Skip to main content
Bureau of AI
Category: Fairness & Bias

Protected Characteristics

Also known as: Protected Class, Protected Attributes
Simply put

Protected characteristics are personal traits—such as age, race, sex, religion, or disability—that laws in certain jurisdictions say cannot be used as a basis to discriminate against someone. In an AI context, they matter because automated systems may produce unfair or unlawful outcomes if they treat people differently based on these traits. Which traits are protected, and how, depends on the specific law and country involved.

Formal definition

Protected characteristics (also termed protected classes) are personal attributes that anti-discrimination law designates as impermissible bases for adverse treatment, harassment, or victimization. The specific set and scope are jurisdiction-dependent: under the UK Equality Act 2010, guidance from the Equality and Human Rights Commission identifies nine protected characteristics—age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; sex; and sexual orientation. In the United States, protected characteristics arise from a patchwork of federal, state, and local statutes rather than a single unified list, and protections may be scoped to particular conditions—for example, federal age-discrimination protection under the Age Discrimination in Employment Act (ADEA) applies to individuals aged 40 and older. State frameworks may enumerate additional categories; California's Civil Rights Department, for instance, lists traits such as ancestry, national origin, citizenship, immigration status, and primary language. For AI and model risk practitioners, protected characteristics typically define the sensitive attributes against which disparate treatment or disparate impact is assessed in fairness testing and bias evaluation. This entry states which attributes are protected but does not resolve how any particular AI use case must be tested or remediated, and it does not address non-legally-protected proxy variables; the precise legal obligations depend on the applicable jurisdiction, sector, and statute.

Why it matters

Protected characteristics are the legal reference points against which AI systems are tested for unlawful or unfair discrimination. When an automated system influences decisions about employment, credit, housing, insurance, or access to services, the possibility that it treats people differently based on traits such as race, sex, age, disability, or religion raises direct legal exposure under anti-discrimination law. Because these characteristics define the sensitive attributes examined in fairness and bias evaluation, they shape how organizations scope their testing and what outcomes they must be able to defend to regulators, auditors, and courts.

The stakes are heightened by the jurisdiction-dependent nature of protection. A single unified list does not exist across countries or, in the United States, even across federal, state, and local law. The UK Equality Act 2010 identifies nine protected characteristics, while the United States relies on a patchwork of statutes—and some protections are scoped rather than absolute. For example, federal age-discrimination protection under the Age Discrimination in Employment Act (ADEA) applies to individuals aged 40 and older, not to age discrimination generally. An organization deploying the same model across multiple jurisdictions may therefore face different obligations depending on where affected individuals are located.

Who it's relevant to

Model Risk Managers and Data Scientists
Those building or validating AI systems rely on the applicable jurisdiction's protected characteristics to define the sensitive attributes used in fairness and bias evaluation, including assessments of disparate treatment and disparate impact. They should note that identifying protected traits is a starting point rather than a complete testing methodology, and that proxy variables correlating with protected traits fall outside the enumerated list but may still drive discriminatory outcomes.
Compliance Officers and Legal Professionals
Compliance and legal teams must map which characteristics are protected under each jurisdiction where a system operates, recognizing that no single unified list applies across countries or across U.S. federal, state, and local law. They should account for scoped protections—such as the ADEA's coverage of individuals aged 40 and older—and for state-specific additions like California's inclusion of ancestry, national origin, citizenship, immigration status, and primary language.
AI Governance and Policy Specialists
Those designing organizational oversight for AI systems use protected characteristics to frame non-discrimination policies and testing requirements. Because obligations depend on jurisdiction, sector, and statute, governance frameworks typically need to reflect the differing enumerations—for example, the nine characteristics under the UK Equality Act 2010 versus the U.S. statutory patchwork—rather than assume a single standard applies everywhere.
Auditors
Auditors reviewing AI systems assess whether fairness testing was scoped against the correct set of protected characteristics for the relevant jurisdiction and whether scoped protections were handled appropriately. This entry states which attributes are protected but does not prescribe how any particular use case must be tested or remediated, so auditors should evaluate that testing against the applicable legal requirements rather than a generic checklist.

Inside Protected Characteristics

Legally recognized protected classes
Attributes that anti-discrimination law designates for protection, such as race, color, national origin, sex, religion, age, and disability. The specific list and its scope vary by jurisdiction and by statute, so the enumerated characteristics that apply to a given AI system depend on the applicable legal regime and sector.
Jurisdiction- and statute-specific scope
The boundaries of a protected characteristic are defined by the relevant law rather than by a single universal standard. For example, in the United States age-discrimination protection under the Age Discrimination in Employment Act (ADEA) applies to individuals 40 years and older, illustrating that a protected characteristic may carry statutory thresholds or qualifications rather than covering the attribute in the abstract.
Proxy and correlated variables
Features that are not themselves protected characteristics but are strongly correlated with them (for example, postal code as a proxy for race, or purchase patterns as a proxy for pregnancy). These can lead to disparate outcomes even when protected attributes are excluded from a model's inputs.
Relationship to fairness and bias analysis
Protected characteristics typically serve as the reference dimensions against which disparate treatment or disparate impact is assessed. Note that bias (a systematic deviation in model behavior) and fairness (a normative judgment about acceptable outcomes across groups) are distinct concepts, and protected characteristics feature in the measurement of both without collapsing that distinction.

Common questions

Answers to the questions practitioners most commonly ask about Protected Characteristics.

Are 'protected characteristics' and 'sensitive attributes' the same thing?
Not necessarily. 'Protected characteristics' is typically a legal concept, referring to attributes (such as race, sex, age, religion, disability, or national origin) that anti-discrimination law designates for protection within a given jurisdiction. 'Sensitive attributes' is a broader, often data-governance or machine-learning term that can include those legal categories but may also extend to attributes considered private or high-risk that are not necessarily legally protected. Treating the two as interchangeable can lead teams to under- or over-scope their compliance obligations, so it is important to confirm which framing a given requirement uses.
Does the presence of a protected characteristic in a dataset automatically mean a model is discriminatory?
No. The presence of a protected characteristic as a feature does not by itself establish discrimination, and its absence does not guarantee non-discrimination. Models can produce disparate outcomes through proxy variables that correlate with protected characteristics even when the characteristic itself is excluded. Conversely, in some contexts a protected characteristic may be collected and used for legitimate, permitted purposes such as fairness monitoring. Whether a given use is lawful or problematic depends on the applicable legal framework, the use case, and how the attribute influences outcomes, so this is an assessment rather than an automatic conclusion.
How should teams handle protected characteristics that are not directly present in the data but may be inferred through proxies?
Teams commonly assess whether other features act as proxies that are strongly correlated with a protected characteristic (for example, certain geographic, socioeconomic, or behavioral variables). Approaches often include proxy detection analysis, reviewing feature importance, and testing outcomes across groups. Excluding the protected characteristic alone does not typically address proxy effects, so this analysis is usually treated as a distinct step. The appropriate treatment depends on the applicable legal framework and use case, and organizations frequently document their rationale for how proxies are identified and managed.
Should protected characteristics be collected in order to test a model for bias?
This is a recognized tension. Testing for disparate outcomes across groups generally requires some information about group membership, yet collecting protected characteristics can raise its own legal, privacy, and data-minimization concerns. Organizations often resolve this by consulting legal counsel on what collection is permitted in their jurisdiction and for what purpose, and by considering approaches such as limited-purpose collection, access controls, or, where permitted, inferred or proxy-based methods with their attendant limitations. Because the permissibility varies by jurisdiction and sector, this decision is typically made with legal review rather than as a default engineering choice.
Which protected characteristics apply to a given AI system?
The set of protected characteristics is defined by the applicable legal framework and jurisdiction, and it is not uniform across regions or sectors. Categories, definitions, and thresholds differ; for example, in the United States, age-discrimination protection under the Age Discrimination in Employment Act applies to individuals aged 40 and older, which is a threshold distinct from how other characteristics are treated. Teams typically map their system's deployment jurisdictions and use cases to the relevant laws rather than assuming a single global list, and confirm the applicable scope with legal counsel.
How are protected characteristics documented within a governance and model risk framework?
Documentation practices commonly include recording which protected characteristics are in scope for a given system, the legal basis for that scope, whether the characteristics are used as features or only for monitoring, how proxies are assessed, and what fairness or disparate-impact testing was performed. In many organizations this documentation supports both governance oversight (policies, accountability, and review) and model risk activities (measurement and monitoring of bias-related risk), which are related but distinct functions. Because regulatory expectations vary and continue to evolve, organizations often note the limitations of their analysis and revisit it as laws and use cases change.

Common misconceptions

Removing protected characteristics from a model's inputs eliminates discrimination risk.
Excluding protected attributes does not remove risk, because correlated proxy variables can reproduce or amplify disparate outcomes. Managing this risk requires analysis of proxies and outcomes, not only input suppression.
A protected characteristic covers the entire attribute without qualification.
Coverage can be scoped by statute. In the United States, for instance, the ADEA's age protection applies only to individuals 40 years and older, so the protected status attaches to a defined population rather than to age in general.
The list of protected characteristics is the same everywhere.
The enumerated characteristics, their definitions, and their thresholds differ across jurisdictions and across specific statutes and sectors, so the applicable set must be determined by reference to the governing law rather than assumed to be universal.

Best practices

Identify which protected characteristics apply to your system by reference to the specific statutes and jurisdictions governing its use, including any statutory thresholds such as the ADEA's application to individuals 40 years and older in the United States.
Assess correlated proxy variables in addition to direct protected attributes, since removing protected inputs alone does not manage disparate-impact risk.
Keep the analysis of bias (systematic deviation in behavior) distinct from fairness (a normative judgment about acceptable outcomes) when documenting how protected characteristics are used in testing.
Document the legal basis and scope for each protected characteristic considered, noting where definitions or thresholds are jurisdiction- or statute-specific.
Coordinate with legal and compliance functions to confirm the applicable protected-class definitions before finalizing fairness metrics or acceptance thresholds.
Treat controls around protected characteristics as measures that reduce and manage discrimination risk rather than eliminate it, and revisit them as regulatory treatment evolves.