Can Eightfold profile applicants without notice? Check the data use and the law

There is no blanket permission to do so. Eightfold describes technology that builds candidate-job match scores, including inferred career information. Whether an applicant must receive notice depends on the data processing, the employer’s use of the output and the applicable law. A vendor privacy policy does not settle those questions.

Also, “I did not receive an email” is not necessarily the same as “no notice was provided.” Some rules allow notice on an employer’s careers website; others require a separate disclosure and authorization.

U.S.-focused explanation, dated October 3, 2026. The examples below are not a complete jurisdictional survey. Informational only—not legal advice.

What Eightfold says it does

Eightfold’s engineering explanation describes more than résumé keyword matching. Its system uses résumé and job-description representations, skill overlap, title progression, company similarity and comparisons with reference profiles supplied by recruiters. It also describes predicting a candidate’s next title and next company from career history. The resulting match score is displayed on a 0–5 scale, in half-point intervals, for a profile against a position. That is a role-specific score—not evidence of one universal applicant rating. These are Eightfold’s descriptions of its matching system, not independent proof of accuracy or fairness.

Its May 2026 privacy notice, Section B, says it processes information supplied by customers and candidates, including contact details, professional and educational backgrounds, and résumés. When instructed by customers, it also obtains professional information candidates have made available through third-party sources such as LinkedIn, Stack Overflow and GitHub.

That notice distinguishes data Eightfold processes on an employer’s behalf from data it controls itself. For employer-controlled applicant records, it directs access, correction and deletion requests to the employer.

One phrase needs careful reading: Section B allows specified disclosures to other entities “without further notice to you, unless required by the law.” That concerns sharing under the stated policy. It is not permission to ignore legally required applicant notices, nor proof that every applicant’s data was collected or scored without notice.

What the Eightfold lawsuit alleges—and does not establish

In Kistler v. Eightfold AI, applicants allege that Eightfold creates undisclosed AI-driven consumer reports used to evaluate applicants, without the access and dispute protections required by the federal Fair Credit Reporting Act (FCRA) and California reporting law. The complaint makes those allegations; it is not a judicial finding that they are true.

Eightfold denied the allegations and said it intended to defend itself vigorously, according to The Guardian’s August 19, 2026 reporting.

The legal question is not simply whether software uses AI. It is whether the provider, information and report fall within consumer-reporting law. For that separate issue, see whether an AI résumé score counts as a background check.

Which notice could be required?

These are different obligations, not interchangeable versions of an “AI consent” checkbox.

Legal route	What to check
NYC Local Law 144	For covered automated employment decision tools used in NYC hiring, NYC-resident candidates must receive notice of tool use and the qualifications or characteristics assessed, plus accommodation-request instructions, at least 10 business days before use. The employer can provide applicant notice on its employment website. Screening can be covered even before the final hiring decision. See NYC DCWP’s scope and notice guidance.
California CCPA	For covered businesses and covered personal information, California residents have notice-at-collection and privacy rights, including access and correction. The employment-data exemption expired December 31, 2022. Coverage and data exceptions still matter. See California’s CCPA explanation.
Federal FCRA, if applicable	Before obtaining an employment consumer report, an employer generally needs a standalone written disclosure and written authorization. Before an adverse decision based on the report, it must provide the report and a summary of rights; additional notice follows the decision. See FTC/EEOC background-check guidance.

NYC’s guidance excludes résumé-bank scanning and outreach to people who have not applied for a specific position from Local Law 144’s audit and notice requirements. That exclusion does not resolve other privacy or reporting-law obligations.

For California, the distinction between source data and a derived profile also matters: publicly available information can be excluded from CCPA personal information, while inferences that create a profile about someone can qualify as personal information. The California Attorney General’s explanation describes both categories.

What candidates can ask now

Save the job posting, application confirmation, privacy notices and rejection message. Then use the employer’s designated privacy-request method, usually identified in its privacy notice. If you cannot find it, ask recruiting where to send this request:

Please confirm whether Eightfold processed or scored my application for [role/reference number]. Please identify any outside data sources and explain how the output affected screening. Where applicable, I request access to personal data about me, including retained inferred attributes and scores, and instructions for correcting inaccurate information. Please identify the relevant privacy notice and any consumer-report disclosure or authorization.

This asks for records and an explanation; it does not assume every jurisdiction guarantees access to every score. California’s guidance specifically advises using a business’s designated request methods, which may differ from its ordinary customer-service channels.

For records Eightfold controls itself, use the privacy webform linked in its notice. A marketing unsubscribe is not the same request.

What HR should verify before relying on a vendor notice

Document the actual configuration: inputs, outside-data enrichment, retained inferences, scoring and the weight recruiters give the output. Then have qualified counsel assess applicable privacy, AI-notice and consumer-reporting requirements.

Assign responsibility for delivering notices and handling access or correction requests. Retain evidence of the notice version, delivery method and timing. Do not treat a vendor’s published policy—or a human making the final decision—as a substitute for checking the employer’s own obligations. Privacy notice and candidate consent are distinct questions.