In the wake of 9/11, law enforcement agencies at the federal, state, and local levels found that they were unable to communicate effectively about potential threats to our national security. In response, the federal government sought to standardize the sharing of terrorism-related information through the adoption of a "Functional Standard." Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, and Tariq Razak (collectively, Plaintiffs) challenged the Functional Standard under the Administrative Procedure Act (APA).1 The district court granted summary judgment in favor of the federal defendants.
We affirm. Although the Functional Standard constitutes final agency action, it was not required to undergo the APA notice and comment procedure, nor was it arbitrary and capricious.
FACTUAL AND PROCEDURAL BACKGROUND
I. Factual Background
In October 2007, President George W. Bush issued a National Strategy for Information Sharing concerning terrorism-related information. The Strategy created fusion centers that would ensure Suspicious Activity Reports (SARs) were "disseminated to and evaluated by appropriate government authorities," and identify requirements to support a "unified process for reporting, tracking, and accessing" SARs. The nationwide effort to standardize this information sharing was called the Nationwide Suspicious Activity Reporting Initiative (NSI).
To "govern[ ] how terrorism information is acquired, accessed, shared, and used," the Program Manager for the Information Sharing Environment (ISE) has issued three Functional Standards since the inception *1183of the NSI, each superseding the previous one: Functional Standard 1.0 (issued January 2008), Functional Standard 1.5 (issued May 2009), and Functional Standard 1.5.5 (issued February 2015).2 The current Functional Standard 1.5.5 focuses "exclusively on terrorism-related information."
The Functional Standard defines suspicious activity as "[o]bserved behavior reasonably indicative of pre-operational planning associated with terrorism or other criminal activity." After receiving a report of suspicious activity, an officer creates a SAR. The SAR then undergoes a two-part evaluation process. An analyst determines whether the SAR meets certain behavioral criteria and has a potential nexus to terrorism.3 If the analyst concludes that it does, the SAR becomes an ISE-SAR, and is uploaded to the eGuardian repository, where it is available to all NSI participants. The ISE-SAR is also input into the Federal Bureau of Investigation (FBI) classified system and sent to the Department of Homeland Security Office of Intelligence Analysis.
Plaintiffs are United States citizens who are the subjects of a SAR or ISE-SAR, none of whom has been charged with a crime. The ISE-SAR on Gill notes his potential access to a "flight simulator type of game," his conversion to Islam, and his "pious demeanor." The FBI visited Gill's sister and questioned her about Gill's religious beliefs. Another SAR describes Razak as a male of believed Middle Eastern descent who "meticulously stud[ied] the entry/exit points" of a train station. After the SAR was uploaded to eGuardian, the FBI questioned Razak. The SAR concerning Ibrahim notes his attempt to purchase "a large amount of computers." Two reports concerning Ibrahim were uploaded to eGuardian.
Private guards prevented Prigoff, a professional photographer, from taking photographs of a work of public art near Boston, an incident resulting in the creation of multiple SARs. The FBI then visited Prigoff's home and questioned a neighbor about him. In northern California, private security stopped Conklin, an amateur photographer, from photographing oil refineries, and during the subsequent questioning, the sheriff's deputies told him he would be placed on an "NSA watch list."
II. Procedural Background
In 2014, Plaintiffs sued the Attorney General, the Department of Justice, and the ISE Program Manager (collectively, the Department). The complaint asserted two APA challenges to the Functional *1184Standard, contending that: (1) the promulgation of the Functional Standard without notice and comment was unlawful; and (2) the Standard was arbitrary and capricious because it did not comply with the "reasonable suspicion" standard in 28 C.F.R. Part 23 for the dissemination of criminal intelligence information.4
The Department moved to dismiss, arguing that Plaintiffs lacked standing, and that the Functional Standard did not constitute final agency action pursuant to the APA. The district court denied the Department's motion.
The parties later cross-moved for summary judgment. The district court granted summary judgment for the Department, finding that: (1) the Functional Standard is a policy guidance statement exempt from the notice and comment requirement; and (2) the Functional Standard is not arbitrary and capricious because it addresses data issues outside the scope of 28 C.F.R. Part 23. Plaintiffs timely appealed.
JURISDICTION AND STANDARD OF REVIEW
We have jurisdiction pursuant to 28 U.S.C. § 1291. We review de novo a district court's grant of summary judgment, and we may affirm on any ground supported by the record. White v. City of Sparks , 500 F.3d 953, 955 (9th Cir. 2007).
ANALYSIS
I. Final Agency Action
The APA allows judicial review only of final agency actions. 5 U.S.C. § 704 ; see Ukiah Valley Med. Ctr. v. FTC , 911 F.2d 261, 266 (9th Cir. 1990). Although it denied the Department's motion to dismiss for lack of finality, the district court observed in its summary judgment order that there was "good reason to treat the Functional Standard as not constituting a final agency action." We review de novo whether agency action is final. Havasupai Tribe v. Provencio , 906 F.3d 1155, 1161-62 (9th Cir. 2018).
For agency action to be final, it must "mark the consummation of the agency's decisionmaking process" and "must be one by which rights or obligations have been determined, or from which legal consequences will flow." Bennett v. Spear , 520 U.S. 154, 177-78, 117 S.Ct. 1154, 137 L.Ed.2d 281 (1997) (internal quotation marks omitted). "We focus on the practical and legal effects of the agency action" and interpret finality in a "pragmatic and flexible manner." Or. Nat. Desert Ass'n v. U.S. Forest Serv. , 465 F.3d 977, 982 (9th Cir. 2006) ; see also Indus. Customers of Nw. Utils. v. Bonneville Power Admin. , 408 F.3d 638, 646 (9th Cir. 2005) (considering any "direct and immediate effect on the day-to-day operations of the party seeking review," and if "immediate compliance with the [action's] terms is expected"). Regardless of an agency's characterization, we consider the actual effects of the action to determine whether it is final. Columbia Riverkeeper v. U.S. Coast Guard , 761 F.3d 1084, 1094-95 (9th Cir. 2014).
The Department does not dispute that the first finality requirement-consummation of the decisionmaking process-is met. Instead, it concentrates on the second Bennett prong, contending the Functional Standard "merely provides procedural guidelines for [agencies'] voluntary participation" and does not impose binding obligations. Plaintiffs counter that the Functional Standard has legal force because the Department can revoke an agency's *1185eGuardian membership for violating the terms of the eGuardian User Agreement, which requires compliance with the Standard. Plaintiffs also assert that compliance with the Functional Standard is a practical requirement of the NSI, and that this "condition on participation" renders the Functional Standard final. We agree; the Functional Standard constitutes final agency action because it has legal and practical effects.
The Functional Standard imposes "direct and appreciable legal consequences." Bennett , 520 U.S. at 178, 117 S.Ct. 1154. In Oregon Natural Desert , we held the Forest Service's issuance of annual operating instructions (AOIs) to permittees grazing livestock on national forest land constituted final agency action under the APA. 465 F.3d at 979. The AOIs outlined restrictions on the permit holder's right to graze. Id. at 980, 986. If a permittee did not comply with the directives in the AOI, the Forest Service could issue a notice of non-compliance and impose administrative sanctions, such as suspension or cancellation of the permit, against the permit holder. Id. at 987-88. We held that the AOIs had legal consequences because the Forest Service could take enforcement actions against a non-complying permittee, imposing "substantial and intricate legal obligations." Id. at 988, 990.
The Functional Standard is not materially distinguishable. To be sure, participation in the NSI remains within the agencies' discretion. And, absent that participation, the Functional Standard does not obligate analysts or agencies to send SAR information or penalize them for sending non-compliant SARs. But, as the Department conceded below, once an agency decides to participate, the eGuardian User Agreement permits the Department to revoke agency membership for violating various policies, including the Functional Standard. Like the suspension of permits in Oregon Natural Desert , 465 F.3d at 988, eGuardian membership revocation is a legal consequence.
The Functional Standard is also final agency action because of its practical effects. In Havasupai , we held a Forest Service Mineral Report was a "practical requirement to the continued operation" of a mine-and therefore final agency action-because the parties "understood that mine operations would not resume until" the Mineral Report's determination of valid existing rights "was completed." 906 F.3d at 1163. An agency action can be final even if its legal or practical effects are contingent on a future event. See Bennett, 520 U.S. at 170, 117 S.Ct. 1154 (noting an agency could "technically" disregard the issued opinion, but to do so would subject it or its employees to "substantial civil and criminal penalties, including imprisonment"); City of Fremont v. F.E.R.C. , 336 F.3d 910, 914 (9th Cir. 2003) (concluding agency orders that attach legal consequences to future proceedings satisfy the finality analysis).
Similarly, because the eGuardian User Agreement permits the Department to revoke participating agencies' access for failure to comply with the Functional Standard, once an agency joined the NSI there was the immediate understanding that its analysts would conform to the Functional Standard when submitting SARs. Thus, we hold the Functional Standard constitutes final agency action.
II. Notice and Comment Procedure
The APA requires a notice and comment procedure for agency "rule making."5 5 U.S.C. § 553. However, "interpretive *1186rules, general statements of policy, or rules of agency organization, procedure, or practice" are exempt from the notice and comment requirement. 5 U.S.C. § 553(b)(3)(A). The district court found the Functional Standard was "fundamentally a policy guidance statement" and therefore not subject to the notice and comment requirement. We review de novo the district court's determination of the scope of the APA's notice and comment requirement. Mada-Luna v. Fitzpatrick , 813 F.2d 1006, 1011 (9th Cir. 1987).
Legislative rules have the "force of law," and are subject to notice and comment under the APA before becoming effective Hemp Indus. Ass'n v. Drug Enf't Admin. , 333 F.3d 1082, 1087-88 (9th Cir. 2003). Policy guidance statements, on the other hand, "do not have the force and effect of law and are not accorded that weight in the adjudicatory process," see Shalala v. Guernsey Mem'l Hosp. , 514 U.S. 87, 99, 115 S.Ct. 1232, 131 L.Ed.2d 106 (1995), and need not undergo notice and comment. "The critical factor to determine whether a directive announcing a new policy constitutes a legislative rule or a general statement of policy 'is the extent to which the challenged [directive] leaves the agency, or its implementing official, free to exercise discretion to follow, or not to follow, the [announced] policy in an individual case.' " Colwell v. Dep't of Health & Human Servs., 558 F.3d 1112, 1124 (9th Cir. 2009) (second and third alterations in original) (quoting Mada-Luna , 813 F.2d at 1013 ). That a policy "provid[es] direction-where once there was none"-does not automatically transform it into a legislative rule. Prof'ls & Patients for Customized Care v. Shalala , 56 F.3d 592, 600-01 (5th Cir. 1995).
Plaintiffs contend the Functional Standard is a legislative rule because it creates a "binding norm" by establishing sixteen exclusive categories the agencies must use in defining suspicious activity. The Department responds that the Functional Standard is not a legislative rule because it provides only standardized guidance that does not have any legal effect. Although we "need not accept the agency characterization at face value," Hemp Indus. , 333 F.3d at 1087, we agree with the Department that the Functional Standard is not a legislative rule because it allows analysts to exercise discretion.
SARs undergo a two-part evaluation before being included in eGuardian. First, an FBI or fusion center analyst "reviews" the SAR information against the sixteen pre-operational behaviors identified in the Functional Standard, "keeping in mind ... the importance of context, facts, and circumstances." If the SAR information reflects one or more of the pre-operational behaviors, then, based on the "context, facts, and circumstances," the analyst uses "professional judgment" to determine whether the information has a potential nexus to terrorism. Only if-in the analyst's judgment-a potential nexus to terrorism exists is the SAR disseminated as an ISE-SAR.
While the Functional Standard employs a combination of mandatory and discretionary language, it does not compel analysts or agencies to disseminate SAR information, nor does it require analysts to create an ISE-SAR when the information reflects a certain number of behavioral categories. Rather, if the SAR contains at least one of the categorized activities, the analyst must still ascertain whether it has a potential nexus to terrorism. No single category of behavior or aggregation of categories is determinative.
The Functional Standard is thus similar to the Food & Drug Administration's policy guide at issue in Professionals and Patients for Customized Care . The FDA promulgated a policy utilizing nine factors *1187to help the agency determine whether to initiate an enforcement action against a pharmacy engaged in drug manufacturing. 56 F.3d at 593. In holding that the policy did not constitute a legislative rule, the Fifth Circuit noted that although the nine factors "assist[ed] the FDA in identifying pharmacies engaged in the manufacture of drugs," the "ultimate decision whether to bring an enforcement action" remained with the agency. Id. at 601. Likewise, the Functional Standard aids agencies in determining whether an individual is engaged in suspicious activity, but the final decision to disseminate an SAR rests in the analyst's discretion.
This significant discretion retained by agencies and their analysts in determining whether to disseminate information compels our decision that the Functional Standard is not a legislative rule. Therefore, the Functional Standard was exempt from the notice and comment requirement.
III. Arbitrary and Capricious
Agency action violates the APA if it is arbitrary or capricious. 5 U.S.C. § 706(2)(A). Plaintiffs argue that the Functional Standard is arbitrary and capricious because it is inconsistent with the "reasonable suspicion" standard for disseminating criminal intelligence information in 28 C.F.R. Part 23 (Part 23). On summary judgment, the district court rejected that argument. We review the district court's decision de novo. Nat'l Ass'n of Home Builders v. Norton , 340 F.3d 835, 840-41 (9th Cir. 2003).
Pursuant to Part 23, criminal intelligence systems can retain criminal intelligence information "only if there is reasonable suspicion that the individual is involved in criminal conduct or activity." 28 C.F.R. § 23.20(a) (emphasis added). Part 23 defines criminal intelligence information, in pertinent part, as "data which has been evaluated to determine that it: (i) is relevant to the identification of and the criminal activity engaged in by an individual who or organization which is reasonably suspected of involvement in criminal activity." Id. § 23.3(b)(3). The Functional Standard, in contrast, defines suspicious activity as "[o]bserved behavior reasonably indicative of pre-operational planning associated with terrorism or other criminal activity." (emphasis added). Consequently, some SARs-including those related to Plaintiffs-do not reach the reasonable suspicion standard that Part 23 requires for criminal intelligence.
Plaintiffs' arbitrary and capricious challenge is twofold. They contend that: (1) the Department initially failed to consider the applicability of Part 23; and (2) the rationale eventually offered for why Part 23 does not apply contradicts the record.
Several principles guide our analysis. An agency must "examine the relevant data and articulate a satisfactory explanation for its action including a 'rational connection between the facts found and the choice made.' " Motor Vehicle Mfrs. Ass'n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co. , 463 U.S. 29, 43, 103 S.Ct. 2856, 77 L.Ed.2d 443 (1983) (quoting Burlington Truck Lines, Inc. v. United States , 371 U.S. 156, 168, 83 S.Ct. 239, 9 L.Ed.2d 207 (1962) ). A rule is arbitrary and capricious if the agency has "entirely failed to consider an important aspect of the problem, [or] offered an explanation for its decision that runs counter to the evidence before the agency." Id . Our review of an agency decision "is based on the administrative record and the basis for the agency's decision must come from the record." Norton , 340 F.3d at 841. That review is "narrow;" we may not "substitute [our] judgment for that of the agency." FCC v. Fox Television Stations, Inc., 556 U.S. 502, 513, 129 S.Ct. 1800, 173 L.Ed.2d 738 (2009). And, we will "uphold a decision of *1188less than ideal clarity if the agency's path may reasonably be discerned." Motor Vehicle , 463 U.S. at 43, 103 S.Ct. 2856.
First, Plaintiffs challenge the ISE's July 2010 explanation concerning Functional Standard 1.5's use of the "reasonably indicative" standard as a post-hoc rationalization. But, Functional Standard 1.5.5, promulgated in February 2015, superseded version 1.5. The Executive Summary for version 1.5.5 provided a detailed explanation for why SAR information need not comply with Part 23 and the reasonable suspicion standard. Thus, Plaintiffs' argument concerning the Department's 2010 explanation for Functional Standard 1.5 is moot.
Second, Plaintiffs argue that the ISE's 2015 explanation is inconsistent with Functional Standard 1.5.5. The 2015 explanation states that SAR information "represents information about suspicious behavior" and "has a potential criminal nexus." In contrast, it asserts that criminal intelligence "focuses on the investigative stage once a tip or lead has been received and on identifying the specific criminal subject(s), the criminal activity in which they are engaged, and the evaluation of facts to determine that the reasonable suspicion standard has been met." Succinctly, according to the 2015 explanation, criminal intelligence is "a product of investigation."
The Department asserts that its interpretation of Part 23 is entitled to Auer deference, which requires an agency's interpretation of its own ambiguous regulation to control unless "plainly erroneous or inconsistent with the regulation." Turtle Island Restoration Network v. U.S. Dep't of Commerce , 878 F.3d 725, 733 (9th Cir. 2017) (quoting Auer v. Robbins , 519 U.S. 452, 461, 117 S.Ct. 905, 137 L.Ed.2d 79 (1997) ). "But Auer deference is warranted only when the language of the regulation is ambiguous." Christensen v. Harris Cty. , 529 U.S. 576, 588, 120 S.Ct. 1655, 146 L.Ed.2d 621 (2000). If the language of a "regulation is unambiguous, we apply the terms as written." Christopher v. SmithKline Beecham Corp. , 635 F.3d 383, 392 (9th Cir. 2011). The Department identifies no ambiguity in Part 23, and we find none. Thus, we independently determine whether the ISE's decision to exclude the Functional Standard from Part 23's scope is consistent with the regulation.
Plaintiffs focus on the one sentence in the Department's explanation of Functional Standard 1.5.5, which states that Part 23 "[c]riminal intelligence information is a product of investigation." They argue that SARs are also criminal intelligence subject to the reasonable suspicion standard of Part 23 because an official conducts "initial investigation or fact gathering" before creating a SAR. That narrow focus distorts the ISE's explanation.
As originally conceived in October 2007, SARs involved "tips and leads" information, that is, an "uncorroborated report or information that alleges or indicates some form of possible criminal activity." Tips and leads required only "mere suspicion," a lower standard than the reasonable suspicion required for criminal intelligence data. In response to concerns regarding Functional Standard 1.0, version 1.5 implemented a somewhat stricter standard-"reasonably indicative"-albeit one still less demanding than the reasonable suspicion standard. Given the lower reasonably indicative standard utilized by the Functional Standard, some SARs do not rise to the level of criminal intelligence. This lower threshold underscores the purpose of ISE-SARs disseminated in accordance with Functional Standard 1.5.5: to determine whether to engage in "follow-up information gathering" about potential terrorist activity, not necessarily to determine whether a crime has occurred.
*1189The distinction between criminal intelligence and SAR information is admittedly not always precise. The ISE Program Manager early on recognized the potential for SARs to contain criminal intelligence subject to Part 23. Thus, the ISE's Initial Privacy and Civil Liberties Analysis of September 2008 stated, "agencies should clearly articulate when 28 C.F.R. Part 23 should be applied .... ISE-SAR information ... may be subject to the requirements of 28 C.F.R. Part 23." Further, an investigating officer "gathers additional facts through personal observations, interviews, and other investigative activities before creating a SAR, suggesting that the "product of investigation" phrase is not dispositive of whether SAR information comes within the ambit of Part 23.
"We will ... uphold a decision of less than ideal clarity if the agency's path may reasonably be discerned." Motor Vehicle , 463 U.S. at 43, 103 S.Ct. 2856. From the outset, the ISE has consistently pronounced that an ISE-SAR need not meet the reasonable suspicion standard in order to expand the base of information gathered. The 2015 explanation, published with Functional Standard 1.5.5, also makes clear that the government intentionally seeks more than reports showing a reasonable suspicion that terrorism-related crimes have occurred. Considering the entirety of the 2015 rationale and the historical explanations before us, we find the Department's decision to exclude SARs from Part 23 is not contrary to the record, and is consistent with the stated objectives of the NSI. Accordingly, we hold that the Functional Standard was not arbitrary and capricious.
CONCLUSION
The Functional Standard endeavors to standardize terrorism-related information sharing nationwide. Although the Functional Standard constituted final agency action, it was not a legislative rule because it requires significant analyst discretion. It therefore was exempt from the notice and comment requirement. And, the Standard was not arbitrary and capricious because the ISE's 2015 explanation distinguishing Part 23 information and SARs is consistent with the ISE's objectives. We affirm the judgment of the district court.
AFFIRMED.