For over a decade, social media taught brands, entities and the State itself to build detailed profiles of each person, transforming every like, share and minute of attention into data that formed an increasingly complete portrait. Artificial intelligence has eliminated the technical limits that still kept this process within certain parameters. What previously required analysis teams, time and manual data cross-referencing is today done in seconds, automatically and at a scale impossible to replicate by human processes. An AI system can simultaneously analyze the language we use, behavior patterns, the hours when we are active, the images we post and even the emotional tone of our messages, creating an almost complete reconstruction of who we are, what we feel and what we will probably do next.
The problem is not in the technology itself, but in who uses it and under what conditions. Much of this information processing occurs outside the reach of any effective regulation. Data analysis companies, third-party platforms and barely visible intermediaries operate in a grey space. Existing legislation was designed for a slower, less automated world. The GDPR was an important step, but it was not designed for systems capable of inferring psychological traits, emotional vulnerabilities or future intentions from seemingly harmless data. When unknown entities can predict consumer behaviors, influence political decisions or manipulate perceptions on a large scale, the very functioning of markets and democracy is compromised.
There is also an aggravating factor, which is opacity. Unlike a traditional database, an AI model is not easily auditable. It is not known exactly what inferences are made, with what degree of confidence, or what decisions are made based on them. This means that a person can be affected by an automated decision, whether in access to credit, employment or insurance, without ever knowing what criteria were used or having any way to challenge them. Portugal and the European Union have taken relevant steps with the AI Act, but regulation always arrives after innovation and companies outside European jurisdiction can continue to collect and process information without real supervision.
The response cannot be merely legislative, it must also be cultural and business-oriented. For Portuguese companies, this should be read as a warning signal and, simultaneously, as an opportunity. Those who build business models based on transparency, genuine consent and responsible data use will differentiate themselves in a market where trust will be increasingly scarce and, therefore, increasingly valuable. Ethics in data use will cease to be a compliance
