Automated Decision-Making Opt-Outs: Profiling Rights by Law

Article 22 is stronger than an opt-out: data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, which the CJEU (SCHUFA, C-634/21, December 2023) confirmed operates as a prohibition, not a right the person must invoke. Elements matter individually. 'Solely automated': no meaningful human involvement; a human who rubber-stamps the model's output does not break the automation, the involvement must be substantive, by someone with authority and information to change the outcome. 'Legal or similarly significant effects': credit denial, insurance pricing, employment screening outcomes, benefit determinations; SCHUFA extended the reach upstream by holding that a credit score itself can be the Article 22 decision where recipients rely on it decisively. Exceptions: the decision is necessary for entering or performing a contract, authorized by EU or member-state law with safeguards, or based on explicit consent. Even within exceptions, mandatory safeguards apply: at minimum the right to obtain human intervention, to express one's point of view, and to contest the decision, plus meaningful information about the logic involved under the transparency articles (and the CJEU's 2025 Dun & Bradstreet ruling pushed 'meaningful information' toward genuinely intelligible explanations rather than algorithm dumps). Special-category data adds Article 9 conditions. So in GDPR-land the design question is not 'how do users opt out' but 'is this decision lawful at all, under which exception, with which safeguards built in.'

The model, set by Virginia and Colorado and copied widely: consumers may opt out of processing of personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects, defined roughly as decisions resulting in provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services, or access to essential goods and services. Near-uniform features: the right attaches to profiling feeding the decision (broader than fully automated decisions); it is exercised like other opt-outs (request mechanisms, verified where feasible, honored within statutory windows, typically 15-45 days); and it sits beside DPIA-style assessment duties for profiling with heightened risks. Variations that matter operationally: Colorado's rules distinguish decisions that are solely automated, human-reviewed, or human-involved, with the opt-out focused on solely automated profiling and documentation duties varying by tier; universal opt-out preference signals (mandatory in Colorado, California, and several others) currently target sale and targeted advertising, not profiling, so profiling opt-outs generally arrive through request workflows rather than browser signals; a handful of states narrow the right or omit it; and exemption structures (GLBA and FCRA-regulated data, HIPAA-covered data, employment data in most states outside California) remove large categories from scope, credit decisions under FCRA, notably, are governed by that regime's adverse-action machinery instead. The practical read: build to the Virginia/Colorado trigger list and the strictest response clock, and the state-by-state variance mostly collapses into notice-text differences.

The CPPA's automated decision-making technology regulations, part of the package finalized in 2025 after a multi-year rulemaking that visibly narrowed from earlier drafts, regulate businesses using ADMT to make significant decisions about consumers: decisions resulting in provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or compensation, or healthcare services. ADMT is technology that processes personal information and uses computation to replace or substantially replace human decision-making, the final text dropped earlier drafts' broader 'substantially facilitate' language and behavioral-advertising coverage, a meaningful narrowing. Obligations: pre-use notice, before using ADMT for a significant decision, plain-language notice of the use, its purpose, and the consumer's rights; opt-out, consumers may opt out of ADMT use for significant decisions, subject to exceptions, most prominently a human-appeal alternative (if the business provides a way to appeal to a qualified human reviewer with authority to overturn, it need not offer a separate opt-out for that use), plus narrow security, fraud-prevention, and safety carve-outs; and access, consumers can obtain information about how the ADMT was used to make a decision about them, including its output and how it factored in. Risk assessments for ADMT uses run on the parallel risk-assessment regulations. Timeline: businesses using ADMT for significant decisions before the operative date have until January 1, 2027 to comply, making 2026 the build year. Design note: the human-appeal exception is the architectural hinge, most businesses will satisfy the regime through appeal-with-authority machinery rather than pure opt-out switches, which conveniently is also what GDPR Article 22 safeguards and Colorado's AI Act require.

The uncomfortable core: an opt-out from automated decision-making obligates you to decide differently, which means an alternative process must exist. Requirements decompose into five layers. Intake and verification: the request arrives through your rights channels (or, for the ADMT pre-use context, at the decision point itself); verify identity to the regime's standard; log the request with scope, which processing, which decisions. State capture and propagation: the opt-out is a durable consumer-level state that every decision system must consult before running automated logic on that person, which demands a preference store keyed to identity, integration into each significant-decision pipeline (the inventory problem again), and propagation to processors and vendors executing decisions on your behalf, with contract terms obligating them to honor it. The alternative path: a human-driven or non-ADMT process producing the same category of decision on comparable timelines and criteria, staffed by people with real authority and access to relevant information; a 'manual review' queue that waits three weeks and then applies the model's output anyway is a documented violation, not a safeguard. Non-retaliation: the decision outcome and service terms cannot punish the opt-out (beyond what genuinely follows from the different process); several regimes prohibit discriminatory treatment for exercising rights. Evidence: per-request records (received, verified, honored, when), per-decision records showing the automated path was bypassed, periodic testing that the flag actually gates the pipelines, and reviewer-competence documentation for the human path, this is what an AG or DPA inquiry will sample. The cost reality: the alternative path is a staffing commitment that scales with opt-out volume, which is why accurate scoping (which decisions truly trigger the rights) is worth doing precisely rather than defensively broadly.

Build once to the union of triggers, with per-regime skins. Inventory and classification: enumerate every system where computation decides or substantially feeds decisions about individuals in the significant-decision categories (credit, insurance, housing, employment, education, healthcare, essential services, benefits); for each, record the automation level (solely automated, human-involved, advisory), jurisdictions of the affected people, and the legal regime that governs (Article 22, state profiling right, ADMT, FCRA adverse-action instead). Lawfulness before rights: for EU/UK populations, run the Article 22 analysis first, prohibition, exception, safeguards, because no opt-out workflow cures an unlawful decision basis; for US populations, confirm exemptions (FCRA, GLBA, HIPAA) before building duplicate machinery. One safeguards chassis: the convergent requirement across every regime is the human-review-with-authority path, GDPR safeguards, California's appeal alternative, Colorado's human-involvement tiers, and the EU AI Act's Article 14 human oversight for high-risk systems all describe the same capability, so build it once: qualified reviewers, information access, overturn authority, timelines, records. Notice layer: per-regime text (Article 13/14 meaningful-logic information, state privacy-notice profiling disclosures, ADMT pre-use notices) rendered from one inventory so descriptions never contradict. Preference and appeal plumbing: one consumer-rights intake, one preference store consulted by all decision pipelines, one appeal workflow with regime-specific SLAs. Assessments: one assessment pipeline emitting DPIAs (GDPR), state data-protection assessments, CCPA risk assessments, and, where the EU AI Act or Colorado AI Act applies, the AI-specific artifacts, shared evidence, different covers. Sequenced sensibly: inventory and Article 22 lawfulness now, state opt-out plumbing next, ADMT notices and appeals through 2026 against the January 2027 date.