Article 22 UK GDPR: What “Decisions Based Solely on Automated Processing” Means for Marketers

In the rush to adopt artificial intelligence and marketing automation, a provision of UK data protection law has received far less attention than it deserves.

Article 22 of the UK GDPR grants individuals “the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her” (Department for Science, Innovation and Technology, 2023).

This is not a minor or obscure provision. It goes to the heart of how AI-driven marketing operates. It imposes restrictions on automated decision-making that many marketers do not fully understand—and that many automated systems routinely violate.

The scale of AI adoption makes this increasingly urgent. Global AI funding reached a record 100.4 billion U.S. dollars in 2024, with nearly 70 percent coming from mega-rounds (Statista, 2024a). The global AI market is projected to grow from 244.2 billion U.S. dollars in 2025 to 1,005.3 billion U.S. dollars by 2031 (Statista, 2024a). Meanwhile, algorithm-driven spending is expected to account for 77 percent of advertising expenditure in the 12 largest ad markets by 2028 (Statista, 2024b).

 

What Article 22 Actually Says

The text of Article 22(1) establishes four elements that must be present for the provision to apply.

1. First, a decision. Not all automated processing is covered. There must be a decision—an outcome that determines something about the individual.
2. Second, based solely on automated processing. The decision must be made without meaningful human involvement. If a human reviews and can override the automated decision, Article 22 may not apply.
3. Third, including profiling. Profiling—any form of automated processing of personal data to evaluate personal aspects of an individual—is explicitly included.
4. Fourth, which produces legal effects or similarly significantly affects the individual. This is the threshold. The decision must have consequences that are real, not trivial.

The UK GDPR recitals provide additional guidance. Recital 71 states that processing should be subject to suitable safeguards, including the right to obtain human intervention, to express their point of view, and to contest the decision.

The fundamental principle is clear: individuals should not be subject to significant decisions made entirely by machines without human oversight.

 

How Article 22 Applies to Marketing

At first glance, Article 22 might seem to apply only to obvious cases—credit scoring, hiring algorithms, medical diagnoses. But the provision reaches much further into marketing than many practitioners realise.

1. Programmatic advertising. An algorithm determines which ads a user sees, what price is offered, and whether a user is excluded from certain campaigns. With social media advertising spending projected to reach 438 billion U.S. dollars by 2030 (Statista, 2024c), the scale of automated decision-making is immense.
2. Dynamic pricing. Algorithms adjust prices in real time based on user behaviour, location, and purchase history. A consumer offered a higher price than another user for the same product has been subject to an automated decision with economic consequences.
3. Credit-based marketing. Algorithms segment users based on predicted creditworthiness and determine who receives offers for financial products. This directly engages the “legal effects” threshold.
4. Personalisation at scale. AI systems determine what content users see, what products are recommended, and what communications they receive. Global digital advertising expenditure is expected to reach 948 billion U.S. dollars by 2028 (Statista, 2024b).

The threshold is not whether the decision is called “marketing.” It is whether the decision is based solely on automated processing and whether it produces legal effects or significantly affects the individual.

 

 

The “Significantly Affects” Threshold

The ICO’s guidance provides clarity on what constitutes significant effects.

Decisions that affect an individual’s financial circumstances meet the threshold. Decisions that affect access to services or opportunities meet the threshold. Decisions that affect an individual’s health or wellbeing meet the threshold. Decisions that have a prolonged or permanent impact meet the threshold. Decisions that lead to exclusion or discrimination meet the threshold.

The guidance also notes that not every automated decision falls under Article 22. Recommending a film based on viewing history is unlikely to be significant. Deciding whether to offer credit is clearly significant.

The key question: would a reasonable person consider this decision to matter? If the answer is yes, the threshold may be met.

For marketing, this means a decision about which newsletter to send is unlikely to be significant. A decision about whether to show a discount code may be significant if the discount is substantial. A decision about whether to exclude a user from a financial product offer is almost certainly significant. A decision about pricing that varies by user is significant if the price difference is material.

The “Solely Automated” Question

Article 22 applies only to decisions “based solely on automated processing.” What counts as meaningful human involvement? The ICO’s guidance is clear: the involvement must be genuine and substantive. A human who simply rubber-stamps an automated decision without reviewing it meaningfully is not providing meaningful involvement.

Several factors indicate meaningful human involvement. The human must have the authority and competence to change the decision. The human must review the decision with sufficient information to evaluate it. The human must consider factors beyond those used by the automated system. The human’s involvement must not be merely performative.

In marketing contexts, an automated email campaign with no human review is solely automated. An AI system that recommends content but is reviewed by a human before delivery may not be solely automated—if the review is meaningful. A programmatic ad system that makes real-time decisions without human oversight is solely automated.

The timing of human involvement matters. Post-decision review—after the automated decision has been implemented—is not sufficient to avoid Article 22. The human involvement must be before the decision takes effect.

Profiling and Generative AI Under Article 22

Article 22 explicitly includes “profiling” within its scope. Profiling means any form of automated processing of personal data to evaluate personal aspects relating to an individual, particularly to analyse or predict performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

This definition captures much of what digital marketing does: segmenting users based on predicted interests, scoring users based on likely value or churn risk, classifying users based on behaviour patterns, and predicting future actions based on historical data.

The rise of generative AI introduces new complexities. Tools like ChatGPT, Claude, and Gemini are being integrated into marketing workflows for content creation, customer service, and personalisation. When generative AI is used to make decisions about what content a user receives, what offers are presented, or how a customer is treated, Article 22 may apply.

The challenges are significant. Generative AI systems are notoriously difficult to interpret. Many operate with minimal human oversight. And they may be trained on user data to personalise outputs, potentially engaging the profiling definition.

What Marketers Must Do

For marketing leaders using AI and automated systems, compliance with Article 22 requires systematic attention.

1. Map your automated decisions. Identify every marketing activity that involves automated decision-making. This includes programmatic advertising, dynamic pricing, personalisation algorithms, segmentation models, and any system that determines what a user sees or is offered.
2. Assess significance. For each automated decision, determine whether it produces legal effects or significantly affects individuals. Consider the financial impact, access to services, duration of effects, and potential for exclusion or discrimination.
3. Evaluate human involvement. If a decision is significant, determine whether meaningful human involvement exists before the decision takes effect. If not, the decision is subject to Article 22.
4. Identify the basis for processing. If Article 22 applies, determine whether an exception exists—necessity for contract, authorisation by law, or explicit consent.
5. Implement safeguards. For any automated decision-making subject to Article 22, ensure suitable safeguards are in place. Individuals must be able to obtain human intervention, express their point of view, and contest the decision.
6. Provide transparency. Inform individuals when automated decision-making is used. Explain the logic, significance, and consequences. Provide information about their rights and how to exercise them.
7. Document compliance. Maintain records of automated decision-making systems, the assessments made, the safeguards implemented, and the transparency provided.

The Human Intervention Requirement

For marketers, the most operationally significant aspect of Article 22 may be the requirement for human intervention.

Where an automated decision is made and Article 22 applies, individuals have the right to request human intervention. This is not merely a right to speak to someone. It is a right to have the decision reviewed by a human who can override the automated outcome.

For marketing systems, this creates practical challenges. How quickly can human intervention be provided? Who has the authority to override automated decisions? How are decisions about overrides documented? How are staff trained to review automated decisions meaningfully?

These challenges require planning. A system that cannot provide meaningful human intervention when requested is not compliant with Article 22.

A 2024 survey of financial services professionals found that 91 percent of companies are evaluating or have already implemented AI to improve operational efficiency (Statista, 2024a). In marketing, AI tools are being deployed across content creation, audience targeting, and campaign optimization. The need for compliance has never been more urgent.

A Question of Control

Article 22 embodies a fundamental principle: individuals should retain meaningful control over decisions that affect their lives, even when those decisions are made by machines.

In marketing, this principle is often tested. The same technologies that enable personalisation and efficiency also create distance between organisations and the individuals they serve. Decisions are made in milliseconds by algorithms no one fully understands.

The right to human intervention is not merely a compliance requirement. It is a recognition that some decisions are too important to be left entirely to machines. When a decision significantly affects an individual—whether financially, in access to services, or in other material ways—that individual has a right to a human review.

For marketers, the challenge is to harness the power of AI while respecting this principle. Systems can be designed to flag significant decisions for human review. Transparency can be built into interfaces. Consent can be obtained explicitly where appropriate.

The question is not whether to use automated decision-making. The question is how to use it responsibly—with transparency, with safeguards, and with respect for the rights that Article 22 enshrines.

 

 

---

References

Department for Science, Innovation and Technology. (2023). Artificial Intelligence sector study 2022. GOV.UK.

ICO. (n.d.). Guide to the UK GDPR. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/

Statista. (2024a). Artificial Intelligence – In-depth Report. Statista.

Statista. (2024b). Digital advertising worldwide – In-depth Report. Statista.

Statista. (2024c). Social media advertising and marketing worldwide – In-depth Report. Statista.