GDPR Article 22 sets a general prohibition on decisions made entirely by automated means when those decisions produce legal effects or similarly significant consequences for the person involved. Such a decision is allowed only where it is necessary for a contract, authorised by law or based on explicit consent, and even then the person can ask for human review and contest the result. The UK took a different route: since 5 February 2026, its version allows these decisions on any lawful basis with safeguards, except where special category data is involved.
The provision protects individuals from being reduced to a data point. If an algorithm denies someone a loan, rejects a job application, or determines which price they see for a product, and no human being meaningfully reviewed that outcome, Article 22 is almost certainly in play.
What Article 22 says
Article 22(1) of the GDPR states that a data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. Three conditions must all be met for the prohibition to apply: the decision must be made without meaningful human involvement, it must be based on automated processing (which includes profiling), and it must produce effects that are either legal in nature or carry a comparable weight.
European regulators read this not as a right that individuals must actively invoke, but as a standing prohibition. Controllers cannot engage in qualifying automated decision-making and then wait for someone to object. The restriction applies by default.
That distinction matters. It means you cannot bury an opt-out mechanism in your privacy policy and consider the matter handled.
Does Article 22 apply to your decision?
Profiling and automated decision-making are not the same
These two concepts overlap but are not identical. Article 4(4) of the GDPR defines profiling as any form of automated processing of personal data that evaluates personal aspects relating to a natural person - particularly to analyse or predict things like work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
Profiling is the act of building up a picture of someone from data. Automated decision-making is the act of using that picture (or other automated processing) to reach a conclusion that affects the person. Profiling can feed into automated decision-making, but it can also exist on its own - for instance, when a website segments visitors by browsing behaviour to display different content.
Article 22 catches both, but only when the resulting decision meets the threshold of legal or similarly significant effects. A website showing personalised product recommendations based on browsing history is profiling, but it probably does not trigger Article 22. An insurance company automatically adjusting premiums based on an algorithmic risk profile almost certainly does.
When does a decision have "legal or similarly significant effects"?
Legal effects are relatively straightforward: decisions that affect someone's legal rights, contractual status, or entitlements under law. Refusing a credit application, terminating an employment contract, or denying a social security benefit all qualify.
"Similarly significant effects" is where it gets harder to draw the line. The Article 29 Working Party's guidelines on automated decision-making and profiling (WP251rev.01), revised in February 2018 and endorsed by the EDPB, explain that the effects must be sufficiently great or important to merit attention. They list several indicators: the decision could significantly affect someone's circumstances, behaviour or choices, have a prolonged or permanent impact, or lead to exclusion or discrimination.
| Scenario | Likely triggers Article 22? | Why |
|---|---|---|
| Automated credit scoring that determines loan approval | Yes | Directly affects contractual rights and financial access |
| Algorithmic CV screening that rejects job applicants | Yes | Determines whether someone can be considered for employment |
| Dynamic pricing based on user profiling | Possibly | If prohibitively high prices effectively bar someone from goods or services |
| Personalised product recommendations on an e-commerce site | Unlikely | Typically does not affect legal status or carry similarly significant weight |
| Targeted advertising based on browsing cookies | Unlikely in most cases | Generally lacks the severity threshold, though exceptions exist for vulnerable groups |
| Algorithmic work shift allocation and rider deactivation on gig platforms | Yes | Affects access to paid work - a similarly significant effect |
What this means for cookies and online profiling
Most cookie-based tracking for analytics or marketing purposes does not directly trigger Article 22. Setting a _ga cookie to measure page views, or a _fbp cookie to track conversions, involves profiling in the broad GDPR sense, but the resulting activity - showing a targeted advert or analysing traffic patterns - rarely produces legal or similarly significant effects on the individual.
That said, the line is not as clear as it once seemed. The Working Party guidelines note that targeted advertising based on extensive profiling could have significant effects on certain individuals, particularly vulnerable groups such as minors or people in financial difficulty. If cookie-based profiling feeds into decisions about pricing, access to services, creditworthiness, or insurance eligibility, Article 22 is potentially engaged.
Consider a practical example: a visitor browses a comparison website, and tracking cookies build a behavioural profile that is then shared with an insurance provider. If that profile directly influences the premium offered - or whether coverage is offered at all - the chain of processing from cookie to decision may fall under Article 22, especially after the SCHUFA ruling established that intermediary scoring can itself constitute a decision.
Regardless of whether Article 22 applies, profiling via cookies still requires a lawful basis under Article 6 of the GDPR and prior consent under Article 5(3) of the ePrivacy Directive for non-essential cookies. A consent tool that categorises tracking cookies and blocks them until consent is obtained covers that first layer. Article 22 adds a further layer when the profiling feeds into consequential decisions.
The SCHUFA ruling extended Article 22 to scores
On 7 December 2023, the Court of Justice of the European Union delivered its first ruling on the scope of Article 22 in Case C-634/21, commonly known as the SCHUFA case. SCHUFA is a German credit reference agency that generates automated credit scores and supplies them to lenders. An individual, referred to as OQ, was refused a loan based on a negative SCHUFA score and sought access to the data and logic behind the scoring.
SCHUFA argued it was merely engaged in preparatory processing - creating a score - and that the actual decision to refuse the loan was made by the bank. The CJEU rejected that argument entirely. The court held that SCHUFA's credit score played a "determining role" in the lending decision, and that where a poor probability value leads "in almost all cases" to the bank refusing a loan, the creation of the score itself constitutes a decision within the meaning of Article 22.
This ruling has far-reaching consequences. It means that intermediary service providers generating automated scores, risk assessments, or probability values can be caught by Article 22 - not just the organisation making the final call. Any company producing an automated output that a third party relies on heavily when making decisions about individuals should take notice.
The CJEU followed up on 27 February 2025 with its ruling in Case C-203/22 (Dun & Bradstreet Austria), which addressed the tension between an individual's right to transparency about automated decision-making and the protection of trade secrets. The controller must explain the procedure and principles it applied so that the person can understand which of their data was used and how, and handing over the algorithm alone is not enough. Where the controller considers that information a trade secret, it must still disclose it to the competent supervisory authority or court, which then balances the competing interests.
Enforcement actions: fines for automated decisions
Enforcement shows the practical consequences of getting automated decision-making wrong.
On 13 November 2024, the Italian Data Protection Authority fined Foodinho (the Italian company of the Glovo group) EUR 5 million over the processing of riders' personal data through its digital platform. The company used algorithms to manage work shifts, assign orders, and deactivate rider accounts, and the Garante found a breach of Article 22(3) because riders had no adequate way to obtain human intervention or contest automated decisions. It was the authority's second decision against the same company, after a first sanction in June 2021. For context on how GDPR fines are calculated under Article 83, the ten assessment criteria give regulators significant room to scale penalties based on the nature and severity of the violation.
Automated systems are not banned as such. The fines follow from failing to be transparent, failing to provide meaningful information about the logic involved, and failing to offer affected individuals a genuine route to human review.
The three exceptions and their limits
Article 22(2) permits solely automated decision-making in three specific circumstances. Each comes with strings attached.
Contractual necessity - the decision is necessary for entering into or performing a contract between the data subject and the controller. A fully automated credit check at the point of application could potentially rely on this basis, but the controller must demonstrate that automation is genuinely necessary for the contract, not merely convenient.
Authorised by law - EU or Member State law permits the processing and lays down suitable measures to safeguard the data subject's rights. Germany's Federal Data Protection Act (BDSG), for example, includes provisions on credit scoring under Section 31, though the CJEU in the SCHUFA ruling questioned whether those provisions fully satisfied GDPR requirements.
Explicit consent - the data subject has given their explicit consent. This is a higher bar than the standard GDPR consent threshold. It requires a clear, affirmative statement specifically addressing the automated decision-making. A general cookie consent banner does not qualify.
Whichever exception applies, Article 22(3) requires controllers to implement suitable safeguards. At minimum, the data subject must be able to obtain human intervention, express their point of view, and contest the decision.
The EU AI Act adds a second layer
The EU AI Act entered into force in August 2024 and applies in stages alongside the GDPR. As of October 2026, its prohibited practices have applied since 2 February 2025 and its rules for general-purpose AI models since 2 August 2025. The 2026 AI Omnibus, Regulation (EU) 2026/1744, moved the obligations for the high-risk systems listed in Annex III to 2 December 2027. Article 14 of the AI Act requires high-risk AI systems to be designed with human oversight capabilities, and Article 86 gives individuals the right to obtain clear explanations of the role an AI system played in a decision affecting them.
Creditworthiness assessment, recruitment tools and risk assessment and pricing for life and health insurance are listed as high-risk in Annex III of the EU AI Act. Their AI Act obligations apply from 2 December 2027, while Article 22 of the GDPR applies to the same decisions today.
For website owners, this dual regime is most relevant where AI-powered tools are integrated into customer-facing processes. If your site uses an AI chatbot that makes binding decisions about customer complaints, or an algorithm that automatically approves or rejects account applications, the GDPR applies now and the AI Act may apply as well. Where high-risk processing is involved, a Data Protection Impact Assessment is almost certainly required under Article 35 of the GDPR before you begin.
Practical steps for website owners
Start by auditing your processing activities. Identify every point where decisions about individuals are made without meaningful human review. "Meaningful" is the operative word here - the Working Party guidelines stress that a human rubber-stamping automated outputs does not count. The person reviewing the decision must have the authority, competence, and practical ability to change the outcome.
For each automated process identified, assess whether it produces legal or similarly significant effects. If it does, you need one of the three Article 22(2) exceptions, plus the mandatory safeguards. If it does not meet the Article 22 threshold, the general GDPR principles still apply - you still need a lawful basis, must provide transparency about the processing, and must respect the right to object to profiling under Article 21.
Your privacy notice must include specific information about automated decision-making. Articles 13(2)(f) and 14(2)(g) of the GDPR require you to inform data subjects about the existence of automated decision-making, provide meaningful information about the logic involved, and explain the significance and envisaged consequences. After the D&B Austria ruling, "meaningful information" means more than a generic description - it must enable the individual to understand the rationale behind the decision. Individuals may also exercise their rights through a Data Subject Access Request to obtain the specific data used in an automated decision affecting them.
On the cookie side, make sure that any profiling cookies are categorised and held until prior consent. Use a cookie scanning tool to identify all cookies on your site, including those set by third-party scripts that may be building profiles of your visitors. Kukie.io's scanner detects and categorises both first-party and third-party cookies, which helps you map which cookies contribute to profiling activities that could engage Article 22.
The UK replaced Article 22 in February 2026
The UK GDPR kept a near-identical version of Article 22 after Brexit, until the Data (Use and Access) Act 2025. Section 80 of the Act replaced it with new Articles 22A to 22D, which have applied to decisions taken since 5 February 2026.
The UK rules turn the prohibition into a permission with safeguards. A significant decision based solely on automated processing can now be taken on any lawful basis, provided the controller gives the person information about the decision and lets them make representations, obtain human intervention and contest it (Article 22C). A near-prohibition remains only where the decision relies on special category data, which needs explicit consent, or a contract or legal authorisation combined with a substantial public interest (Article 22B).
Because the UK has loosened Article 22, organisations serving both markets now run two standards: the EU prohibition with exceptions, and the UK permission with safeguards. California has taken a parallel path: the CCPA's automated decision-making rules, finalised in late 2025, impose their own notice and opt-out requirements for businesses targeting Californian residents.
Questions about Article 22 and profiling
Does Article 22 apply to all types of profiling?
No. Article 22 only applies when profiling feeds into a decision that is made solely by automated means and that decision produces legal effects or similarly significant effects on the individual. Profiling for general analytics or personalisation typically falls outside its scope, though the general GDPR principles still apply.
Can I use automated credit scoring on my website if I get consent?
Explicit consent is one of the three exceptions under Article 22(2), but it must be specific to the automated decision-making, freely given, and informed. A generic cookie consent banner or a buried clause in terms and conditions does not meet this threshold. You must also still provide the right to human intervention, the right to express a point of view, and the right to contest the decision.
Do targeted advertising cookies trigger Article 22 of the GDPR?
In most cases, no. Displaying a targeted advert based on cookie profiling does not typically produce legal or similarly significant effects. Exceptions may arise where the profiling targets vulnerable groups, leads to discriminatory pricing, or feeds into decisions about access to essential services. The cookies themselves still require consent under the ePrivacy Directive regardless of Article 22.
What counts as meaningful human involvement in a decision?
European regulators say the human must have genuine authority and competence to review and change the automated outcome. A person who clicks "approve" on every recommendation from an algorithm, without the practical ability or training to override it, does not provide meaningful involvement. The review must be substantive, not ceremonial.
What information must I give users about automated decisions?
Under Articles 13(2)(f) and 14(2)(g) of the GDPR, you must inform individuals about the existence of automated decision-making, provide meaningful information about the logic involved, and explain the significance and likely consequences for them. Following the CJEU's rulings in the SCHUFA and D&B Austria cases, this must be more than a vague summary - individuals need enough detail to understand the rationale behind a specific decision.
Does the EU AI Act replace Article 22 of the GDPR for AI systems?
No. The AI Act supplements the GDPR rather than replacing it. If an AI system is classified as high-risk under the AI Act and also makes decisions falling under Article 22 of the GDPR, both sets of requirements apply, the AI Act's high-risk duties for Annex III systems from 2 December 2027. The AI Act adds obligations around human oversight, bias monitoring, and transparency that go beyond what the GDPR specifies.
How do I audit my website for automated decision-making that might fall under Article 22?
Map every process where decisions about individuals are made without human review - this includes account approvals, pricing algorithms, eligibility checks, and any third-party tools that generate scores or assessments. For each, assess whether the outcome has legal or similarly significant effects. A cookie audit is a good starting point, as profiling cookies can reveal which third-party services are building user profiles that may feed into downstream decisions.
Map the profiling cookies on your site
If your website uses profiling cookies or third-party scripts that build user profiles, start by knowing which ones run. Kukie.io scans your site, finds the cookies set by first-party and third-party scripts, sorts them into categories and holds the non-essential ones until visitors consent.
