22/12/2025
Revealed: Most Australian charities are profiling you without letting you know
(Cam Wilson and Crikey)
Most of Australia’s charity sector uses third-party data profiling services to label people, rank them, and even ‘predict’ whether they’ll donate or leave money in their will to the organisation — with almost no disclosure, an industry insider has revealed to Crikey.
Gabrielle Josling is a woman, probably. She is ambitious, well-educated and lives in the inner city. She is motivated by a sense of moral obligation, particularly when it comes to social and environmental causes.
Josling also has both the means and desire to donate money. She might be very likely to give. Or maybe she’s very difficult to convert into a donor.
You should ask her for at least $29. Or $36, $45. Even $50.
These are the things Australian charities know about Josling — or at least they think they do. Some of it is accurate, some not.
Usually this information is hidden in cloud computing server farms, but the real Josling — not the charities’ version of her — made it her mission to find out what Australia’s biggest and most trusted charities knew about her using a little-known part of Australian privacy laws.
What she found surprised even her, a data scientist who once worked in the industry: most of Australia’s charity sector uses third-party data profiling services to label people, rank them, and even “predict” whether they’ll donate or leave money in their will to the organisation.
This is happening with almost no disclosure, Josling has shared with Crikey.
The industry says that these are useful tools that can help build long and positive relationships with donors so that they can do the most good. Privacy advocates worry that donors have no idea charities are using sophisticated tools to target and manipulate them, while also training their AI models on that data.
How much will you give?
You’ve probably been asked to donate money recently. Charities know that Australians are more likely to give at Christmas than at any other time. Devastating news events like the Bondi Beach terrorist attack also prompt donations, as Australians look for ways to help those in need.
In fact, Australians are among the most charitable people in the world. When surveyed, three in five adults said that they’d donated to charity in the last month. Nineteen billion dollars was given to charities in 2023, a number that continues to grow year-on-year (although 2023’s number was bolstered by $4.9 billion given by Andrew and Nicola Forrest to the Minderoo Foundation).
One of the reasons for this growth is the increasing sophistication of the Australian not-for-profit sector’s approach to fundraising. Charities say they’re spending more on technical staff and infrastructure.
“Digital technology has become an essential tool to amplify limited resources for greater impact,” says a report released into the Australian charity industry’s use of technology by not-for-profit Infoxchange earlier this year.
Josling used to be on the front line of this industry, having spent years working for a household name in the Australian charity sector as a data scientist.
She knew that charities were increasingly using data to power their operations, often leaning on little-known third parties to help them out, and had concerns about how donor information was being used. So she set out to understand more.
Through 2025, Josling investigated 31 charities about their use of third-party profiling platforms and how transparent they were about this process — by both asking for her own personal data and asking the charities questions directly, filing formal data access requests, and studying privacy policies, case studies and job ads.
The results were shocking to her. Sixteen of them had profiled Josling based on data they’d gathered and gleaned. They had information including her name, email address, how often and when she visited their websites, even the fact that she kept looking at their privacy policy (and then flagging this as behaviour that might suggest potential fraudulent intentions). Ten of them even initially denied profiling her and didn’t disclose it when first asked.
But what surprised her most was that she found out that at least a majority of the charities — 18 of 31 — were using what she calls “commercial profiling” services to make sense of data that they had on people like her. These third-party companies take data provided to them by the charities, analyse it, and advise on how to get the most money out of the people analysed.
Despite the fact this was an industry-wide practice, it was nearly impossible to find out about. These charities did not clearly tell their donors they were using their data like this; many refused to answer questions about donor privacy, and some even denied profiling supporters until confronted with the evidence.
How charities rely on commercial providers to help get the most money out of you
Among those that acknowledged or were shown to be using commercial profiling tools, Australian-owned Dataro was by far the most popular, with 18 organisations using or previously having used it.
Dataro is an Australia-based AI fundraising platform that says it’s used by “300+ nonprofits in 20+ countries”. It sells “predictive-AI models” that it promises give “actionable insights that reveal preferences” and will “create precision-targeted audiences for specific fundraising asks and campaigns”.
Dataro CEO Tim Paris told Crikey that the company helps charities fundraise more effectively while taking privacy and security seriously.
“Charities exist to meet critical needs in our society, often with limited resources and in the face of increasing demand. To do that effectively, they need access to modern tools that help them to raise funds responsibly, reduce waste, and engage appropriately with their supporters,” he said in an emailed statement.
Charities can upload a whole array of data to Dataro: personal identifying information like name, contact details, and postcode, as well as financial transactions and “intent signals” like event attendance and volunteer activity.
Then, Dataro analyses this data and provides advice to charities in a number of ways. It ranks them on how likely they are to give to a charity, to become a regular donor, to churn off, or even to bequeath a gift in their will. It suggests how much to ask them for.
According to Dataro, the Australian Red Cross had a less than 1% chance of getting a gift from Josling or converting her into a regular giver. In fact, she was ranked 547,877th among supporters as someone who was likely to be a “mid-value giver”. However, she was ranked just 207,728th as someone who was likely to leave the organisation a gift in her will.
Dataro can also break a charity’s fundraising list into different segments of its supporters. It even offers to “target each donor with the content they want to see”.
Paris said this helps charities do the most good and avoid frustrating people: “These outputs are then used by charities to ensure they are only contacting donors with a good chance of responding, reducing wasted costs by not sending too many letters or making too many calls, and ensuring donors are not ‘spammed’ with communications that are not relevant to them.”
Josling’s data also showed the use of two other commercial profiling tools: data broker Experian’s “Mosaic”, and Roy Morgan’s “Helix”. These products take user data and sort it into “segments” with inferred characteristics. Josling, for example, was classified by Roy Morgan as “101 Bluechip” for WWF Australia, which defined her as being among a group “boasting the highest income and highest proportion of home ownership in the Leading Lifestyles Community, Bluechips are big spenders and live mostly in Sydney in separate houses.”
Trust, charities and informed consent
Charities consistently poll among the most trusted institutions in Australia, outstripping government and business. This trust is fundamental to their business, as charities literally rely on goodwill.
Key to maintaining that trust is good privacy practices, according to Australia’s privacy commissioner Carly Kind. The Office of the Australian Information Commissioner has put out guidelines for the charity sector, which includes advice for working with third-party providers.
Kind also highlights that charities remain responsible for the risks that come with handing over this data to third parties.
Industry group Fundraising Institute Australia, which has some guidelines for how its members should collect and use data for the donors, says it is reasonable to collect information on users as long as it’s limited to what is required.
“Our further guidance around best practice is that the charity’s privacy policy and collection statements should include a description of the data collected and for what purpose it’s collected and used,” CEO Katherine Raskob told Crikey in an email.
However, Josling said that only two of the charities that she confirmed used these services had clearly disclosed their use in their privacy policy. Others mentioned it in vague terms, and most did not mention it at all.
Former chair of the Australian Privacy Foundation and privacy advocate David Vaile said it’s unsurprising that charities have joined other sectors in obscuring or failing to disclose how their data is being used.
“There’s a massive crisis of abuse of the consent model of asking people to agree to things that they can’t possibly understand,” he told Crikey on the phone.
“Privacy policies and terms and conditions have become structures for turning off people’s cognitive radar, turning off their interest in it, or just making them feel like they can’t do anything about it,” he said.
Still, Vaile said, he expects more from charities that are “trading on their own good reputation and the good reputations of others in the sector.”
The risks of this approach became clear in 2023, when a telemarketing firm working with major charities suffered a data breach that exposed the personal information of thousands of donors. Introducing third parties into these relationships creates additional privacy risks, including hacking, misuse of data, and donors being unaware their information is being used in this way at all.
There are also questions about how this data is used once it’s given to third parties. For example, Dataro says it trains its model using pooled data from all charities using the platform. Although the data is described as de-identified, it is still used to train AI models that benefit other organisations. This means donors are unknowingly training third-party AI systems that are then used to target people like them, often without their knowledge or consent.
Paris emphasised that Dataro’s models are trained on non-personal, de-identified information, and that it does not link people’s data across charity data sets.
“For the vast majority of the charities we support, Dataro does not hold donor contact details at all, unless needed to support other activities like campaign creation, and we do not hold any sensitive or payment data. We also go to great lengths to provide model transparency and interpretability, so charities can understand the factors relevant to predicting particular outcomes,” he said.
Dataro also offers profiling of people who have never donated — such as those merely on an email list — raising further questions about whether these people have knowingly consented to the use of their data this way. The company even offers a tool that scans the internet to gather more information on high-value donors, expanding surveillance even further.
Taken together, this raises serious ethical and privacy concerns about how charities collect, share, and monetise personal data — largely without public awareness.
The fact that donors seem to be almost entirely unaware of this use of their data also means it’s near impossible for them to understand why charities might be treating them in certain ways, let alone challenge it.
In the mid-2010s, the UK charity sector was embroiled in a scandal over the targeting of vulnerable, often elderly, people with aggressive fundraising appeals (although these were primarily carried out by private fundraising firms connected to major charities).
Josling’s investigation into the various charities revealed some of the limits or issues facing analysis carried out by these third parties. When commercial providers infer certain characteristics, this information often contains errors or judgments, with little information on how that changes how a charity treats a donor.
Dataro’s recommendation to charities regarding how much to ask Josling for varied widely. Sometimes they were able to infer her gender from her name, other times not. In one case, Mission Australia flagged Josling as having “unusual behaviour” with “red flags regarding … legitimacy”, according to data that she received from them.
After spending months chasing these charities just to find out what they knew about her, Josling isn’t done yet. She’s filed more than a dozen complaints to the Office of the Australian Information Commissioner about what she believes is a regulatory failure, and continues to fight for information from some charities.
Josling believes that this saga reveals not just how widespread the practice of profiling is in the charity industry, but how Australia’s existing privacy framework does little to help inform the public, or even to let them know what others know about them.
“This is really invisible to donors. Even for me — coming from the sector, having a lot of knowledge of data practices and privacy and being, you know, decently cynical — it took quite a lot of work and persistence to extract this,” she said.
“I think a typical donor would just have no chance of understanding the full picture of how their data had been used.”