A court let a nationwide age-discrimination collective go forward against Workday's hiring software. Nothing has been proven yet; the case will turn on statistics. Five things an audit would have to measure, and why New York City's bias-audit rule would not measure the one this case is about.
One of the rejections arrived at 1:50 in the morning, "less than one hour after he had submitted his application." It was one of more than 100. Derek Mobley alleges that since 2017 he applied for over 100 jobs, across many industries and employers, and was turned down for all of them. The employers were different. The court put the thing they shared in one sentence: "The common denominator for these positions is Workday, which provided the hiring companies with a platform for application intake and screening."
On May 16, 2025, Judge Rita F. Lin of the Northern District of California let Mobley's age claim go forward as a nationwide collective action. The collective reaches "[a]ll individuals aged 40 and over who, from September 24, 2020, through the present, [] applied for job opportunities using Workday, Inc.'s job application platform and were denied employment recommendations."
That order is preliminary certification, a standard the court called "loosely akin to a plausibility standard." No court has found that Workday's tools screen out older applicants. Workday's position is that it "does not recommend, screen out, or otherwise assess or predict applicants' likelihood of success in a role." What the order does is set up a test. The question is what that test will have to measure.
Mobley sued in 2023. In April 2024 the EEOC filed an amicus brief on his side, arguing that Workday could be liable as an employment agency, an indirect employer or an agent of employers. In July 2024 the court rejected the employment-agency theory, because Mobley had not alleged that Workday "finds employees for employers." It accepted the agent theory: the complaint plausibly alleged that Workday's customers "delegated their traditional function of rejecting candidates or advancing them to the interview stage to Workday."
The court drew the line with an example developers will recognize. If an employer used a spreadsheet to "sort workers by birthdate" and filter out everyone over forty, the spreadsheet vendor would not be liable, "because the spreadsheet is not participating in the determination of which employees to hire." Workday is different, the court said, because its tools "are alleged to perform a traditional hiring function of rejecting candidates at the screening stage." The test is delegation. A tool that executes the employer's own criteria is a tool. A tool that makes the cut on criteria of its own is doing the employer's job. "Drawing an artificial distinction between software decisionmakers and human decisionmakers," the judge wrote, "would potentially gut anti-discrimination laws in the modern era."
The same order dismissed the claims of intentional discrimination and kept the claims of disparate impact. That detail decides everything that follows. A disparate-impact case is won or lost on statistics. The question at trial will not be what anyone intended. It will be what the numbers show.
At the hearing, the judge put a hypothetical to Workday's lawyer. Suppose a vendor knowingly ships a tool that screens out everyone who attended a historically Black college, and the employers using it don't know. Workday's counsel agreed that the employer would have to know what was happening for an intentional-discrimination claim against it to work. The court's conclusion is the clearest statement of the problem I have found: "Without agency liability, it appears that no party would be liable for intentional discrimination in that scenario. This is the very gap that the agency theory is intended to address." Ignoring it, the order goes on, "would allow companies to escape liability for hiring decisions by saying that function has been handed over to someone else (or here, artificial intelligence)."
California's Supreme Court had already reasoned the same way, in its 2023 decision in Raines v. U.S. Healthworks Medical Group. Summarizing that reasoning in a June 2026 order in this case, Judge Lin wrote that "it may well be that the employer has no knowledge of the agent's discriminatory practices," and that "business-entity agents will frequently provide their services to many employers, opening the door to systemic industry-wide discriminatory practices." Liability, the California court had held, belongs with the entity "that is in the best position to implement industry-wide policies that will avoid FEHA violations."
Computer scientists have a name for the structure underneath this case. In 2021, Jon Kleinberg and Manish Raghavan wrote about "algorithmic monoculture, in which many decision-makers all rely on the same algorithm," and showed that converging on one algorithm can "reduce the overall quality of the decisions being made by the full collection of agents," even when that algorithm is more accurate for each one alone. In 2022, Rishi Bommasani and colleagues named the harm to individuals: "outcome homogenization: the extent to which particular individuals or groups experience negative outcomes from all decision-makers." Their benchmarks found that sharing training data "reliably exacerbates homogenization."
Mobley's complaint is outcome homogenization described from the receiving end. And it shows why nobody inside the system could see it. Each employer saw one application from one candidate among many. Only the applicant saw a hundred rejections with one thing in common. The court made the comparison itself: in a traditional case, his data would be like having over one hundred qualified applicants all strike out "for jobs with one employer."
The scale on the vendor's side is enormous. Opposing notice to the collective, Workday offered a figure: "1.1 billion applications were rejected using Workday" during the period at issue. The court called it a "rough estimate" that "ignores the qualifiers in the definition of the collective," so it is not a count of anyone's claims. It is a sense of how many decisions pass through one company's software.
The EEOC's iTutorGroup case was the easy kind. In September 2023 the company agreed to pay $365,000 to settle an EEOC suit alleging that it "programmed their tutor application software to automatically reject female applicants aged 55 or older and male applicants aged 60 or older," turning away "more than 200 qualified applicants." You could prove that case by reading the configuration.
Mobley does not allege a written age rule. The claim is about a learned system whose output may correlate with age. You cannot read that off the code. You have to measure it, and the record shows how many decisions have to be made before measuring is even possible.
First, what counts as "selected." Workday's Candidate Skills Match reports results to employers as "'strong,' 'good,' 'fair,' 'low,' 'pending,' and 'unable to score.'" A selection rate needs a line between selected and not. The court asked the parties the question directly: "Does anything less than a 'strong' CSM score qualify as a denial of a recommendation? How should the results of any other features be measured?" It ordered them to "meet and confer to determine what rank, score, or grouping constitutes a 'recommendation.'" Anyone who has tuned a classifier knows why this matters. A ranking has no disparity until you pick an operating point, and moving the threshold moves the number.
Second, age. The best-known yardstick for biased selection is the four-fifths rule in the federal Uniform Guidelines, which speaks of "any race, sex, or ethnic group." The guidelines say outright that they "do not apply to responsibilities under the Age Discrimination in Employment Act." New York City's bias-audit rule for automated hiring tools computes impact ratios "to compare sex categories, race/ethnicity categories, and intersectional categories." In the text of that rule, "sex" appears 10 times and "age" does not appear at all. A fully compliant New York audit of a tool like this would say nothing about the claim this collective is built on.
Third, the right unit. The court held that whether the tools have a disparate impact on older applicants "is susceptible to common proof … regardless of the degree to which particular employers place weight on those recommendations," and that differences between units do not defeat a case where "the net disparate impact of that unified policy can be proven through statistical evidence." An audit employer by employer could miss what a pooled one would find. New York's rule already imagines pooling. Its own worked example has an employer ask the vendor for an audit, and "[t]he vendor provides historical data regarding applicant selection that the vendor has collected from multiple employers to an independent auditor." It has the right shape for this case and measures the wrong axis.
Fourth, the data. Workday's customers "sign contracts that prohibit Workday from accessing applicants' confidential personal data," with an exception when Workday is under a court order, and Workday's counsel "was unable to confirm what age-correlated data Workday customers collect." To find the collective's members, the court suggested that "graduation year or employment experience will frequently be available to use as a proxy for age." Mobley's résumé, the 2024 order notes, listed his 1995 college graduation. Nothing in the record establishes that the model used graduation year. But the field the court proposes for finding the people who may have been harmed is the kind of field that can leak age into a model.
Fifth, attribution. The spreadsheet line decides who is liable, so the audit has to separate criteria "specifically selected by the employer alone" from the vendor's own tools. In July 2025 the court also brought the AI features Workday acquired with HiredScore inside the case. Attribution is hardest where the plaintiff's theory is sharpest. He alleges that another Workday tool uses machine learning to "observe that a client-employer disfavors certain candidates who are members of a protected class, [and] decrease the rate at which it recommends those candidates." If a model learns an employer's past preferences, whose criteria are they?
Three facts show how open this still is.
The defense to an age disparate-impact claim is "reasonable factors other than age." The employer carries it: "The employer bears the burdens of production and persuasion." Among the factors the EEOC's regulation lists is "[t]he extent to which the employer assessed the adverse impact of its employment practice on older workers." The defense asks about an employer's own assessment of a tool whose applicant data, by contract, its vendor cannot open without a court order.
The circuits disagree about whether job applicants, as opposed to employees, can bring age disparate-impact claims at all. Workday cited en banc decisions from the Seventh and Eleventh Circuits saying they cannot. Judge Lin treated the point as waived and, in any event, followed a Northern District of California decision allowing such claims. Workday pressed the argument again in a later motion, and in a March 6, 2026 order she reached the same conclusion. The same screen rejecting the same 60-year-old may be a claim in San Francisco and not in Chicago.
And the federal enforcer has changed direction. Executive Order 14281, signed April 23, 2025, declared that "[i]t is the policy of the United States to eliminate the use of disparate-impact liability in all contexts to the maximum degree possible." It told agencies to "deprioritize enforcement of all statutes and regulations to the extent they include disparate-impact liability" and ordered the Attorney General and the EEOC's chair to assess "positions taken in ongoing matters" that rely on disparate impact. The certification order came 23 days later. A private collective action is now carrying the theory the government's own enforcer has been told to deprioritize. I could not find whether the EEOC has changed its position in this case.
If you build or buy a system that ranks people, whether for hiring, lending, housing or admissions, Mobley is a preview of the questions you will be asked. Four of them can be answered now, cheaply.
Write down what "selected" means. Pick the operating points at which you will compute selection rates, per score band, and version them with the model. The court had to ask the parties what a recommendation is. Your team should already know.
Measure the axis the law will ask about, not only the one your audit rule lists. Run your impact ratios for applicants over and under forty, even where your mandated audit leaves age out. Under the age law's own defense, the question is whether anyone assessed the impact on older workers.
Put the audit path in the contract. A vendor is the only party that can pool across customers. A customer is the only party that can consent to its applicants' data being used. If the only exception in your contract is a court order, then the first real audit will happen in discovery. Write in a consent path for pooled, privacy-preserving bias audits instead.
Log attribution. Record which criteria the customer configured, which features were switched on, and which model version scored each applicant. The court relied on the fact that Workday "is able to see whether its customers have enabled any AI features." Without that record a disparity cannot be assigned to anyone, which is the gap the court warned about.
A rejection at 1:50 a.m. proves nothing about bias. It does show that the decision was made by something that doesn't sleep, and that the only person in a position to see the pattern was the applicant. An audit designed around those five measurements is how someone else gets that view before a court has to order it.
Sources:
Chain of Consciousness keeps a tamper-evident, dated record in hash-linked entries. Record which criteria a customer configured, which features were switched on and which model version scored each decision, and “whose criteria were they?” has an answer you can verify.
pip install chain-of-consciousness npm install chain-of-consciousness
Or start without installing anything: Hosted Chain of Consciousness.