Skip to content

Automated decision-making in use but no transparency disclosure in the policy

This check looks for signs that your site makes automated decisions with a real effect on people, such as instant approval, automated eligibility or underwriting, or algorithmic pricing, then checks whether your privacy policy explains this. Automated decision-making (ADM) means a computer system reaches an outcome with little or no human involvement. On this site, the check found signals of ADM in use, but the privacy policy has no section describing it, so visitors have no way to know a decision affecting them was automated. Visitors have no way to know a computer, not a person, made a decision that affects them, or how to ask for a human to check it. Australia's Privacy Act reform adds specific automated decision-making transparency requirements, with the ADM provisions commencing December 2026, and the GDPR (General Data Protection Regulation) has an equivalent requirement for European visitors under Article 22. Missing this disclosure is a concrete compliance gap regulators are now watching for. Your privacy lawyer should add an 'Automated decision-making' section to the privacy policy, roughly half a day of work. It needs to name which decisions are automated, the effect on the person, how they can request a human review instead, and a plain-English summary of the logic used. Get this live before the Australian ADM provisions commence in December 2026, so the policy is already compliant when the rule takes effect rather than scrambling afterwards.

Why this matters

Visitors have no way to know a computer, not a person, made a decision that affects them, or how to ask for a human to check it. Australia's Privacy Act reform adds specific automated decision-making transparency requirements, with the ADM provisions commencing December 2026, and the GDPR (General Data Protection Regulation) has an equivalent requirement for European visitors under Article 22. Missing this disclosure is a concrete compliance gap regulators are now watching for.

How to fix it

Your privacy lawyer should add an 'Automated decision-making' section to the privacy policy, roughly half a day of work. It needs to name which decisions are automated, the effect on the person, how they can request a human review instead, and a plain-English summary of the logic used. Get this live before the Australian ADM provisions commence in December 2026, so the policy is already compliant when the rule takes effect rather than scrambling afterwards.