A behavioral digital twin is a parameterised model of a specific person. Running scenarios through it without their knowledge is not research — it is modeling a person's identity without consent.
Key Analysis
Creating a digital twin without consent may constitute processing of personal data for profiling purposes under GDPR Article 21.
Synthetic data derived from a digital twin may still re-identify the subject — membership inference is a legal risk, not just a technical one.
The case for mandatory consent before digital twin creation is strengthening in EU regulatory guidance.
Risk Signals
Digital twins created from customer data without explicit profiling consent.
Synthetic datasets released without membership inference testing.
Action Items
Obtain explicit, informed consent for digital twin creation.
Run membership inference attacks before releasing any synthetic behavioral dataset.
Treat digital twin outputs as personal data subject to all applicable privacy obligations.