Every search you make, video you watch, product you consider buying and question you ask an artificial intelligence assistant can reveal something about you. Individually, these activities may appear insignificant. Analysed together, however, they can help technology systems build increasingly detailed pictures of people’s interests, habits and behaviour.
The surprising part is that you do not necessarily have to disclose something directly for a system to make an educated guess about it.
Research has demonstrated that digital behaviour can reveal personal characteristics people never explicitly shared. Meanwhile, recommendation algorithms and AI-powered tools are making it easier to analyse information and tailor digital experiences to individual users.
But how much can AI actually discover about someone? And what happens when these predictions begin influencing the information, products and opportunities that person encounters?
How AI Can Learn Things You Never Disclosed
In 2013, researchers published a landmark study in the Proceedings of the National Academy of Sciences examining whether Facebook Likes could reveal sensitive personal characteristics.
The study analysed data from more than 58,000 volunteers, including their Facebook Likes, demographic information and psychological assessment results. Using statistical models, the researchers demonstrated that patterns of Likes could help predict characteristics such as political views, religious beliefs, personality traits and sexual orientation.
The researchers reported that their model correctly distinguished between gay and heterosexual men in 88 per cent of cases within their study sample. This was a result for a particular prediction task and dataset, not a claim that AI can determine anyone’s sexuality with 88 per cent accuracy in every situation.
The wider finding was significant: seemingly ordinary online behaviour could contain information about personal characteristics that users had not directly disclosed.
A person might never announce their political preferences, for example, but their repeated engagement with particular subjects could provide clues. Those clues would not establish their beliefs with certainty, but a model could use them to estimate what they might believe.
This is the difference between collecting information and inferring information. A system may record what you watched, searched for or purchased. It can then use patterns in those records to estimate other characteristics about you.
The result is a digital profile that may contain both facts and predictions, with varying levels of accuracy.
Your Digital Habits Can Become a Prediction System
Consider someone who regularly searches for affordable flights, watches videos about studying abroad and visits websites offering language courses.
None of these activities proves that the person intends to leave their country. They might be researching for a friend, completing a school assignment or simply exploring an idea.
Nevertheless, a recommendation system could interpret the pattern as evidence of an interest in international travel or education.
That interpretation can influence what appears next: advertisements for flights, language-learning applications, international universities or travel services.
Google’s published privacy policy explains that information associated with its services can be used to personalise content, recommendations and, depending on users’ settings, advertisements. The company also describes controls that allow users to manage certain activity and advertising preferences.
This illustrates how personalisation works in practice. Systems use information about previous activity to estimate what might be relevant in the future.
However, predicting an interest is not the same as knowing a person’s intentions. Algorithms can misunderstand context, confuse curiosity with commitment or continue making recommendations based on interests that have changed.
The distinction matters because repeated predictions can create a feedback loop: a system recommends something, a person interacts with it, and that interaction becomes another signal used to shape subsequent recommendations.
When Separate Pieces of Information Tell a Bigger Story
One digital activity rarely reveals a complete picture of someone’s life. The potential becomes more significant when information from different sources is combined.
A shopping history might suggest spending preferences. Search activity could indicate an interest in a particular subject. Location information, where collected and available for analysis, could reveal recurring places. Public social media activity might provide clues about friendships, hobbies or professional interests.
When these signals are linked, organisations may be able to construct more detailed profiles than any single activity would support.
The Federal Trade Commission in the United States has investigated the practice known as surveillance pricing, in which businesses may use personal information and algorithmic systems to categorise consumers and potentially tailor prices.
In July 2024, the agency announced that it had ordered eight companies offering surveillance-pricing products and services to provide information about their practices. The inquiry sought to understand what data these intermediaries used, where it came from and how the resulting technologies might affect consumers.
The announcement did not establish that every retailer uses individualised pricing or that every consumer receives a different price. Rather, it highlighted a practice regulators considered important enough to investigate.
The underlying concern is straightforward: information about a person may become commercially valuable not only because it describes them, but because it helps an organisation decide how to approach them.
What Happens When AI Becomes Part of Your Personal Life?
The issue extends beyond advertising.
People increasingly use AI assistants to draft messages, explain personal problems, organise their schedules, explore career choices and discuss sensitive questions. Such conversations can reveal concerns, ambitions, relationships and circumstances that may never appear on public social media profiles.
However, what happens to this information depends on the particular service, its settings, its privacy policy and the circumstances in which it is used. It would be inaccurate to assume that every AI assistant stores, shares or uses conversations in the same way.
OpenAI, for example, provides data controls for consumer ChatGPT accounts, including a setting governing whether conversations can be used to improve its models. Its documentation also describes Temporary Chat, which does not appear in chat history, does not create or update memories and is not used to improve models while the conversations remain temporary. Other retention and processing rules may still apply.
These distinctions are important. A conversation that feels private to a user is not automatically equivalent to information stored exclusively on a personal device. Users should understand the specific service’s terms and controls before sharing sensitive details.
Smartphones, connected home devices and wearables introduce additional considerations when they collect information such as location, voice commands, activity or sleep-related measurements. The privacy implications depend on what each device actually collects, how it processes the information and who can access it.
AI can make large amounts of information easier to analyse, but the technology itself does not determine every data-handling practice. The organisations operating these systems, their technical designs and the applicable rules also matter.
Can AI Know What You Are Thinking?
Despite its growing analytical abilities, AI cannot simply look inside someone’s mind and retrieve their private thoughts.
It can analyse available signals and generate predictions, but a prediction remains an estimate rather than direct access to a person’s intentions.
Someone who searches for information about a career change may be considering a new job, helping a friend or researching an article. The search alone cannot establish which explanation is correct.
Even sophisticated models can produce incorrect inferences, particularly when the available information is incomplete, outdated or unrepresentative.
The risk emerges when other people treat these estimates as established facts.
Imagine an organisation using an automated system to assess applicants, customers or students. If the system relies on inaccurate assumptions about an individual’s interests, reliability or likely behaviour, those assumptions could affect how that person is treated.
The European Commission’s explanation of European data-protection rules distinguishes profiling, which involves evaluating personal aspects to make predictions, from decisions made solely through automated means. Under applicable European rules, people have protections concerning certain solely automated decisions that produce legal or similarly significant effects.
These legal protections do not apply identically everywhere, but they illustrate an important principle: predicting something about a person and using that prediction to make a consequential decision are different issues.
What This Means for Nigeria and the Rest of the World
These questions are relevant wherever people use digital services, from online shopping and mobile banking to social media, educational platforms and AI chatbots.
In Nigeria, the Nigeria Data Protection Act 2023 provides a legal framework for the processing of personal data and establishes protections and obligations concerning how such information is handled.
The existence of a law, however, does not mean that every user understands how their information is collected or knows which settings are available to them. Effective protection also depends on compliance, enforcement, public awareness and the circumstances of individual cases.
People can reduce unnecessary exposure by reviewing application permissions, limiting information shared with AI assistants, checking privacy and advertising settings, securing their accounts and avoiding the submission of passwords, financial credentials or other highly sensitive information to services that do not need it.
Users should also remember that deleting a post does not necessarily erase every copy previously made by another person or service.
For organisations developing AI systems, the US National Institute of Standards and Technology identifies privacy, reliability, security, transparency and fairness as important considerations in managing AI-related risks. These principles are relevant because a system can be technically impressive while still producing harmful outcomes if its data or decisions are poorly managed.
The Real Question Is Who Gets to Use What AI Knows
Artificial intelligence is becoming increasingly capable of finding patterns in information that people generate throughout their daily lives. Those patterns can make digital services more useful, but they can also expose sensitive characteristics, support intrusive profiling or encourage decisions based on uncertain predictions.
The answer is not to assume that AI knows everything, nor to believe that information shared online is automatically harmless.
It is to recognise that the information we deliberately disclose is only part of the picture. Our behaviour can reveal clues we never intended to communicate, and those clues can become more revealing when combined with other data.
Ultimately, the most important question may not be whether AI can understand us perfectly. It is whether the people and organisations using it will recognise the limits of what it knows, and whether individuals will have meaningful control over how those conclusions affect their lives.
