Automated decision-making is the practice of reaching a decision about a person by technical means, without a human meaningfully weighing the outcome. A loan refused by a scoring model within minutes or a driver deactivated by fraud software are typical examples. The term exists as a legal category because the law treats such decisions differently from those taken by people. In Europe, Article 22 of the General Data Protection Regulation (GDPR) restricts decisions "based solely on automated processing, including profiling" that produce legal effects or "similarly significantly" affect an individual. The rule exists to keep a human answerable for outcomes that change lives.

How a decision becomes "solely automated"

Article 22 applies only when three conditions meet. There must be a decision, it must be based solely on automated processing, and it must carry legal or similarly significant effects. A legal effect changes rights or contractual status, such as cancelling a contract or refusing a social benefit. A similarly significant effect is harder to define. Recital 71 of the GDPR offers two examples: "automatic refusal of an online credit application" and "e-recruiting practices without any human intervention".

The word "solely" carries most of the weight. The former Article 29 Working Party, the group of EU data protection authorities that preceded the European Data Protection Board (EDPB), wrote in its 2017 guidelines (WP251) that human involvement must be meaningful, "not a token review". A reviewer who rubber-stamps every score does not take a decision out of Article 22. The Working Party also read Article 22(1) as a prohibition rather than a right that individuals must actively invoke - a reading the Commission later tried to change.

The chain is simple: data is collected, a model built through profiling produces a score, and a threshold turns that score into an outcome. The Court of Justice of the European Union (CJEU) widened the first link of that chain in its SCHUFA ruling (C-634/21) of December 7, 2023. A credit score produced by one company can itself be an automated decision when the bank or landlord using it "draws strongly" on it. That moved credit bureaus, not only lenders, inside Article 22.

Exceptions and safeguards

Article 22(2) lists three exceptions. A solely automated decision is allowed when it is necessary for entering into or performing a contract, when it is authorised by EU or member state law, or when the person gives explicit consent. Where the contract or consent route is used, Article 22(3) requires safeguards: at minimum, the right to obtain human intervention, to express a point of view and to contest the decision. Article 22(4) adds a stricter layer for special category data such as health or ethnicity, which can feed automated decisions only with explicit consent or on grounds of substantial public interest.

Transparency duties sit elsewhere in the regulation. Articles 13(2)(f), 14(2)(g) and 15(1)(h) require controllers to disclose the existence of automated decision-making and "meaningful information about the logic involved, as well as the significance and the envisaged consequences". The CJEU clarified that phrase in case C-203/22 on February 27, 2025: controllers must explain the procedure and principles actually applied, and a trade secret claim must be put before the competent authority or court rather than used to refuse an answer. An Austrian court applied that guidance on May 28, 2025, ordering a credit agency to supply compliant information within four weeks. The right of access under Article 15 is how most people discover such a decision was taken.

From French data law to Article 22

The idea predates the internet economy. France's data protection law of January 6, 1978 barred court decisions involving an assessment of human behaviour from resting solely on automated processing. Article 15 of Directive 95/46/EC, adopted on October 24, 1995, generalised that idea into a right not to be subject to automated individual decisions.

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, carried the rule forward as Article 22 and added explicit references to profiling. The Working Party adopted its guidelines on October 3, 2017, revised them on February 6, 2018, and the EDPB endorsed them on May 25, 2018.

Other jurisdictions have since built their own versions. California's privacy regulator finalised rules on automated decisionmaking technology (ADMT) on July 24, 2025; the Office of Administrative Law approved them on September 23, 2025, with ADMT duties applying from January 1, 2027, according to White & Case. The United Kingdom went in the opposite direction from the EU default. The Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025, replaced Article 22 of the UK GDPR with Articles 22A to 22D from February 5, 2026. Significant automated decisions are now permitted subject to safeguards, except where special category data is involved.

Why it matters for advertising

For most ad delivery, Article 22 does not bite. The Working Party wrote that "typical cases of targeted advertising" would not have a significant effect. The same guidelines flagged exceptions: intrusive targeting, the person's expectations and known vulnerabilities all matter, with repeated gambling ads aimed at someone in financial difficulty given as an example. The ordinary mechanics of ad personalization - consent signals, audience segments and bid decisions - are governed mainly by consent rules and the Digital Services Act rather than by Article 22.

The pressure comes from adjacent systems: lead scoring, credit-linked offers, dynamic pricing, recruitment advertising and AI agents can all tip into significant decisions. California's regulator originally covered "extensive profiling", which included behavioural advertising, then deleted that definition in the revised draft it advanced on May 1, 2025, according to Squire Patton Boggs' Privacy World blog. Colorado took a similar line. SB 26-189, passed on May 9, 2026, excludes advertising and marketing from "consequential decisions", though AI used for employment ad targeting could sit closer to the line when the same system also evaluates candidates.

The sums at stake are no longer theoretical. On August 21, 2026, the Dutch Autoriteit Persoonsgegevens (AP) fined Uber 824.99 million euros for deactivating drivers between 2018 and 2022 on the basis of fraud flags and ratings, with no human review. "A computer should not make decisions on its own that have major consequences for you," said Monique Verdier, the AP's deputy chair. Uber has appealed.

Where it fails or is disputed

The first dispute is about what counts as meaningful human involvement. When the AP consulted on the question, respondents described automation bias, overreliance on scores and interfaces that encourage routine approval, according to the summary published on June 3, 2025. Courts have drawn the line differently on similar facts. On September 1, 2025, Austria's Federal Administrative Court found that the public employment service's AMAS algorithm complied with Article 22 because trained advisers could and did override it. Weeks later, on September 25, 2025, the Austrian data protection authority ruled that KSV1870's credit scoring was unlawful after an energy supplier rejected an applicant within minutes on the strength of a single score.

Human review is no cure either: an access request to Zalando showed one director's note overriding a panel's unanimous yes.

Explanation is the second problem. Machine learning models rarely produce reasons a person can contest. The AP's draft guidance on the right to an explanation, opened for comment on April 25, 2026, rejects asking a large language model to explain itself as a valid answer under the GDPR.

The third dispute is political: whether Article 22 should remain a prohibition at all. That fight now runs through the Digital Omnibus.

Not the same as

Profiling. Profiling is the automated evaluation of personal aspects, such as predicting preferences or reliability. It often feeds automated decisions but is regulated separately; profiling without a significant decision falls outside Article 22.

Algorithmic media buying. In ad tech, "automated" usually means programmatic buying of impressions. Those are decisions about inventory, not people.

Legitimate interest. Legitimate interest is one of six legal bases for processing under Article 6. It is not one of the three Article 22 exceptions, so it cannot on its own justify a solely automated significant decision.

High-risk AI. The EU AI Act classifies systems, such as those used in hiring or credit scoring, as high-risk regardless of whether a human signs off. Its obligations attach to the system; Article 22 attaches to the individual decision.

Recent developments

The European Commission's Digital Omnibus proposal of November 19, 2025 rewrote Article 22 as a permission. Drafts reported by PPC Land in November 2025 allowed solely automated decisions for contracts "regardless of whether the decision could be taken otherwise than by solely automated means". The Netherlands listed automated decision-making rules among its concerns.

The Council has moved back and forth. Its Irish presidency text of September 3, 2026, document 12535/26, restored Article 22 as a right and deleted the "regardless" clause. PPC Land's report on document 13886/26 of October 2, 2026 instead describes the rewritten Article 22 as permitting such decisions for contracts with the same "regardless" wording, without saying whether the clause had returned or was carried over from the Commission text. The two accounts conflict. Coreper, the committee of member state ambassadors, postponed its vote on October 7 and did not take up the text on October 11, 2026, according to Agence Europe. As of October 15, 2026, no Council mandate exists.

National rules keep arriving meanwhile. Spain's Royal Decree 723/2026 took effect on October 5, 2026, requiring employers to explain the criteria behind algorithms that set pay, shifts or dismissal. Colorado's replacement law and California's ADMT rules both start on January 1, 2027.

Timeline

  • January 6, 1978 - French data protection law bars court decisions on human behaviour based solely on automated processing.
  • October 24, 1995 - Directive 95/46/EC adopted; Article 15 covers automated individual decisions.
  • April 27, 2016 - GDPR adopted, with Article 22 on automated decision-making and profiling.
  • October 3, 2017 - Article 29 Working Party adopts guidelines on automated decision-making (WP251).
  • February 6, 2018 - WP251 revised.
  • May 25, 2018 - GDPR applies; EDPB endorses WP251.
  • December 7, 2023 - CJEU SCHUFA ruling (C-634/21) treats credit scores as automated decisions.
  • February 27, 2025 - CJEU ruling in C-203/22 on explaining the logic involved.
  • May 1, 2025 - California regulator advances revised ADMT draft without "extensive profiling".
  • June 3, 2025 - Dutch AP publishes consultation summary on meaningful human intervention.
  • June 19, 2025 - UK Data (Use and Access) Act 2025 receives Royal Assent.
  • September 1, 2025 - Austrian court finds AMAS employment algorithm compliant with Article 22.
  • September 23, 2025 - California ADMT regulations approved.
  • September 25, 2025 - Austrian data protection authority rules KSV1870 credit scoring unlawful.
  • November 19, 2025 - Commission proposes Digital Omnibus, recasting Article 22.
  • February 5, 2026 - UK Articles 22A to 22D take effect.
  • April 25, 2026 - Dutch AP opens consultation on the right to an explanation.
  • May 9, 2026 - Colorado House passes SB 26-189.
  • August 21, 2026 - Dutch AP fines Uber 824.99 million euros over automated deactivations.
  • September 3, 2026 - Council text 12535/26 restores Article 22 as a right.
  • October 2, 2026 - Council document 13886/26 circulated.
  • October 5, 2026 - Spain's Royal Decree 723/2026 takes effect.
  • October 11, 2026 - Coreper does not vote on the data omnibus.
  • January 1, 2027 - California ADMT duties and most of Colorado SB 26-189 apply.

Summary

Who. Controllers that use scoring or AI systems to decide about people, including lenders, credit bureaus, employers, platforms and the ad tech vendors whose models feed them. Supervisory authorities such as the Dutch AP and Austrian authority enforce the rules; the CJEU interprets them; the Commission, Council and Parliament are renegotiating them.

What. A decision about an individual taken solely by technical means, with no meaningful human involvement, that has legal or similarly significant effects. Under GDPR Article 22 it is permitted only on contract, law or explicit consent, with safeguards.

When. The concept appeared in French law in 1978, entered EU law in 1995 and became Article 22 when the GDPR applied on May 25, 2018. As of October 15, 2026, the Digital Omnibus rewrite awaits a Council mandate.

Where. The EU and European Economic Area under the GDPR; the UK under Articles 22A to 22D; California and Colorado under separate ADMT rules from January 1, 2027.

Why. Automated systems decide at a speed and scale that removes accountability. The rule keeps a human answerable for outcomes such as refused credit, lost work or rejected applications, and determines how far advertising and AI systems can act on people without review.