The Autoriteit Persoonsgegevens imposed a fine of 824,990,000 euros on Uber on 21 August 2026, finding that the company let software decide, without any human involvement, when a driver stopped earning.

The Dutch data protection authority published the decision on 21 August 2026. Its finding is narrow in legal terms and broad in commercial ones: between 2018 and 2022, Uber deployed systems that tracked driving behaviour and customer ratings, and when those systems flagged a suspicion of fraud or a rating judged too low, the affected driver's account was deactivated automatically. Temporary deactivation followed a flag. Persistent low ratings produced permanent removal. In both cases, according to the AP, income from the platform stopped for the duration.

The regulator concluded that this arrangement breached the prohibition on fully automated decision-making under the General Data Protection Regulation, and separately that Uber failed to inform drivers adequately about how those automatic decisions were being taken. The authority states that Uber has since stopped the conduct.

What the regulator found

The mechanism the AP describes is a closed loop. Software monitored two data streams, driver behaviour and rider reviews, and acted on threshold breaches without routing the outcome through a person. There was no human assessment at the point where the consequence attached.

That absence is the entire case. The GDPR does not prohibit scoring drivers, nor does it prohibit deactivating them. It prohibits a decision produced solely by automated processing where that decision carries legal effects or similarly significant consequences for the individual, unless a specific exemption applies and safeguards are in place. Cutting off a person's earnings clears the significance threshold without much argument.

Monique Verdier, deputy chair of the AP, set out the reasoning in the authority's statement: "Uber has committed serious infringements. Drivers were deactivated without pardon. From one moment to the next, they no longer had any income through Uber. That's forbidden. A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being."

The second limb of the decision concerns transparency. The AP found that Uber did not sufficiently inform drivers that automated decision-making was in operation. Under the GDPR, controllers running such systems owe affected individuals meaningful information about the logic involved and about the significance and envisaged consequences of the processing. A notification that an account has been deactivated does not, on the regulator's reading, discharge that duty.

Four years of exposure

The conduct period runs from 2018 to 2022. That window opens in the year the GDPR became applicable and closes four years later. The AP has not published a driver count for the Dutch or wider European population affected, and the decision as summarised does not break the penalty down between the automated decision-making finding and the transparency finding.

How the case travelled from Paris to Amsterdam

The investigation did not begin in the Netherlands. According to the AP, 171 French drivers reported their situation to the Ligue des droits de l'Homme, a French human rights organisation. The LDH then lodged a complaint with the French data protection regulator, the CNIL, acting on the drivers' behalf.

Jurisdiction shifted from there. Uber's European headquarters sit in the Netherlands, which makes the AP the lead supervisory authority under the GDPR's one-stop shop mechanism. The AP conducted the investigation, cooperated with the French regulator throughout, and aligned the final decision with other European supervisors.

That procedural route is familiar. The same 171 French drivers and the same LDH complaint pathway produced the two previous Dutch decisions against the company, in 2023 and again in 2024. A single complaint file, lodged in one member state, has now generated well over a billion euros in nominal penalties through a regulator in another.

How the number was reached

European privacy regulators calculate fines on a common basis, capped at 4% of a company's worldwide annual turnover. Uber's global turnover in 2025 was approximately 44.5 billion euros, according to the AP. That places the statutory ceiling at roughly 1.78 billion euros.

The 824,990,000 euro penalty therefore lands at about 1.85% of turnover, or roughly 46% of the maximum available. It is 2.8 times the 290 million euro fine the AP imposed in 2024 for unlawful transfers of driver data to the United States.

Scale matters here for reasons beyond Uber. National authorities across the European Economic Area issued a combined 1,145,760,374 euros in GDPR fines during the whole of 2025, according to the European Data Protection Board's annual report published on 9 April 2026. This single decision is equivalent to roughly 72% of that figure. The Netherlands recorded 353.4 million euros across 42 enforcement actions in the same year, a total this one penalty exceeds by a factor of more than two.

Uber has filed an appeal.

The fourth fine, and a stack of unresolved appeals

The AP has now fined Uber four times. The sequence runs 600,000 euros in 2018, 10 million euros in 2023, 290 million euros in 2024, and 824,990,000 euros in 2026. The cumulative nominal total is 1,125,590,000 euros. According to the AP, Uber is defending itself against the 2023 and 2024 penalties, and those procedures remain ongoing.

Three of the four decisions are therefore contested at once. That is not unusual. An analysis published in May 2026 found that close to 40% of the 7.1 billion euros in announced GDPR fines has been annulled or is under active legal challenge. Headline figures and collected figures diverge sharply across the regime. A Rome tribunal annulled a 15 million euro penalty against OpenAI on jurisdictional grounds in 2026, and a Luxembourg court sent Amazon's 746 million euro fine back to the regulator. Announcement and outcome are separate events.

Why the decision matters beyond ride-hailing

The AP has spent two years building toward a position on algorithmic decisions, and this fine is the first time it has attached a nine-figure sum to that position.

In March 2025, the authority opened a consultation on what meaningful human intervention actually requires in algorithmic decision-making, arguing in its draft that human assessors must hold genuine authority to overrule an algorithmic outcome and must exercise it when warranted. A rubber stamp does not qualify. In April 2026 it went further, opening a second consultation on the right to an explanation in automated decision-making, a 31-page draft covering the boundary between general and specific explanations and the limits trade secrets can place on disclosure. Days earlier, the AP published survey research showing that nearly two in five Dutch residents did not know they had a right to human intervention when an automated system decides about them.

The Uber decision converts that guidance work into enforcement. It also arrives while the underlying legal text is itself in flux. The European Commission's Digital Omnibus proposal, published in November 2025, would restructure Article 22 from an individual right into a set of permissible processing conditions, explicitly stating that the availability of a human alternative does not prevent a controller from deciding by automated means alone. Had that text been law during the conduct period, the analysis would have looked different.

The pattern across European enforcement

Article 22 has become an active enforcement surface rather than a dormant provision. Austria's data protection authority ruled automated credit scoring indicators unlawful under the article in September 2025. A German administrative court ordered Schufa to explain individual score calculations in November 2025. In August 2026, a Berlin court upheld a supervisory order against a solar firm running automated credit checks before site visits.

The reasoning travels. Any system that assigns a person a score and attaches an automatic consequence to that score sits inside the same analytical frame, whether the consequence is a rejected credit application, a withheld quote, or a switched-off earnings stream. Kenya's data regulator adopted a comparable structure in 2026, requiring a contest mechanism routing to a human with authority to reverse an outcome. The proposed United States SECURE Data Act would require disclosure and an opt-out for profiling that drives decisions on healthcare, housing, or employment, though its drafters left pure advertising profiling outside the trigger.

The advertising dimension

Uber is not only a mobility company. Uber Advertising has been assembling a media business at pace, with a stated target of one billion dollars in annual advertising revenue, and the infrastructure it has built runs on the same first-party signal layer that the AP has now examined from the labour side.

The company opened Journey Ads inventory to programmatic buyers across ten European markets in June 2025. In December 2025 it launched Uber Intelligence on LiveRamp clean room infrastructure, letting brands combine their own customer data with Uber mobility and delivery signals. In June 2026 the company extended first-party signals to Meta and Google Shopping through Offsite Ads, the first time Uber inventory reached beyond surfaces it controls directly, and consolidated campaign management into a single self-serve platform spanning rides and delivery, alongside programmatic Ads APIs for point-of-sale providers and consumer packaged goods brands.

None of that advertising activity is the subject of the AP decision. The relevance is structural. A platform that operates automated systems at scale across two populations, riders and drivers, now carries a regulatory finding that one of those systems produced legally significant outcomes without human review. Compliance attention inside such a company tends not to stay in a single department.

There is a second, more general point for media buyers and platform operators. The automated decision analysis does not depend on whether a system is labelled artificial intelligence. It depends on whether the output attaches a consequence to a person. Bid throttling, account suspension, eligibility screening, and dynamic pricing all fit that description in some configurations. Advertising profiling that merely selects which creative a person sees generally does not, because it lacks the legal or similarly significant effect. The line sits at consequence, not at technology.

Enforcement capacity is the open variable. The EDPB asked the European Commission on 17 July 2026 for a statutory basis allowing regulators across different fields to exchange information, warning that complaint volumes driven partly by artificial intelligence are stretching authorities. Dutch enforcement has historically been sparse in volume: EDPB statistics covering 2018 to 2023 showed the Netherlands imposing fines in 0.03% of cases. Concentration, not frequency, is the Dutch pattern. This decision is consistent with it.

Timeline

Summary

Who: The Autoriteit Persoonsgegevens, the Dutch data protection authority, acting as lead supervisory authority against Uber. Monique Verdier, deputy chair of the AP, provided the authority's statement. The case originated with 171 French drivers who reported to the Ligue des droits de l'Homme, which complained to the CNIL on their behalf.

What: An administrative fine of 824,990,000 euros for violating the GDPR prohibition on fully automated decision-making, and for failing to inform drivers sufficiently about automatic decision-making. Uber has filed an appeal.

When: The conduct ran from 2018 to 2022. The AP published the decision on 21 August 2026. It is the fourth AP fine against Uber, following 600,000 euros in 2018, 10 million euros in 2023, and 290 million euros in 2024.

Where: The Netherlands, where Uber's European headquarters are located, giving the AP lead authority under the GDPR one-stop shop mechanism. The complaint originated in France, and the AP aligned the decision with other European supervisors.

Why: Software tracked driving behaviour and customer reviews and automatically deactivated accounts on fraud suspicion or low ratings, permanently in cases of persistent low ratings, with no human assessment at any point. Drivers lost platform income as a result. The penalty equals about 1.85% of Uber's approximately 44.5 billion euro global turnover in 2025, against a statutory ceiling of 4%.