The Vienna-based privacy group noyb has filed five complaints against Scale AI, alleging that the company’s Outlier platform breaks European data protection law in how it watches the people who train AI models for it.
The complaints, filed on 27 October with regulators in France, Italy, the Netherlands and Austria, accuse Outlier of placing advertising and analytics trackers on workers’ devices and forcing them through repeated face and ID checks. In its announcement, noyb also says Scale AI ignored workers’ requests to see the data held on them. These are noyb’s allegations. No regulator has ruled, and TSN has not seen a response from Scale AI.
In brief
- noyb filed five GDPR complaints against Scale AI on 27 October, two in Austria and one each in France, Italy and the Netherlands.
- It alleges Outlier tracks its AI trainers with third-party trackers and makes them repeat face and ID checks through a company called Persona.
- noyb asks regulators to investigate and suggests fines. Scale AI had not responded publicly when TSN checked.
What noyb says Outlier does
Outlier is a platform where contractors write prompts, rank chatbot answers and correct model output, the kind of work TSN looked at in Training the Trainers. noyb says Outlier has more than 900,000 “freelance” workers, and in a post on X it named Meta, OpenAI, xAI, Google, Anthropic and the US government among Scale AI’s customers.
The group says its technical analysis found trackers from TikTok, LinkedIn, Facebook, the survey tool Sprig and the analytics firm Datadog running while people worked on the platform. “Every few seconds, these trackers send the workers’ personal data to third parties,” noyb says, listing IP addresses, contact details, unique identifiers and the page being viewed.
The Dutch complaint, the only one written in English, gives more detail. It says the complainant recorded network traffic on the platform on 22 May 2026 and found trackers from Fullstory, Sprig, LinkedIn, Posthog, Segment, Run.app and Google. It describes Fullstory as a session replay tool that records mouse movements, clicks and keystrokes, and says it “sends a request every few seconds”.
“Such constant and extensive tracking while working really goes against all reasonable expectations,” said Lisa Steinfeld Leiser, a data protection lawyer at noyb. “Why should LinkedIn or Facebook know which tasks you’re working on?”
The face checks and the unanswered requests
The second complaint concerns identity checks. noyb says workers must upload an ID and record video of their face through Persona, a verification company, and repeat this over time. The Dutch complaint quotes Outlier’s privacy policy, which says that “at regular intervals thereafter, we may collect, store, and analyze images as well as video or audio recordings depicting you”, and use them to “generate information and measurements about your face”.
noyb argues this goes beyond what is needed to prevent fraud. It also points to Persona’s record, saying around 70,000 photos of government IDs stored with Persona were stolen in October 2025. The Dutch complaint adds that Persona lists OpenAI, Groqcloud and Anthropic among its subprocessors.
The third complaint is about access. noyb says Scale AI “didn’t even bother to respond” when complainants asked for their data, which the GDPR requires within a month. In the Dutch case, a follow-up sent on 28 January 2026 also went unanswered, according to the complaint. One aim of that request was to find out whether automated decisions had been made about the worker.
What the regulators are being asked to do
All five complaints cite the same GDPR articles on data minimisation, data protection by default, choosing processors and the right of access. Each also cites the national law that requires consent before trackers are placed on a device. They ask the authorities to declare the breaches, order Scale AI to answer the access requests, investigate its use of automated decision-making and consider a fine.
“Data protection authorities must now take these issues seriously and impose strict enforcement measures,” said Baptiste Delmas, project coordinator at the group Intérêt à Agir. Thomas Le Bonniec, a sociology researcher at DiPLab, said: “Platform work seems to be fertile ground for a whole new type of workplace surveillance.”
Why filing in four countries matters
The choice of five national regulators is deliberate. The Dutch complaint argues that Scale AI is based in the United States and has no main establishment in the EU, so each national authority can act on a complaint from a resident in its country. That sidesteps the GDPR’s “one-stop shop”, which usually routes cases against companies with an EU base to a single lead regulator in the country where that base sits.
It also gives noyb four separate chances at a ruling. The complaints lean on earlier decisions, including an Italian ruling against the delivery app Glovo that, according to the Dutch filing, treated trackers on workers’ phones as surveillance. If even one authority agrees, Scale AI would face a formal finding from an EU regulator.
The case also shifts attention from what goes into AI models to who builds them. Most EU privacy fights over AI have concerned training data and chatbot users, such as the tracker questions Brussels raised about chatbots this month. This one is about the contractors behind the models, a group the GDPR protects as data subjects whether or not they count as employees. Italy has already moved to ban fully automated decisions about workers, and noyb’s request to examine automated decision-making at Outlier points in the same direction.
The limits are real, though. GDPR complaints often take years, and regulators can reject or narrow them. Several of noyb’s points, such as the tracker lists, rest on traffic captures made by the complainants themselves. Scale AI, which publishes its own AI safety research, has not yet answered them in public.
Sources
- noyb: “AI training platform Outlier illegally surveils European platform workers” (27 October 2026)
- noyb complaint to the Dutch Autoriteit Persoonsgegevens, case C109-05 (27 October 2026), PDF
- noyb complaint to France’s CNIL, case C109-01 (27 October 2026), PDF
- noyb complaint to Italy’s Garante, case C109-04 (27 October 2026), PDF
- noyb complaint to Austria’s Datenschutzbehörde, case C109-03 (27 October 2026), PDF
- noyb complaint to Austria’s Datenschutzbehörde, case C109-02 (27 October 2026), PDF
- @NOYBeu on X: announcement thread (27 October 2026)
- @NOYBeu on X: customers named (27 October 2026)
Related stories
- Italy’s New AI Decree Bans Fully Automated Decisions on Workers
- Training the Trainers: How Gig Workers Around the World Are Teaching Robots to Be Human
- AI Policy Roundup: FTC Demands Near, a Kentucky Filing, India’s 30-Day Paper and EU Tracker Questions
- Chatbots Often Spot a Crisis but Don’t Point People to Help, Scale AI’s Own Test Finds
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
