The rule.
Article 22 restricts solely-automated decisions with legal or similarly significant effects.
“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
The EDPB guidelines (WP251rev.01) read “similarly significant” to cover effects on financial circumstances, access to services, employment, or opportunities. Profiling-based marketing is in scope when the outcome materially affects the consumer.
What it requires.
Identify the decisions. Catalogue every automated decision in the stack: who gets the campaign, the bonus, the airdrop, the dynamic price, the purchase-driving recommendation.
Establish lawful basis. Article 22(2) allows three: contract necessity, EU/Member-State law, or explicit consent. Marketing automation rarely qualifies as contract necessity — that leaves explicit consent.
Transparency. Articles 13(2)(f) and 14(2)(g) require disclosing the existence of automated decision-making, meaningful information about the logic, and the significance and consequences.
Right to human review. Human intervention, the right to express a view, and the right to contest — operationalised, not just a privacy-policy sentence.
Common violations.
Airdrop allocation: algorithmic score based on wallet activity, on-chain history, social signals. No disclosure of the scoring logic.
Automated decision with financial effect, no transparency, no human-review path. Fails Article 22 and Article 13(2)(f).
Fee schedule varies by user segment determined algorithmically from KYC data, transaction history, and behavioural signals.
Differential pricing is a financial effect. Fully automated segmentation puts it in Article 22; consent is required.
Lifecycle automation: users below the engagement-score threshold do not receive the product-launch email; users above do.
The algorithm decides who hears about a financial product. A closer call, but trending toward scope.
How to comply.
A register: each decision, inputs, outcome, who is affected, lawful basis. Also an Article 30 records-of-processing requirement.
Collect explicit consent separately from marketing-email consent: “I understand my eligibility for product offerings may be determined by automated processing of my account data, and I consent to this.”
Disclose the existence of automated decision-making, the logic in plain language (the factors and how they matter, not the model), and the consequences.
A clear route to request human review — email, support form, in-app — with a documented process and response SLAs.
Run a Data Protection Impact Assessment (Article 35) before any new automated-decision system: risks, mitigations, lawful-basis analysis. Standard in regulated firms; rare in growth stacks.
Related rules.
-
The upstream gate; automated-decision consent is layered on top.
-
KOL-driven segmentation often pairs with Article 22 issues.
-
An algorithmic incentives engine trips both the ban and Article 22.