Updated October 28, 2026
WANDERTECH. Tech News
Privacy
5 min readWandertech Team

Privacy Group Files Five GDPR Complaints Against Scale AI Over Its Outlier Platform

noyb alleges Outlier, a platform for AI-training freelancers, tracks and profiles its workers unlawfully. Scale AI calls the claims unfounded. Here is what is alleged and what is not yet decided.

Key facts: GDPR complaints filed by noyb on 27 October, 5; Countries where they were filed: France, Italy, Netherlands, Austria, 4; Freelance workers on Outlier, as reported by noyb, 900,000+; Regulator findings so far on the allegations, None yet.

The people who label data for AI systems are an unseen part of the industry, and a privacy group alleges they are being monitored unlawfully. On 27 October 2026, the group noyb filed five complaints under Europe’s data protection law, the GDPR, against Scale AI, which runs a platform called Outlier. Scale AI rejects the allegations. No regulator has ruled on any of them.

A note on method: this story is about allegations, so we separate three things throughout: what the complaints claim, what Scale AI says in response, and what has actually been established. Facts come from noyb’s own release, Reuters reporting republished by Global Banking & Finance Review, and Tech Times. Analysis is labelled as ours.

What happened

According to noyb’s release, it filed the complaints together with three partner organisations, Intérêt à Agir, DiPLab and Reversing.Works. Five complaints were lodged in four countries: France, Italy, the Netherlands and Austria, with two of them in Austria. noyb says Outlier, which uses freelancers to produce data for training AI models, has more than 900,000 workers, a figure it presents as reported rather than confirmed. noyb asks the authorities to investigate and to impose a fine.

What the complaints allege

Everything in this section is an allegation from noyb and its partners.

  • Third-party trackers. noyb says its technical analysis found trackers from TikTok, LinkedIn, Facebook, Sprig and Datadog running on workers’ devices while they use the platform, sending personal data such as IP addresses and unique identifiers to those companies every few seconds. It argues that Scale AI has no legal basis for this and did not obtain consent. Reuters and Tech Times, citing the DiPLab investigation, put the number of trackers at up to 19, and Reuters adds that they record keystrokes and mouse movements, which could be used to reconstruct a work session. noyb’s own release, as we read it, names five trackers.
  • Repeated biometric checks. noyb says workers are repeatedly required to complete identity verification through a vendor called Persona, including face video and ID uploads, and that this goes further than necessary. It also points to an incident in October 2025 that it says exposed about 70,000 government ID photos held by Persona.
  • Unanswered access requests. Under the GDPR, people can ask a company for a copy of the data held about them. Reuters and Tech Times report that four workers made such requests between December 2025 and May 2026 and received no reply.

What Scale AI says

In a response reported by Reuters on 28 October, Scale AI said the claims are “unfounded and inaccurate.” It said its practices are disclosed to workers and require their consent, and that its monitoring measures serve identity checks, fraud prevention, protection of confidential projects and accurate payment. It said an optional tool that records time and screen activity is used on some projects and must be switched on by the worker, and that it does not sell workers’ personal data or use it to train customers’ models. noyb’s release records the company’s explanation that the biometric checks prevent identity fraud and verify skills, and noyb disputes that they are necessary.

Tech Times adds one observation of its own, which we have not verified: that Outlier’s screen-monitoring privacy notice, dated 19 August 2026, cites “legitimate interests” rather than consent as its legal basis, which the outlet says sits awkwardly with Scale AI’s statement about consent.

What has been established

Nothing yet. Tech Times notes that no violation has been determined and that complaints like these start an investigation that can take months or years. The GDPR allows fines of up to €20 million or 4% of a company’s global annual turnover, whichever is higher, according to Tech Times. Whether any fine results is unknown.

Background

The GDPR requires that personal data be collected only for a clear purpose and in the minimum amount needed, that tracking technologies generally rest on a valid legal basis such as consent, and that people can see their own data. noyb is a privacy advocacy group, and complaints like these are filed with national regulators, who decide whether to investigate. This case is about data protection, not about wider working conditions.

Why it matters

For the AI industry. AI models rely on large amounts of human-produced data, and the platforms that supply it rely on large freelance workforces. This case asks what those platforms may collect about their workers. A regulator’s answer, whenever it comes, could set expectations for the whole sector.

For software teams (our analysis). The allegations are a useful checklist for any product, not just this one. Do you load third-party trackers or SDKs, and can you show you have a legal basis for each? Do you collect biometric or ID data, and is each request necessary and proportionate? Can you answer a data-access request within the deadline? These are questions every team handling European users’ data should be able to answer, regardless of how this particular case ends.

Different perspectives and risks

  • Both sides have an interest. noyb is an advocacy group seeking enforcement. Scale AI is a company defending its practices. Neither is a neutral finder of fact.
  • The details differ between sources. The tracker count (five named, up to 19 reported), and exactly which allegations appear in noyb’s release versus in secondary reporting, vary by outlet. We have attributed each claim to where we found it.
  • Regulators may disagree with noyb, narrow the complaints, or find that Scale AI’s practices are lawful.
  • We have not seen the complaints themselves, only noyb’s release and press coverage.

What to watch next

  • Whether the national regulators open investigations, and in which country the lead case lands.
  • Any further response from Scale AI, including changes to its privacy notices or tools.
  • Whether other AI-data platforms face similar scrutiny from regulators or advocacy groups.

The bottom line

The complaints raise a serious set of questions about how an AI-training platform treats the people who work on it, and Scale AI gives a detailed answer. Between those two accounts lies an investigation that has not started. Until a regulator rules, the fair summary is that these are allegations, and that the answers could shape how the industry handles its own workforce’s data.

Sources

All stories →