AI-based screening of job applicants comes with some concerns, but a recent class action lawsuit against recruiting software company Eightfold AI threatens to establish a false precedent that expands developer liability. The lawsuit says decades-old consumer reporting laws unfairly require courts to resolve issues that should be the responsibility of lawmakers.
The lawsuit was filed in California’s Contra Costa County Superior Court in January. The plaintiffs, two job seekers, alleged that Eightfold uses a cloud-based platform that aggregates information about job seekers from multiple sources, including applicant resumes and profiles, publicly available job information, employer data, and proprietary datasets.
The platform then applies a machine learning model to generate a numerical “fit score” that predicts how well an applicant would be a good fit for a particular job. These rankings, when provided to employers, help recruiters screen candidates. Lower-ranking candidates may not have had their applications reviewed by humans. The complaint also alleges that applicants cannot review or modify the data or scores used in the evaluation process.
In other words, the plaintiffs argued that Eightfold operates like a consumer reporting agency. They liken Eightfold to an agency that compiles personal information into reports and sells them to others for use in credit, housing, and employment decisions. If Eightfold qualifies as a consumer reporting agency, it will be subject to strict obligations regarding disclosure, accuracy, and dispute rights. The law would treat the company like credit reporting and background check companies under the Federal Trade Commission’s more than 50-year-old Consumer Reporting Act.
Is Eightfold really like a consumer reporting agency?
A company that sells database software does not become a reporting entity by storing customers’ personal data in the software.
Eightfold’s public documentation says otherwise. The company promotes itself as an enterprise software platform that supports employers’ recruitment efforts, rather than a company that creates documents about individuals for sale to third parties.
Of course, marketing materials are not sworn evidence. It does not explain how the platform will behave in all deployments. Still, there are enough differences to understand that the legal issues at issue are not as simple as the complaint suggests. The responsibilities of a consumer reporting agency are very different from those of a software service developer.
Consumer reporting laws were enacted long before AI entered the workplace, and Congress enacted them to regulate companies such as credit reporting companies, background check companies, and tenant screening services.
Consumer reporting agencies have a common structure. They collect personal information about individuals and compile it into reports. They then sell those reports to banks, landlords, and employers. Individuals may never see the reports or control how the company uses them. Because this imbalance creates risks, the law imposes a regulatory regime that governs accuracy, disclosure, and the right to contest errors.
However, this is a different service than a software platform designed as a database storage tool. A company that sells database software does not become a reporting entity by storing customers’ personal data in the software. This law focuses on who operates the reporting functions, not who builds the tools.
Important questions for courts to ask
Rather than getting lost in technical labels, courts evaluating Eightfold should ask three practical questions:
Who collected and analyzed applicant information? Was Eightfold operated independently or were employers using the software within their own recruitment systems?
Who distributed the reports to others: Did Eightfold sell reports about individuals to employers, or did employers use the tool to generate their own internal output?
Who controlled how the system worked, including what data was entered, when the system was run, how the results were interpreted, and how long the results were retained?
What’s wrong with the lawsuit?
The flaw in the lawsuit is a misunderstanding of AI tools. Specifically, unlike human actors, AI models do not autonomously generate reports about individuals. Instead, they respond to prompts, such as when applicants submit their resumes. The output only occurs when someone activates the system, not because the software developer decides to rate a specific person.
The Consumer Reporting Act regulates companies that actively create and sell reports about people. Tools that generate output on demand are not regulated.
Treating that response as the software company “providing” the report breaks down the distinction between the tool and its operator. This means that companies building AI tools are legally responsible for all output produced when a user or automated workflow activates the system. However, the developers did not select the subject matter, initiate the evaluation, or control how the results were used by the employer.
The Consumer Reporting Act regulates companies that actively create and sell reports about people. Tools that generate output on demand in response to user prompts are not regulated. Extending the laws governing consumer reporting to include AI software vendors would treat the tools as regulated parties and redefine the scope of the law.
If AI recruitment tools raise new concerns about fairness, transparency, and accountability, courts can address those concerns through flexible common law principles as appropriate. Legislatures can also design new regulatory frameworks tailored to modern systems. What courts should not do is stretch old statutes beyond their design limits to fill perceived regulatory gaps.
The Eightfold lawsuit presents an easy option. This encourages courts to apply familiar legal concepts to new AI tools. Although this approach has the potential to streamline analysis, it also carries the risk of increased uncertainty.
The software is not a reporting agency. AI tools are not decision makers. Responsibility follows control, not code. Courts should resist the urge to blur these lines and leave expanded regulation to the legislature.
John Pollenberg is a highly regarded business trial lawyer in Florida, known for his relentless advocacy and strategic acumen in complex commercial litigation. Jon has decades of experience representing companies in high-stakes litigation and has built a reputation for handling complex legal disputes with precision and striving for excellence. His practice spans a wide range of industries, helping companies resolve issues that affect their operations, reputation, and financial interests.
