The screen for the San Aurelio Library Network asks Lucy to turn on “personalised recommendations.” She agrees because she wants to know which workshops are close to home. For a few weeks, she receives notices about reading groups, repair classes, and children’s activities. Then she notices that afternoon language sessions have stopped appearing. Nobody has told her why. Perhaps the program inferred, from her loans, times, and visits, that she is not interested; perhaps it placed her in a group with a similar pattern. Lucy cannot see the data that produced that conclusion, the rule that turned it into a label, or the alternative for receiving the full programme without being watched.
That scene does not make a library a threat. Recommendations can save time and help people find valuable opportunities. The problem begins when a public institution turns a person’s cultural activity into opaque inferences and presents that transformation as the only practical entrance to the service. A library is not a shop required to guess what to sell. It is a place for access, discovery, and conversation. For that reason, it should be able to guide people without demanding that every visit become raw material for a profile.
A profile is more than information someone supplied#
There is an important difference between recording that Lucy enrolled in a workshop and inferring that she will not want information about another one. The first fact describes a specific action. The second makes a claim about a person and can affect what she gets to know. Between them is a chain: records of loans or attendance, a choice of variables, a comparison with other visitors, a recommendation rule, and a consequence in the programme displayed on screen. When that chain is hidden, it is impossible to question whether the conclusion was reasonable or whether it unfairly narrowed Lucy’s opportunities.
There is an important difference between recording that Lucy enrolled in a workshop and inferring that she will not want information about another one.
Many inferences look minor because they do not formally deny a right. Yet limiting visibility can matter greatly. Someone receiving a complete listings page can choose among activities. Someone receiving a calculated selection depends on assumptions made by a system they do not know. The difference grows when personalised alerts become the easiest channel, when schedules change quickly, or when a person has little time to search elsewhere. A recommendation stops being assistance and starts arranging the horizon of what appears to be available.
The right not to be profiled does not require every institution to abandon every use of data. It calls for a more demanding prior question: is it necessary to build a hypothesis about this person in order to provide the service? If the answer is no, collection should be reduced. If the answer is yes for a specific function, the institution should explain the purpose, the data used, the planned inferences, and the time limit. There must also be a functional route for people who do not want to accept that journey. A hidden link that delivers an inferior version of the service is not enough.
An alternative only matters when it actually works#
In San Aurelio, the council might say that the complete programme is available on another page. The practical meaning would need examination. If that page requires people to search each venue by hand, cannot save interests, takes longer, or does not announce changes, the choice between profiling and privacy is unequal. The no-tracking alternative must let people discover activities, check times, register when appropriate, and receive general alerts they have requested without letting the system build a portrait of their habits.
An equivalent option can be designed in straightforward ways. The library could let each visitor choose interests locally and change them at any time, without retaining a detailed borrowing history or attaching those choices to a permanent file. It could send a newsletter by venue or cultural area to people who subscribe, without trying to predict what they “really” want. It could also show explicit filters: recommended age, time slot, accessibility, neighbourhood, language, or format. In those cases, the person chooses the criterion and understands the effect of that choice.
The difference is not cosmetic. A filter answers a question made by the service user; a profile tries to anticipate questions from traces that may mean something else. Lucy may have borrowed young-adult novels for her niece, a gardening manual for a neighbour, or a book about grief because of a private circumstance. Turning every gesture into a stable signal of interest produces errors and, more importantly, normalises the institution observing more than it needs in order to be useful.
The alternative must be visible from the start. Rather than a large button saying “turn on recommendations” and a grey link for declining them, the screen could present two routes with equal standing: “explore using your own criteria” and “receive suggestions based on use.” Each should explain what information it uses, for how long, and how it can be changed. Choosing not to be profiled is not an eccentric preference; it is a legitimate way to take part in a public service.
Minimise before promising benefits#
Organisations often begin by asking which data could improve a recommendation. The responsible sequence is the reverse: which concrete objective cannot be met with less data? If the aim is to inform someone that a registered activity was cancelled, an alert tied to the registration is sufficient. If it is to make searching easier, filters and categories may be enough. If the aim is to evaluate programming, aggregate attendance counts may work without retaining each visitor’s individual path. Collecting just in case turns a technical possibility into a habit that is hard to reverse.
Minimisation also means separating functions. Data needed to lend a book should not automatically flow into the system that orders the listings page. Enrolment in a class does not authorise combining it with connection time, device details, or searches made months earlier. Teams should describe what each component receives, who can access it, and when it is deleted. That separation reduces harm if there is an error or breach and limits the temptation to find new uses for information collected for another purpose.
Evidence of benefit deserves the same care. Saying that personalisation “improves the experience” is too broad a promise. The council should define the improvement it expects: do more attendees discover activities that matter to them; are missed appointments reduced; does the range of venues visited increase; are there fewer unanswered queries? It should then compare the test with a well-designed common programme and voluntary filters. If the difference is small, it does not justify detailed profiles. If a benefit appears, it must be assessed alongside the costs of exclusion, error, and surveillance.
The comparison cannot be limited to an average. A system may increase clicks for people who already use the app every day while making access worse for people who log in rarely, share a phone, use screen readers, or prefer not to reveal cultural habits. Evaluation should therefore look at who receives less information, which activities disappear, and what complaints occur. Efficiency without equity may simply be an elegant way of measuring the users who are easiest to serve.
Explaining an inference makes it contestable#
If the network chooses to keep use-based recommendations, it should provide a comprehensible explanation. It need not publish its code or reveal methods that would compromise security. It does need to say, for example: “These suggestions use your enrolments from the last three months and the topics you selected; they do not use your loans, location, or browsing history.” If an automatic conclusion hides activities, it must be visible and correctable. Nobody should discover afterwards that a silent label reduced their access to the programme.
Correction requires a person or team with authority. A form that merely receives comments does not solve exclusion. The library needs a channel to request review, correct data, turn profiles off, and confirm that the programme becomes complete again. It should also keep aggregate incident records: how many people chose the profile-free route, how many disputed an inaccurate recommendation, what changes were made, and what results followed. Those records are not surplus bureaucracy; they are the evidence needed to know whether the safeguard works.
It is wise to test the system with uncomfortable cases before deployment. A person may share a card with a family member, have moved neighbourhood, be searching for activities for somebody else, or not want messages related to a sensitive subject. If the design cannot handle those cases without demanding intimate explanations, it is not ready. A cultural institution should not make people justify their reserve in order to learn about a public reading or a free course.
A library can guide without watching#
Ultimately, San Aurelio’s decision is not only about an app. It is about the relationship a public network offers its visitors. A library that provides the full programme, clear filters, and voluntary subscriptions recognises that cultural discovery does not need to be a constant act of prediction. A library that profiles by default risks confusing attention with observation and relevance with reducing options.
Lucy could continue receiving useful information without handing over a record of her cultural life. She could indicate an interest in reading groups and change her mind the next week. She could check what happens in another neighbourhood without having that curiosity become a label. And she could choose personalised suggestions when she understood their scope, not because the alternative was slower or invisible. That is the reasonable standard: minimise before collecting, demonstrate benefits before expanding, and always maintain an equivalent route for anyone who decides not to be profiled.
