Automated Decision Rules and Consumer Rights

There is no single law governing automated decisions about people. There are four overlapping regimes — consumer credit reporting, fair lending, state privacy law and EU data protection — and each one obliges you to send a different notice at a different moment. This page is organised around those notices, because that is the artefact you actually have to produce.

The rights, by what they oblige you to send

Adverse action: FCRA and ECOA

These two are the oldest automated decision rules in force anywhere and they are routinely missed by teams who think of them as banking regulation. Neither is limited to banks.

The Fair Credit Reporting Act reaches anyone who uses a “consumer report” for a permissible purpose — credit, insurance, employment, tenancy. If a vendor sells you a score or a report about individuals assembled from third-party data and you use it to decide about them, you may be a user of a consumer report and the vendor may be a consumer reporting agency, whatever either of you calls the product. The word “AI” changes nothing in that analysis; what matters is what the data is and what it is used for.

The Equal Credit Opportunity Act and Regulation B require a creditor taking adverse action to give a statement of the specific principal reasons, or notice of the right to request one. The Consumer Financial Protection Bureau published circulars in 2022 and 2023 addressing exactly the AI question: that creditors may not rely on the complexity of a model as an excuse for failing to give specific reasons, and that the sample reason codes in the regulation’s appendix are illustrative rather than exhaustive, so a reason that does not appear on the list must still be given. Confirm the current publication status of those circulars before citing them; the statutory and regulatory requirement stands regardless.

A legal reason is not a model feature

This is the paragraph most compliance write-ups miss and it is where engineering and law actually meet.

A top-feature attribution from a model — a SHAP value, a permutation importance ranking — tells you which input moved the score most. A statutory statement of reasons has to tell the applicant what they did that led to the outcome, in terms they can act on. Those are different objects. “Feature 47 contributed -0.12” is not a reason. “Length of credit history too short” is.

The mapping between them is a design decision that must be made before the model ships, and it constrains the model: if a feature cannot be expressed as a reason a person could understand and act on, using it in an adverse decision creates an obligation you cannot discharge. That is a stronger constraint than an explainability preference. It is the one place where the legal requirement determines the feature set.

# The artefact to build, once, per decisioning model.
# Not a SHAP plot: a table with a legally usable sentence per feature.

feature                     reason_code  applicant_facing_reason
----------------------------------------------------------------------
credit_history_months       C07          Length of credit history too short
revolving_utilisation       C12          Proportion of balances to limits too high
recent_inquiries_6m         C15          Too many recent credit inquiries
delinquency_max_severity    C02          Serious delinquency on file

# Rules this table enforces:
#  1. Every feature that can move a decision has a row, or it is removed.
#  2. Reasons are about the applicant's conduct or circumstances, never
#     about the model's internals.
#  3. Proxy features with no honest applicant-facing sentence do not ship.

State privacy laws and the profiling opt-out

Around twenty US states have comprehensive consumer privacy laws, and the ones modelled on the Colorado, Connecticut and Virginia pattern share two AI-relevant features.

• A right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Financial services, housing, insurance, education, employment and healthcare are the usual illustrations.
• A duty to conduct a data protection assessmentbefore processing that presents a heightened risk of harm, with profiling of that kind named as such processing. The assessment is usually required to be made available to the Attorney General on request, which makes it a document that has to exist rather than an internal habit.

Two operational consequences. The opt-out has to be honoured by a system, which means the decisioning path needs a route that does not use profiling and produces a defensible outcome — usually manual review. And the assessment has to be written before deployment, not reconstructed afterwards, because its date is part of what makes it evidence.

California’s automated decisionmaking rules

California went further than the opt-out pattern. The California Privacy Protection Agency adopted regulations dealing specifically with automated decisionmaking technology used to make a significant decision about a consumer, covering financial or lending services, housing, education, employment or independent contracting opportunities, and healthcare.

The obligations are a pre-use notice describing the purpose and the consumer’s rights, a route to opt out with limited exceptions, and a right to access meaningful information about how the technology was used with respect to that consumer. Compliance is phased and the principal date falls in 2027; this page does not state the day, because the phasing was set by rulemaking and has been adjusted. Take it from the CPPA’s own regulation text.

Also under the CCPA, and easy to miss: California amended the statute in 2024 to make explicit that personal information can exist in artificial intelligence systems capable of outputting it. That undercuts the argument that a model is a fresh artefact containing no personal data, and it has consequences for deletion requests that most teams have not thought through.

Article 22 and the EU explanation right

GDPR Article 22 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them — with exceptions for contractual necessity, authorisation by law, and explicit consent, each carrying safeguards.

Two CJEU judgments have made this considerably sharper:

• SCHUFA (Case C-634/21, December 2023). Where a third party draws strongly on an automated probability score in deciding whether to contract with a person, the production of that score is itself a “decision” within Article 22. The consequence: the scoring bureau cannot point at its customer as the decision-maker to escape the article, and a scoring vendor is not outside the regime because a human at the client clicked accept.
• Dun & Bradstreet Austria (Case C-203/22, February 2025). “Meaningful information about the logic involved” means information a data subject can actually understand — the procedure and principles actually applied, enough to understand which personal data were used and how — not the algorithm or the source code. Trade secrecy does not defeat the right; where secrecy is asserted, the material goes to the supervisory authority or the court to weigh, not into a refusal.

The AI Act adds a further right for individuals affected by decisions based on the output of Annex III high-risk systems that produce legal or similarly significant adverse effects: a right to obtain clear and meaningful explanations of the role of the system in the decision procedure and the main elements of the decision taken. It sits alongside the GDPR right rather than replacing it, and the two are assessed together in practice.

What to build once

The regimes differ but the machinery overlaps almost entirely. Six components serve all of them:

1. A decision log. For each automated decision about a person: the model version, the inputs used, the output, the threshold applied, whether a human reviewed it and who. Without this, every notice obligation becomes a reconstruction exercise.
2. The reason-code table above, mapping features to sentences an applicant can act on, maintained as part of the model rather than bolted on.
3. A notice template per trigger, with the moment it fires defined in code, not in a runbook. Ten business days before use, at the point of adverse action, at collection.
4. A human review path with real authority to change the outcome, staffed by people who know the system. Review that cannot overturn is not a safeguard.
5. An opt-out path that reaches a defensible decision without profiling.
6. The written assessment, dated before deployment, covering purpose, necessity, risks to individuals, and mitigations. One document can satisfy the state assessment requirement, the GDPR impact assessment and, where applicable, the AI Act’s fundamental rights impact assessment, if it is written to the strictest of the three.