If an algorithm is scoring you for a job, a loan, an insurance rate, or a police risk assessment, both the EU and the US give you legal tools to find out, challenge the result, and in some cases block the profiling entirely. AI profiling and your legal rights sit at the intersection of privacy law, anti-discrimination law, and consumer protection law, and the specific protections you can invoke depend on where you live and what kind of decision the profile drives. What follows is what those rights actually are and how to use them.
What Counts as AI Profiling
The EU’s General Data Protection Regulation defines profiling as any automated use of personal data to analyze or predict a person’s work performance, economic situation, health, preferences, reliability, behavior, location, or movements.1GDPR.eu. Art. 4 GDPR – Definitions In practice, that covers a lot: hiring platforms that rank resumes, lenders that score creditworthiness, ad networks that predict what you’ll click, and law enforcement tools that estimate the risk a defendant will reoffend.
The inputs range from obvious financial and employment records to behavioral signals like scrolling patterns, purchase history, social media activity, and location data. The model turns those signals into a score or a category, and that output travels to whoever makes the decision about you. You usually don’t see the score, and you usually aren’t told which variables mattered.
Your Core Rights When You’re Profiled
Several rights show up consistently, though the details vary by jurisdiction.
The Right to Know You’re Being Profiled
Under the GDPR, organizations must disclose the existence of automated decision-making, meaningful information about the logic involved, and the significance and expected consequences for you.2GDPR.eu. Art. 15 GDPR – Right of Access by the Data Subject Most US state privacy laws require notice at or before the point of data collection. That notice is often buried in a privacy policy, but it’s there, and you can rely on it as a starting point for asking what data the company holds.
The Right to Access Your Data
Both the GDPR and the newer US state privacy laws let you request the specific data an organization holds about you, including the inputs that feed your profile.3European Commission. Information for Individuals Requests typically go through a company’s privacy portal or a designated contact, and the organization has a set window to respond.
The Right to Correct Inaccurate Data
If your profile is built on wrong information, you can demand a correction. In the US, the Fair Credit Reporting Act requires consumer reporting agencies to reinvestigate disputed items within 30 days and either correct the information, delete it, or verify it.4Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy The GDPR offers a parallel right to rectification across the broader category of personal data.
The Right to Human Review
The GDPR gives people in the EU the right not to be subject to a decision based solely on automated processing when that decision produces legal effects or otherwise significantly affects them.5GDPR.eu. Article 22 GDPR – Automated Individual Decision-Making, Including Profiling Three exceptions apply: the decision is necessary for a contract, it’s authorized by law with safeguards, or you gave explicit consent. Even then, you can demand human intervention, share your point of view, and contest the decision.
The US has no direct equivalent to Article 22, but adverse-action notice requirements in credit law force lenders to give you the specific reasons behind an automated denial, which functions as a concrete basis for appeal.
The Right to Opt Out or Delete
The GDPR provides a right to erasure when data is no longer needed or is being processed unlawfully. In the US, a growing number of state privacy laws give you the right to opt out of profiling used for decisions with legal or similarly significant effects and to request deletion of your data.
Rights in Hiring
Recruitment platforms routinely use AI to filter applicants before a human ever looks at a resume. Federal anti-discrimination law applies to those tools the same way it applies to a human hiring manager. The Equal Employment Opportunity Commission has confirmed that Title VII covers AI-driven employment decisions, including cases where the tool wasn’t designed to discriminate but produces an unjustified disparate impact on a protected group.6U.S. Equal Employment Opportunity Commission. What Is the EEOC’s Role in AI? A video interview tool that scores applicants low because their speech patterns differ due to a disability, or facial recognition software that performs worse on darker skin tones, can create illegal discrimination even if no one intended that result.
Employers must also provide reasonable accommodations for applicants with disabilities when AI-driven assessments are part of the process. That can include extra time on timed tests, materials in accessible formats like large print or braille, or assistive technology such as screen readers. Cost alone isn’t a valid reason to refuse, though employers aren’t required to provide a specific accommodation that would cause genuine significant difficulty or expense.7U.S. Equal Employment Opportunity Commission. Job Applicants and the ADA
If you suspect an automated screening tool unfairly rejected you and a disability may have affected your performance, request an accommodation in writing and document what happened. That documentation matters if you later file a complaint with the EEOC or a state civil rights agency. The employer is required to engage in an interactive process rather than simply refusing.
Rights in Credit and Lending
Under the Equal Credit Opportunity Act, every applicant who faces adverse action is entitled to a statement of the specific reasons for that decision.8Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition The Consumer Financial Protection Bureau has been direct about what that means when a lender uses AI: a creditor’s claim that its model is too complicated to explain is not a valid defense.9Consumer Financial Protection Bureau. Circular 2022-03 – Adverse Action Notification Requirements in Connection With Credit Decisions Based on Complex Algorithms Vague explanations like “internal standards” or “you didn’t meet our qualifying score” don’t satisfy the requirement. The reasons disclosed must describe the actual factors the model scored, and no principal reason for denial can be left out.
The CFPB has also flagged the risk of “alternative data” inputs like social media activity or shopping habits that can serve as proxies for race, age, or other protected characteristics. Lenders are expected to review their input variables for fair lending risks and to actively search for less discriminatory alternatives.10Consumer Financial Protection Bureau. Innovation Spotlight – Providing Adverse Action Notices When Using AI/ML Models
When a lender uses a consumer report to deny credit, the lender must notify you, identify the reporting agency, and tell you that you have the right to a free copy of the report and to dispute its accuracy. Combined with the FCRA’s 30-day reinvestigation rule, that’s your practical pathway to challenge inaccurate data feeding a profile.4Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
Rights When Law Enforcement Profiles You
Law enforcement agencies use AI profiling in two main ways: place-based models that predict where crime is likely to occur, and person-based models that score individuals on their likelihood of offending or of becoming victims. Pretrial risk assessment tools also profile defendants to estimate the likelihood they’ll reoffend or fail to appear, and courts may rely on those estimates when making bail or sentencing decisions.11U.S. Department of Justice. Artificial Intelligence and Criminal Justice, Final Report
The bias problem is well documented. Models trained on historical crime data can reproduce and amplify existing enforcement patterns. A place-based model may direct more officers to a neighborhood that already had heavy policing, which generates more arrests, which feeds back into the model. Person-based tools face similar criticism, and the data behind them may reflect errors or historical biases that the models often lack the transparency to expose.
In the EU, the AI Act prohibits AI that predicts whether someone will commit a crime based solely on profiling their personality traits or characteristics, unless the system supports a human assessment already grounded in objective facts linked to criminal activity.12European Commission AI Act Service Desk. Article 5 – Prohibited AI Practices In the US, there’s no direct federal analog, though constitutional and civil rights claims can be raised against specific tools in specific cases.
How EU Protections Differ From US Protections
The EU regulates AI profiling through two overlapping frameworks. The GDPR restricts automated decisions that significantly affect people and gives them access, correction, and human-review rights. The EU AI Act adds a risk-based layer: any AI system listed in Annex III that performs profiling is automatically classified as high-risk, with no exceptions.13EU Artificial Intelligence Act. Article 6 – Classification Rules for High-Risk AI Systems The high-risk categories include AI used for recruiting or evaluating job candidates, systems that assess creditworthiness, and tools used by law enforcement for risk assessment or criminal profiling.14EU Artificial Intelligence Act. Annex III – High-Risk AI Systems Referred to in Article 6(2) Providers face extensive obligations around transparency, data quality, technical documentation, and conformity assessments.15EU Artificial Intelligence Act. Article 16 – Obligations of Providers of High-Risk AI Systems
Some profiling is banned outright. The AI Act prohibits social scoring, personality-based criminal prediction as described above, and systems that use manipulative or deceptive techniques to distort behavior in ways that cause significant harm.
The US has no comparable comprehensive law. Federal protection comes from sector-specific statutes: the FCRA and ECOA in credit, Title VII and the ADA in employment, and the Federal Trade Commission’s general authority over unfair and deceptive practices. The FTC has used that authority against AI abuses, including banning Rite Aid from using AI-powered facial recognition after finding the retailer had deployed the technology without reasonable safeguards.16Federal Trade Commission. FTC Announces Crackdown on Deceptive AI Claims and Schemes Federal executive policy on AI has shifted between administrations, but the underlying statutes remain in force regardless.
State Privacy Laws Fill Some of the Gap
As of late 2025, at least 18 US states had passed comprehensive privacy laws giving consumers the right to opt out of profiling used for decisions with legal or similarly significant effects, including credit determinations, insurance pricing, and hiring. The specifics vary. Some laws cover only fully automated decisions; others reach decisions where a human is technically involved but the algorithm drives the outcome.
Several state laws require businesses to honor browser-level opt-out signals like Global Privacy Control, which sends an automated “do not sell or share” request when you visit a website. Penalties for violations range from a few hundred dollars per violation in some states to several thousand for intentional violations or violations involving minors’ data. The protections available to you depend heavily on where you live.
Steps to Take Now
If you’re denied credit, ask for the specific reasons in writing. Lenders are legally required to provide them, and those reasons are your starting point for identifying whether the decision rested on inaccurate data or a questionable variable.8Office of the Law Revision Counsel. 15 USC 1691 – Scope of Prohibition If you spot errors, dispute them directly with the reporting agency; the agency has 30 days to investigate and must correct or delete anything it can’t verify.4Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
Enable Global Privacy Control in your browser or install an extension that sends the signal automatically. Where recognized by state law, this functions as a legally binding opt-out request that companies must honor. Review privacy settings on the platforms you use most, and exercise your access rights to see what data companies actually hold.
For job applicants, if an automated assessment may have penalized you because of a disability, request a reasonable accommodation and document everything.7U.S. Equal Employment Opportunity Commission. Job Applicants and the ADA The employer must engage in an interactive process rather than reject the request outright. If you believe an AI screening tool caused unlawful discrimination, a complaint to the EEOC or a state civil rights agency is the formal channel.
Bias in AI profiling is often invisible: you don’t get told the algorithm scored you lower because of a proxy correlated with your race or disability. You just get the denial or the higher price. That’s why the rights to explanation, access, correction, and human review matter as much as they do. They’re often the only mechanism that forces the decision into the open where it can be examined.