data subject may object at any time, and on objection the data must no longer be processed for those purposes. There is no override, no compelling grounds, no balancing. If your model powers audience selection, lookalike targeting, send-time optimisation or content personalisation for marketing, an objection stops that use, full stop.

Notice the scope: it stops processing for those purposes. It does not by itself require deletion, and it does not reach processing of the same data for unrelated purposes. Article 17(1)(c) then gives a right to erasure where the objection is under 21(2), which is why in practice a marketing objection usually should result in a suppression record rather than a purge — you need to retain enough to honour the objection.

Handling an objection in a model-backed system

• Stop the inference, not just the display. Continuing to compute a score and suppressing it in the interface is still processing. The objection is to the profiling.
• Propagate to the feature store. Derived attributes already computed are processing outputs about that person and continue to exist after you stop the pipeline. Decide explicitly whether they are deleted or frozen, and record the decision.
• Decide what happens to the person’s data in future training runs. An objection to profiling is not automatically an objection to being in a training corpus, but where the training itself runs on legitimate interests, an objection can reach it. Excluding a person from future runs is achievable; the retrospective question is the hard one and is taken up on the consent withdrawal page.
• Respond within one month. Article 12(3) sets the deadline and Article 12(4) requires reasons where you do not act, together with notice of the right to complain to a supervisory authority and to a judicial remedy.
• Keep the assessment. If you override, Article 5(2) means you must be able to show what the compelling grounds were for that person, at that time.

The notice duty in Article 21(4)

Article 21(4) requires that, at the latest at the time of the first communication with the data subject, the right to object is explicitly brought to their attention and presented clearly and separately from any other information. “Separately” is the operative word and it is very widely ignored: a line in paragraph fourteen of a privacy notice is not separate presentation. Article 21(5) adds that in the context of information society services the data subject may exercise the right by automated means using technical specifications — not a general obligation to build an opt-out button, but a strong steer, and the cheapest way to comply with 21(2) is usually to build one anyway.