The emergence of social media as a tool for credit scoring is changing how financial institutions assess creditworthiness. While traditional credit scores have largely relied on an individual’s financial history—such as payment records and debt profile—social media is increasingly being used to fill in the gaps where such historical data is lacking. This shift is particularly important for individuals without traditional credit histories, such as expats and the unbanked. However, the integration of social media data into credit assessments raises important questions about data privacy, accuracy, and fairness. The European Union’s (EU) Artificial Intelligence Act (AI Act) categorizes credit scoring as a high-risk use case of artificial intelligence,[1] which brings additional scrutiny to the use of alternative data sources like social media.
This analysis will explore the potential benefits of social media credit scoring, alongside its key challenges. We will also examine its legal implications within the European Union, particularly concerning GDPR compliance, and consider whether it promotes financial inclusion or risks creating new forms of exclusion.
How Social Media Is Shaping the Future of Credit Scoring
In recent years, the credit scoring industry has seen a significant shift in data sources. More companies are turning to network-based data to assess creditworthiness. This includes using information from social media profiles, such as education, employment history, social connections, and followers, to evaluate a person’s financial reliability.[2] Social data—derived from platforms like Facebook, X (formerly: Twitter), and LinkedIn—provides insights into a borrower’s lifestyle, trustworthiness, and financial behavior.[3] Lenders can use this data alongside traditional credit scores to create a more comprehensive risk profile. This is particularly beneficial in emerging economies where large segments of the population are underbanked and lack access to formal credit information.[4] The analysis of social data helps lenders make more informed decisions, especially when traditional credit data is limited or non-existent.[5]
The Pros and Cons of Social Media Credit Scoring
The pros of social media credit scoring:
A key benefit of social media credit scoring is its ability to provide real-time data. In fast-paced lending environments, such as payday loans or Buy Now, Pay Later (BNPL) services, this can significantly reduce the time required to make lending decisions.[6] Additionally, social media profiles can be used to assess “thin-file” borrowers—those without extensive financial histories.[7] In markets with high social media penetration, social data can offer a more nuanced picture of an individual’s behavior, making it especially useful for countries with limited credit bureau data.[8]
Moreover, social data can be a strong indicator of fraud risk. A complete lack of social media presence can be a red flag, suggesting that a potential borrower may be a fraudster.[9] However, a complete lack of social media presence is not always a red flag. In some cases, individuals may intentionally avoid social media for privacy or personal reasons, and using this as a signal of fraud could be misleading. That said, social media can help catch discrepancies between a person’s claimed financial status and their online persona, such as mismatches in job titles, location, or lifestyle.[10]
The cons of social media credit scoring:
Despite its advantages, using social media for credit scoring comes with significant drawbacks. A primary concern is privacy. Many consumers may not feel comfortable with their social media profiles being scrutinized for credit decisions, and they may resist this level of personal data collection.[11] The European Data Protection Supervisor (EDPS) has expressed concerns over the processing of personal data, particularly the use of sensitive information like social media data and has urged for clearer guidelines and stronger consumer protections.[12]
Additionally, social media data is not always accurate. People often present curated versions of their lives online, leading to potential misjudgments based on misleading or incomplete information. There are also issues with the varying quality of social media data. Not all social platforms offer the same depth of information, and aggregating data from multiple sources can be difficult.[13] The risk of false positives—rejecting creditworthy individuals due to inaccurate or incomplete social data—could have significant consequences for consumers.[14]
Credit Scoring in the EU: GDPR and AI Act Compliance
A critical challenge facing social media credit scoring in the EU is compliance with data protection and AI regulations, such as the General Data Protection Regulation (GDPR) and the AI Act.
GDPR Compliance
Under Article 22 of the General Data Protection Regulation (GDPR), automated decision-making is prohibited unless specific conditions are met, such as obtaining explicit consent from the data subject. The applicability of Article 22 is contingent on three cumulative conditions: first, there must be a “decision”; second, that decision must be based solely on automated processing; and third, the decision must produce legal effects or similarly significant effects on the individual.[15] If credit scoring involves human intervention or is not based solely on automated processing, it may not fall within the scope of Article 22, avoiding the stricter requirements for automated decisions.
In response to a request for a preliminary ruling on the interpretation of Article 22 of the GDPR, the Court of Justice of the European Union (CJEU) in OQ v. Land Hessen (C-634/21) on 7 December 2023[16] considered credit scoring an automated decision-making under Article 22 of the GDPR. The Court of Justice of the European Union (CJEU) found that the automated establishment of a probability value by a credit information agency, such as the one used in this case, constitutes „automated individual decision-making” as outlined in Article 22 of the GDPR. This type of decision-making is prohibited unless specific conditions are met, such as obtaining explicit consent from the data subject.[17] The CJEU emphasized that credit scoring agencies cannot bypass these requirements, even if their decisions do not involve direct actions by the agency itself.[18] Instead, credit scoring—which plays a crucial role in determining an individual’s ability to enter into contracts—was deemed to have a legal or similarly significant effect on the individual, thereby qualifying it as automated decision-making.[19] The Court emphasized that national laws permitting automated decision-making must include safeguards to protect the data subject’s rights. These include using appropriate procedures to minimize errors, securing personal data, and allowing human intervention, the right to express views, and the ability to challenge decisions.[20] This ruling underscores the critical need for credit agencies to adopt robust safeguards and ensure transparency, protecting consumers’ rights while using alternative data sources for credit assessments.
AI Act
The AI Act introduces another layer of complexity to the use of social media data in credit scoring. In its Annex III, the AI Act categorizes credit scoring systems as high-risk AI applications because they can determine individuals’ access to financial resources or vital services, including housing, electricity, or telecommunications.[21] The use of AI in credit scoring could perpetuate historical discrimination based on factors such as race, ethnicity, gender, age, or disability.[22]
As the AI Act emphasizes, AI systems designed for credit scoring must undergo thorough risk assessments to ensure fairness, transparency, and accountability. These assessments aim to mitigate the risk of bias in AI algorithms and safeguard consumers’ rights.[23] The Act calls for specific safeguards, including regular monitoring of these systems to ensure they do not produce discriminatory outcomes. For example, a high-risk classification means that AI systems must be designed to prevent any biased outcomes, such as decisions that disproportionately affect marginalized groups based on incorrect or biased social media data.[24]
The Future of Social Media in Credit Scoring
While social media credit scoring presents a promising opportunity to include more people in the financial system, its implementation must be handled carefully.
Research suggests that financial institutions need to develop sophisticated models that integrate social data in a way that complements, rather than replaces, traditional credit scoring methods. Equally important, strong data privacy protections must be in place to ensure that consumers’ rights are not infringed upon.[25] Given the increased risk of legal challenges in the EU under both the GDPR and the AI Act, financial institutions must also adopt robust compliance strategies to navigate the evolving regulatory environment effectively.
As digital transformation continues to shape the financial landscape, the question remains: will social media be the key to unlocking fair access to credit for millions, or will it create new forms of financial exclusion? The answer lies in how well the industry can navigate the balance between innovation, privacy, and fairness.
[1] European Parliament and Council of the European Union. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 15 February 2024 on Artificial Intelligence and Amending Certain Union Legislative Acts. Official Journal of the European Union, 2024, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 (hereinafter: AI Act), Annex III, 5(b).
[2] Wei, Yanhao, et al. „Credit Scoring with Social Network Data.” SSRN Electronic Journal, vol. 35, 2014, doi:10.2139/ssrn.2475265.
[3] Qarar. Social Media Can Tell a Lot More About Your Credit. Qarar, 2021, https://qarar.org/social-media-can-tell-a-lot-more-about-your-credit/ (hereinafter: Quarar, 2021).
[4] SEON. Social Media Credit Scoring: Pros, Cons, and How to Do It. SEON, 2021, https://seon.io/resources/social-media-credit-scoring/ (hereinafter: SEON, 2021).
[5] Qarar, 2021.
[6] SEON, 2021.
[7] Ibid.
[8] Qarar, 2021.
[9] SEON, 2021.
[10] Ibid.
[11] Ibid.
[12] European Data Protection Supervisor (EDPS). Fair Access to Credit through Consumer and Data Protection. EDPS, 26 Aug. 2021, https://www.edps.europa.eu/press-publications/press-news/press-releases/2021/fair-access-credit-through-consumer-and-data_en.
[13] SEON, 2021.
[14] Ibid.
[15] OQ v. Land Hessen, C-634/21, 7 Dec. 2023, ¶43.
[16] Court of Justice of the European Union. Judgment in Case C-634/21, OQ v. Land Hessen, SCHUFA Holding AG (Scoring). 7 Dec. 2023, Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany). Court of Justice of the European Union. curia.europa.eu, https://curia.europa.eu/juris/document/document.jsf;jsessionid=4BE93BAC601538E9AA2A8431E38CBF8B?text=&docid=280426&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=626967 (hereinafter: OQ v. Land Hessen, C-634/21, 7 Dec. 2023).
[17] Hunton Andrews Kurth LLP. CJEU Rules that GDPR Prohibition on Automated Decision-Making Applies to Credit Scoring. Hunton, 14 Dec. 2023, https://www.hunton.com/privacy-and-information-security-law/cjeu-rules-that-gdpr-prohibition-on-automated-decision-making-applies-to-credit-scoring.
[18] Ibid., ¶¶61-63, 73.
[19] Ibid., ¶¶42-43, 48, 62, 73.
[20] Ibid., ¶¶65-66.
[21] European Commission. Recital 58 of the Artificial Intelligence Act. European Commission, 2021, https://artificialintelligenceact.eu/recital/58/.
[22] Ibid.
[23] European Commission. Regulatory Framework for Artificial Intelligence. European Commission, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai.
[24] Ibid.
[25] SEON, 2021.
