The consequence that matters most is one families almost never anticipate. 12 CFR 1026.12(b)(1)(i) defines unauthorized use as "the use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit." An authorized user has actual authority by definition. So their charges are not unauthorized use, and the liability cap at 1026.12(b)(1)(ii), which limits a cardholder's exposure for unauthorized use to the lesser of $50 or the amount obtained before notifying the issuer, has nothing to attach to. The account holder owes the full amount, whatever the user was told they could spend, and revoking the authority stops future transactions rather than reversing past ones.
That is the risk running from the user to the account holder. In the other direction the position is more comfortable. The Bureau's guidance is direct: "No, being an authorized user generally does not obligate you to pay the debt." It adds two practical points for anyone being pursued for a balance on an account they merely used. "Credit card issuers usually report authorized users' status to the credit bureaus," and that status shown on your own credit report is itself the evidence to hand a collector; you may also ask a collector insisting you cosigned to produce a contract you signed.
What the arrangement does for the user's credit file, stated only as far as it can be verified. The account can appear as a tradeline in the authorized user's own file, because issuers generally report the status. What each scoring model then does with an authorized-user tradeline is proprietary to the model developer, and the developers publish anti-abuse logic no more than they publish the models themselves. So the honest position has two halves. It is verifiable that the account can appear in the user's file and that its history and balances come with it. It is not verifiable that the tradeline counts the same as an account of the user's own, and claims either way about how a model treats it are claims about internals nobody outside the vendor can inspect. The practice of adding strangers to accounts for a fee has its own name and its own page, piggybacking credit.
What is verifiable, and worth acting on, is that the tradeline arrives as the account actually is. A long-standing account with a low reported balance brings that record; the same account carrying a large balance brings that instead. The arrangement inherits behavior, not merely age.
The under-21 route is why this term carries a family topic. 12 CFR 1026.51(b)(1) provides that a card issuer "may not open a credit card account under an open-end (not home-secured) consumer credit plan for a consumer less than 21 years old" unless the consumer has submitted a written application and the issuer has either financial information showing an independent ability to make the required minimum payments, or a signed agreement from a cosigner, guarantor or joint applicant at least 21 years old who has that ability. Adding a young person as an authorized user is not opening an account for them, so none of that applies. It is the ordinary way a parent gets a card into a teenager's hands and a tradeline into their file, and it works because it sits entirely outside the rule.
Two adjacent details complete the picture. Where an account was opened on a young consumer's own financial information, 1026.51(b)(2)(i) bars a credit limit increase before they turn 21 unless they independently qualify at that point; where it was opened on the cosigner route, 1026.51(b)(2)(ii) requires that person's written agreement to assume liability on the increase. And issuers set their own minimum ages for authorized users, which is a term of the agreement rather than anything in the regulation, so it is worth confirming before assuming a young child can be added.
A different mechanism exists for spouses specifically, under Regulation B: a creditor furnishing credit information must designate a shared account to reflect both spouses' participation, and must do so on an existing account within 90 days of a written request. That is spouse-specific and is covered on the credit history page. It is not a general authorized-user route.