On 27 October the European Centre for Digital Rights, noyb, filed five GDPR complaints against Scale AI in four countries: two in Austria, one each in France, the Netherlands and Italy. The target is Outlier, where more than 900,000 "freelance" workers write prompts, rank answers and label data for clients including Meta, OpenAI and Google. Meta owns 49% of Scale AI.
Nobody alleges a dangerous model here. The allegation is about how a company watches the people who make its product useful, and the law that covers that is the GDPR, in the hands of national data protection authorities. The AI Act, enforced since August, does not reach it.
What the complaints describe
- Up to 19 trackers on the working environment, logging keystrokes and mouse movements every few seconds, per the complaints as reported by Reuters. noyb names trackers from TikTok, LinkedIn, Facebook, the survey tool Sprig and Datadog, sending IP addresses, contact details, persistent identifiers and the page being viewed to third parties.
- A record that can be turned back into video. DiPLab, a Paris research collective that spent two years on the platform, found the resulting file could be rebuilt to replay a session from start to finish.
- Repeated biometric checks. Workers must upload identity documents and a face video to the verification firm Persona, which noyb calls far beyond what is necessary. Persona had roughly 70,000 government ID photos exposed by hackers in October 2025.
- Silence on access requests. Four workers asked Outlier for copies of their data between December 2025 and May 2026. None received an answer, a separate breach of the GDPR's right of access.
- Bonuses as a control mechanism. DiPLab interviewed workers offered $100 to $200 for completing 200 tasks in 24 hours. Italy's data protection authority fined the delivery platform Glovo in 2021 over comparable gamification.
noyb wants the authorities to investigate and fine Scale AI. It also asks them to examine how the platform hands out work, the part with the longer reach: "You don't work when you want," DiPLab's Thomas Le Bonniec told Reuters. "You work when the platform wants you to and there are tasks available."
The awkward part for Brussels
The EU spent four years building an AI rulebook that regulates systems by risk class, and it has nothing to say about the surveillance of the annotators inside the supply chain. The instrument that does bite is older and blunter: a lawful basis, data minimisation, special rules for biometric data, and a right to see your own file.
A newer law overlaps, and the timing is uncomfortable. Directive (EU) 2024/2831 on platform work has a chapter on algorithmic management, with data protection authorities supervising the data-protection side. Member states must transpose it by 2 December 2026. These five complaints land five weeks before that deadline, in front of four of the same regulators who will enforce the national statutes.
What is not established
A complaint is not a finding, and noyb's model is to file early and argue for years. None of the four authorities has opened a formal investigation. Scale AI did not respond to Reuters' request for comment, so the company's position is not on the record beyond its stated rationale for verification: preventing identity fraud and checking workers' skills. The presence of a tracker is not by itself unlawful; lawfulness, consent and necessity are the questions a regulator would have to answer.
The employment question sits to one side: whether those 900,000 people are genuinely freelancers is a separate fight, and these complaints do not depend on the answer. Data protection applies to a contractor's screen exactly as it applies to an employee's.
What to watch
The first regulator to act sets the shape of the case, and Austria is the likely candidate since two of the five complaints are there. Any change to Outlier's tracker stack or to the Persona checks would be an admission of sorts. And 2 December is the date by which the platform-work rules have to exist in national law, in the four countries named.
This post will be updated when a data protection authority opens a file or Scale AI answers publicly.
Sources
- AI training platform Outlier illegally surveils European platform workers — noyb, 27 October 2026, with the French, Italian, Dutch and Austrian complaints
- Privacy group files complaints against Scale AI over alleged worker surveillance — Reuters, 27 October 2026
- Why should Big Tech know what you're working on? Scale AI accused of spying on AI trainers — Euronews with AP, 27 October 2026
- Surveillance at scale: report on AI training platforms — DiPLab
- Directive (EU) 2024/2831 on improving working conditions in platform work — EUR-Lex (transposition by 2 December 2026)
No comments yet