Abstract
This research critically examines the adequacy of the Protection of Personal information Act (POPIA) 4 of 2013 in regulating AI-driven personalisation, particularly in the context of ADM and behavioural profiling. Artificial intelligent (AI) technologies, increasingly used in digital marketing and ecommerce, rely on cookies and tracking pixels to collect user data, raising significant concerns around informed consent and transparency. While POPIA provides a foundational framework for data protection, it lacks specific provisions addressing digital consent mechanisms, leaving users vulnerable to opaque data practices and manipulative design features.
A comparative analysis with Mauritius’ Data Protection Act (DPA) 120 of 2017 reveals stronger safeguards, including explicit consent requirements, broader definitions of profiling, and mandatory Data Protection Impact Assessments (DPIAs) for high-risk processing. The research further explores the African Union (AU) Convention on Cyber Security and Personal Data Protection (Malabo Convention) which contain similar Automated decision-making (ADM) provisions to South Africa and draws lessons from the AU AI Strategy which can serve as a guide to improving the National Artificial Intelligence Policy Framework (NAIPF).
The research concludes with policy recommendations to strengthen POPIA, including amendments to Section 71, the introduction of cookie-specific consent provisions and notification of ADM. These measures are essential to ensure ethical AI deployment, protect user autonomy, and align South Africa’s data governance with international best practices