An adviser to the Court of Justice of the European Union today told the court that an online retailer which uses a fully automated credit check to withhold invoice and instalment payment from a shopper can fall under the GDPR's ban on solely automated decisions, and that the retailer, not the shopper, must prove the automation was necessary. The opinion, dated October 15, 2026, concerns Case C-568/25, a class action brought by Austria's Association for Consumer Information (VKI) against mail-order company Universal Versand GmbH.

In Short

A European court adviser says that when a shop's computer decides on its own that you cannot pay later by invoice or in instalments, that can be the kind of automated decision Europe's privacy law restricts. It matters for any online shop that runs credit checks at checkout, because the adviser says the shop must show which data it used, why that data predicts non-payment, and why a person could not do the check instead. The opinion does not settle the case; the EU Court of Justice will rule later, and the Austrian Supreme Court will then decide the dispute.

A note on the source text

The version of the opinion reviewed by PPC Land is a 22-page machine translation into English of the German-language text published on the court's InfoCuria database. According to footnote 1, the original language of the opinion is French. Several things follow from that chain of translations, and they matter for how the document is read.

The heading of the translated text renders the author's name as "THERE IS THE MEDINA", which appears to be a machine error for the name of Advocate General Laila Medina. Footnotes 19 to 31 were not translated at all and remain in German. Quotations in this article are taken word for word from the English machine translation, which means the wording is not the court's official English and may differ from the version the court eventually publishes in English.

Paragraph 10, which sets out the facts, contains two problems that cannot be resolved from the text. It states that Universal Versand receives tens of thousands of orders a month, "approximately 90% of which are processed using a 'low-risk' payment method", yet the next sentence says the company runs an automated credit check before allowing "such a payment method", and the rest of the opinion describes the methods in dispute as "unsafe" or "uncertain". The rendering "low-risk" therefore appears to be a mistranslation, and it is not clear whether the 90% share refers to the risky methods or the safe ones. The same paragraph says three colour-coded scenarios are possible but describes only two: red, for automatic rejection, and yellow, for a check by an employee. The third is missing from the translation.

The practice in dispute

Universal Versand runs a mail-order business in the Austrian market. Before it allows a customer to pay by "partial payment" or "on open account" - instalments or invoice - it runs an automated credit check. For new customers, according to the opinion, a request goes to a third-party company. If that company does not know the customer, the invoice or instalment option is rejected. If it does know the customer, the result is sorted by colour. Red means the option is automatically refused. Yellow means a Universal Versand employee carries out a database check. After an automatic rejection, the customer can ask for a manual review or contest the decision.

The order itself is not refused. As the Austrian Supreme Court framed it in its first question, the company declares its willingness "to enter into the business relationship with the customer using either the payment method 'credit card' or 'PayPal'". The shopper can still buy, but only by paying up front.

VKI, which brings collective actions on behalf of consumers in Austria, argued that this practice systematically infringes Article 22 of the GDPR. Universal Versand countered on two fronts: that refusing an unsafe payment method has no legal effect and does not similarly significantly affect customers, and that in any case the decision is necessary for entering into or performing the contract, which is an exception under Article 22(2)(a).

The Salzburg Regional Court dismissed VKI's action, and the Linz Higher Regional Court rejected its appeal. The Supreme Court in Vienna then stayed the case and sent three sets of questions to Luxembourg.

Question one: when a payment option becomes a decision

Article 22(1) gives a person the right "not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." The Advocate General reads three cumulative conditions into that sentence: there must be a decision, it must be based solely on automated processing, and it must produce legal or similarly significant effects. The Austrian court asked only about the third.

On legal effects, the opinion says a decision "must be capable of changing the content or exercise of a person's rights or obligations." On the second limb, it sets a threshold that excludes "merely incidental or marginal effects" and requires effects that are "at least similar to those that would result from the modification or cancellation of a right or obligation."

Footnote 5 contains a point of some practical weight. The Advocate General says that "significant" does not have to mean "serious", and expressly departs from the position of the Article 29 Working Party in its guidelines on automated decision-making, adopted on October 3, 2017 and last revised on February 6, 2018. According to the footnote, effects can be significant "if they have some importance for the person concerned (economically, socially, professionally, etc.), without being 'severe'". Footnote 6 lists the examination of a loan application, the setting of an insurance premium and the acceptance or refusal of medical treatment costs as examples that could fall within the second limb.

The opinion then turns to the Court's judgment of December 7, 2023 in SCHUFA Holding and Others (Scoring), Case C-634/21, which held that a person is at least similarly significantly affected when an automated probability score "almost systematically leads a bank to refuse to grant them credit." The question is whether refusing a payment option resembles refusing credit.

Here the reasoning runs through consumer credit law. The 2008 Consumer Credit Directive (2008/48/EC) may exclude contracts such as Universal Versand's, since Article 2(2)(f) carves out interest-free and fee-free credit and credit repayable within three months with only minor costs. But the Advocate General notes that the 15th recital of the newer Directive 2023/2225 records that several member states chose to apply the 2008 rules beyond their scope. According to paragraph 30, "nothing prevented the Republic of Austria from classifying contracts with insecure payments as credit agreements", and so "the findings of the SCHUFA Holding et al. (Scoring) judgment are therefore applicable."

A second line of reasoning does not depend on the credit directive at all. Paragraph 31 states that customers who cannot pay the full price immediately could be deprived "of the opportunity to conclude a purchase agreement", which puts them in a position "comparable to that in the case underlying the judgment in SCHUFA Holding et al. (scoring)".

The proposed answer to the first question is conditional. Excluding a customer from certain payment methods on the basis of a fully automated default assessment "has legal effect on that customer or at least similarly significantly affects that customer if it is likely to prevent the conclusion of the sales contract in question." Whether that is so for a given shopper is left to the Austrian court.

Contractual necessity, borrowed from Meta

If Article 22(1) applies, Universal Versand can still rely on Article 22(2)(a), which lifts the prohibition where the decision "is necessary for the conclusion or performance of a contract between the data subject and the controller". The opinion insists, citing earlier case law, that the exception must be "interpreted narrowly".

The central move is to read "necessary" in Article 22(2)(a) the same way the Court read the almost identical wording of Article 6(1)(b), the contractual legal basis for processing. That reading comes from the judgment of July 4, 2023 in Meta Platforms and Others, Case C-252/21, the competition and data case that rejected Meta's reliance on contract to justify personalised advertising on Facebook. In that judgment, according to the opinion, the Court held that processing must be "objectively essential to achieving a purpose which is a necessary component of the contractual performance", and that there "must be no practicable and less intrusive alternatives".

Paragraph 42 explains why the same standard should apply to both provisions: the criterion "must not be assessed according to different standards depending on whether it serves to establish either the lawfulness of processing personal data (Article 6(1)(b) GDPR) or the lawfulness of taking an automated decision in an individual case (Article 22(2)(a) GDPR)". For advertisers who followed the Meta litigation, this is the same test that closed contractual necessity as a route for behavioural targeting, now applied to checkout logic.

The result is a two-step test. First, there must be "a direct, substantive link between the subject matter of a contract to be concluded and the adoption of an automated decision". Second, there must be "no other, less intrusive alternative to achieve the same result."

On the first step, the opinion leans towards Universal Versand. Offering a suitable payment method serves the proper performance of a sale, and footnote 19, in German, contrasts this with the Court's January 9, 2025 judgment in Mousse (C-394/23), where gendered forms of address were not needed to sell a rail ticket. In the mail-order case, the footnote says, a customer's ability to pay directly affects whether the contract is properly performed. Whether automation is a suitable and indispensable means of checking that ability remains for the national court.

What data, and who has to prove it

The second question asks whether the data used must be objectively suitable for predicting default, and who carries the burden of proof. The Advocate General reads two issues into it: how much data may be used, and whether that data is fit for the purpose.

On quantity, the answer runs through Article 5 and the principle of data minimisation. Paragraph 50 states that a controller "may only collect and use data that is objectively suitable and strictly necessary for achieving the purpose pursued by the processing of personal data." Article 25, data protection by default, points the same way.

On quality, the opinion is more cautious. Paragraph 52 notes that "the GDPR provides no guidance as to the criteria by which the 'adequacy' and 'relevance' of a data element should be assessed." Which factors may count towards creditworthiness, it says, may fall under EU consumer credit rules or national law, with the GDPR supplying a proportionality test on top. Footnote 24, again untranslated, lists what the national court should examine: whether each data item has a direct factual link to the credit check, whether it is indispensable on its own or in combination with other data, and what risks it carries for the person concerned.

On the burden of proof, the opinion is unambiguous. Under the accountability rule in Article 5(2), "it is therefore incumbent upon the controller to indicate which data have been collected and processed, and to demonstrate that these were necessary". The proposed answer ends with one sentence: "The burden of proof for this lies with the mail-order company."

Speed, volume and the human alternative

The third question goes to the word "decision" in Article 22(2)(a). Must the decision itself be necessary for the contract, or must its automation be necessary? The Austrian court also asked whether order volumes and customers' expectation of an instant answer at checkout count.

The Advocate General answers with grammar. Article 22(2)(a) refers to "the decision", with a definite article, so it can only mean the "decision based solely on automated processing, including profiling" described in Article 22(1). Footnote 26 notes that the German ("die Entscheidung") and English ("the decision") versions read the same way. Any other reading, according to paragraph 61, would mean that "the mere fact that the adoption of a decision (whether automated or not) is necessary for the conclusion or performance of a contract would be sufficient" to permit automation.

Volume and speed are not ruled out. The opinion endorses the Article 29 Working Party's view that a court could find automation essential "if it finds that human intervention would not be realistic for practical reasons or would be impossible given the volume of data processed." But the company has to show it, and "the mere fact that such processing is useful for the performance of the contract in question is not sufficient".

Paragraph 65 sets the evidential bar. Universal Versand would need to demonstrate, "on the basis of objective factors", why the volume of orders leaves automated processing as the only option, and "that receiving an immediate response regarding the payment method is a significant factor in the customer's decision to conclude the contract". Footnote 31, in German, gives examples of such factors: quantified cost-benefit analyses, the financial impact of the alternative measures on the company, and statistical studies.

The final proposed answer allows that "time savings for customers and cost savings for the company" may be relevant, but only if they "objectively demonstrate this necessity under the specific circumstances of the individual case, in particular in the sense that no less intrusive alternative is available."

The Digital Omnibus in the background

Paragraph 62 contains the opinion's only reference to pending legislation. The European Commission told the court that its proposal to amend the GDPR - the Digital Omnibus, COM(2025) 837 final, according to footnote 29 - "would eliminate any doubt" about the meaning of "decision", because the amended text "would expressly not require that a decision be based solely on automated processing in order to benefit from the derogation". The Advocate General dismissed the argument: the proposal "has not yet entered into force and has not even been approved by the Parliament and the Council in its current form", so it "cannot be relevant".

The two texts point in opposite directions. A leaked draft of the Commission's package, reported by PPC Land in November 2025, included a recital stating that "the fact that the decision could also be taken by a human does not prevent the controller" from automating. The Council's October 2 negotiating text, covered by PPC Land on October 10, would allow solely automated decisions where necessary for a contract "regardless of whether the decision could be taken otherwise than by solely automated means." The Advocate General's test turns precisely on whether the decision could be taken otherwise. If the Court follows the opinion and the Omnibus passes in the Council's form, the legislature would reverse the Court's reading for future cases, a sequence that will be argued over in trilogue negotiations once Parliament adopts its own position.

Montezuma's reading, and a question the opinion does not answer

Luis Alberto Montezuma, who describes his LinkedIn posts as "Data and Privacy Policy | Personal Opinion", published a summary of the opinion on LinkedIn under the headline "Happy GDPR Article 22 Day in Case C-568/25". According to Montezuma, the opinion "takes a strict approach to GDPR Article 22 and fully automated decisions affecting data subjects."

His post reduces the opinion to five points: restricting payment methods can trigger Article 22; contractual necessity "must be demonstrated" through "a genuine factual connection between the contract and the automated assessment"; the data "must be objectively relevant"; "the company bears the burden of proof"; and "automation itself must be necessary". On cost, he writes that savings "may be considered, but only where they objectively support the conclusion that the automated processing is necessary and that a less restrictive alternative is not feasible." Those points track the proposed answers closely. The post credits Joost Gerritsen for the unofficial translation it attached.

The post also contains a detail that does not appear in the opinion. Montezuma opens by saying the algorithm "checks, among other things, whether your email provider is paid or free", and later describes this as one of the "unconventional indicators" for which a company must explain its choice. The 22-page opinion reviewed by PPC Land does not mention email providers anywhere. The detail may come from the Austrian Supreme Court's referring decision or from elsewhere in the case file, but it cannot be verified from the attached documents. If accurate, it is the type of data item paragraph 53 and footnote 24 ask the national court to scrutinise.

Not every reaction was positive. In a comment below the post, Arnoud Engelfriet, who lists himself as a "Legal specialist AI, data, IT, privacy/GDPR", called the scope analysis frustrating. "A refusal to offer postpayment is the same as rejecting a sale due to credit score. Ok. But what is the underlying criterion? This teaches us nothing," he wrote. The criticism is fair to the structure of the first answer: the opinion makes the outcome depend on whether the refusal "is likely to prevent the conclusion of the sales contract", and leaves the national court to decide that for each customer.

Why this matters for online retail and marketing

Checkout payment logic is not usually thought of as an advertising or data protection matter. Yet the decisions in this case are driven by the same machinery that powers much of digital marketing: third-party data, internal scoring and real-time classification of customers. An automated refusal at the payment step removes an option from a shopper at the point of purchase.

Austria has produced a cluster of Article 22 cases. In September 2025, the Austrian data protection authority found that KSV1870's fully automated credit scoring was a prohibited automated decision, in a case noyb brought on behalf of a customer refused by an energy supplier. That decision allowed the supplier to rely on the contractual necessity exception for its automated rejections, which it said it processed at a rate of 6,000 to 10,000 applications a month. The Advocate General's two-step test, if adopted, would require a supplier in that position to show that human review was not a realistic alternative before relying on the exception.

The same court system produced a May 2025 ruling ordering a credit agency to explain automated scores after the Court of Justice's February 27, 2025 judgment in Dun & Bradstreet Austria, which the Advocate General also cites. Austria's Federal Administrative Court went the other way in September 2025, finding that the public employment service's AMAS algorithm complied with Article 22 because advisers made substantive decisions rather than rubber-stamping scores.

Credit checks outside Austria have drawn scrutiny under the same necessity test. In May 2026, a Berlin administrative court ruled that a solar company's Schufa checks run before site visits lacked a legal basis under Article 6(1)(b), because the check was not objectively necessary at that stage. Italy's Garante, in an order adopted on March 12, 2026, fined Intesa Sanpaolo EUR 17.6 million for profiling about 2.4 million customers. And the Dutch authority opened a consultation in April 2026 on how to explain automated decisions, relying on both SCHUFA and Dun & Bradstreet.

What the opinion adds is a burden of proof that sits squarely on the business, extending to the choice of each data input. A retailer that cannot say what data its scoring vendor uses, or why each item predicts default, would struggle to meet it.

What happens next

An Advocate General's opinion does not bind the Court of Justice. The judgment will come later; the opinion gives no date. After that, the Austrian Supreme Court will apply the ruling to Universal Versand's practice, including the factual questions the opinion leaves to it: whether a refused customer is likely to be unable to buy, whether each data category is suitable, and whether human review could replace the automated step.

Timeline

Summary

Who: Advocate General Laila Medina of the Court of Justice of the European Union, in a case brought by Austria's Association for Consumer Information (VKI) against mail-order company Universal Versand GmbH, referred by the Austrian Supreme Court. Luis Alberto Montezuma summarised the opinion on LinkedIn, and Arnoud Engelfriet criticised it in a comment.

What: The opinion proposes that refusing invoice or instalment payment on the basis of a fully automated default assessment is an Article 22 GDPR decision if it is likely to stop the shopper from buying, and that the retailer must prove a factual link to the contract, the suitability of each data category, and the absence of a less intrusive alternative such as human review.

When: The opinion is dated October 15, 2026. The Court of Justice will rule at a later, unannounced date.

Where: The Court of Justice in Luxembourg, on a reference from Austria, where Universal Versand sells by mail order and online.

Why: Automated credit checks at checkout decide which shoppers may pay later. The opinion would require retailers to justify both the data they use and the decision to automate, at a time when the EU's Digital Omnibus negotiations would remove the second requirement from the GDPR.