The Question at Hand
The FTC's decision to end disparate impact consideration in most cases presents a dilemma for compliance officers. You've invested years in controls to screen for unintended discriminatory effects in your algorithms, marketing, and consumer systems. Now, the federal agency that once supported this approach has reversed its stance.
Should you maintain your disparate impact analysis framework, or reallocate those resources to other compliance priorities?
This isn't just theoretical. Your team's time is limited, your audit budget is fixed, and your board expects risk management to align with actual enforcement patterns.
The Case for Maintaining Disparate Impact Analysis
Even if the FTC has stepped back, disparate impact remains a key element in other regulatory frameworks you can't ignore.
The Equal Credit Opportunity Act still prohibits lending practices that disproportionately harm protected classes, regardless of intent. The Department of Justice and private plaintiffs continue to pursue disparate impact claims under the Fair Housing Act. State attorneys general in California, New York, and Massachusetts continue to use this analytical approach in consumer protection enforcement.
Your algorithmic risk assessments already include disparate impact testing. If you've built credit decision models, employment screening tools, or targeted advertising systems, you're measuring outcomes across demographic groups. Removing this layer doesn't eliminate the risk; it just blinds you to it.
Consider the reputational risk. A pricing algorithm that charges higher rates in predominantly minority ZIP codes can damage your brand, whether or not the FTC acts on it. Your crisis communications team still needs to explain these outcomes to customers, journalists, and advocacy groups.
From a risk management perspective, disparate impact analysis acts as an early warning system. It identifies problems before they become discrimination lawsuits or PR disasters. The FTC's policy shift doesn't remove the underlying conduct risk.
The Case for Redirecting Resources
On the other hand, you can't defend against every theoretical risk, and compliance resources should follow actual enforcement priorities.
The FTC's reversal indicates a shift in how federal regulators evaluate fairness claims. If the commission that led algorithmic accountability is dropping disparate impact, that's a clue about future enforcement. Your job isn't to maintain controls that regulators no longer prioritize; it's to prevent the violations they're actively pursuing.
Disparate impact analysis is costly. It requires demographic data collection, statistical expertise, ongoing monitoring, and documentation that auditors rarely examine. If you're running SOC 2 Type II audits or ISO/IEC 27001 certifications, disparate impact testing doesn't align with any control objective in those frameworks. You're maintaining a parallel compliance program that doesn't contribute to your certification scope.
Disparate impact claims are difficult to prove and defend. They require complex statistical analysis, expert testimony, and years of litigation. Most organizations settle these cases not because the analysis was flawed, but because the cost of defense exceeds the settlement amount. The compliance investment doesn't actually reduce your litigation exposure.
Your board is asking tougher questions about compliance ROI. When presenting your annual GRC budget, you need to justify every control with a clear risk reduction outcome. "The FTC used to care about this" isn't a compelling answer.
Where Practitioners Actually Land
Most compliance officers aren't making a binary choice. They're adjusting their disparate impact programs based on industry, regulatory exposure, and existing control architecture.
Financial services teams continue robust disparate impact testing because the Consumer Financial Protection Bureau, Office of the Comptroller of the Currency, and Federal Reserve haven't changed their stance. Housing and employment compliance officers maintain their frameworks because HUD and EEOC enforcement patterns haven't shifted.
Technology companies with consumer-facing algorithms are taking a more selective approach. They're preserving disparate impact analysis for high-risk use cases (credit, housing, employment) while scaling back monitoring for lower-risk applications like content recommendation or search ranking.
The common thread is documentation. Even teams that reduce active disparate impact testing are maintaining their analytical frameworks and historical data. If enforcement patterns shift again, they want the ability to demonstrate they considered fairness outcomes, even if they weren't legally required to test for them.
Our Take
Don't dismantle your disparate impact analysis framework, but don't treat it as a federal compliance mandate anymore.
The FTC's policy shift is significant, but it's one agency's position, not a wholesale regulatory retreat. Your exposure to disparate impact claims depends on your industry, product mix, and state-level regulatory environment. A blanket decision to eliminate this analysis ignores those variables.
The smarter move is to tier your approach. Maintain rigorous disparate impact testing for use cases where other regulators still enforce it, where your legal team identifies elevated litigation risk, or where the reputational stakes are high. Scale back monitoring for applications where the FTC was your primary concern and no other enforcement risk exists.
Document your risk-based rationale. If you reduce disparate impact testing in certain areas, your audit trail should show that you evaluated the decision against your regulatory obligations, industry standards, and risk appetite. That documentation protects you if enforcement patterns shift or if you face litigation years from now.
The FTC's reversal doesn't mean fairness stopped mattering. It means the federal enforcement landscape changed, and your compliance program should change with it, thoughtfully and with clear justification for every resource allocation decision you make.
