Scale AI faces 5 GDPR complaints over tracking of Outlier AI trainers

Privacy group noyb on October 27, 2026 filed five complaints against Scale AI, the US company behind the AI training platform Outlier, alleging that it tracks its freelance workers with advertising and analytics tools, puts them through repeated biometric identity checks run by the verification firm Persona, and leaves their requests for their own data unanswered. The complaints went to data protection authorities in France, Italy and the Netherlands, and two went to Austria. They are allegations: no regulator has ruled on them. Scale AI told The Register that the report's claims are unfounded and inaccurate, and that Outlier's practices are disclosed to contributors and require their consent.

In Short

People who teach AI chatbots by rating their answers on a website called Outlier say the site watched them closely while they worked, passed details about them to companies such as TikTok, LinkedIn and Facebook, and made them scan their faces again and again. A privacy group called noyb has asked regulators in four European countries to investigate Scale AI, the American company that runs Outlier, and to consider fining it. The tracking tools in question are the same ones advertisers put on their own websites, so the case tests whether they can run on a work platform without the worker's consent. Nothing has been decided yet, and Scale AI says the claims are wrong.

Five complaints, four countries, one defendant

noyb - European Center for Digital Rights, the Vienna-based non-profit, filed the complaints with the support of three partners: the French association Intérêt à Agir, the Digital Platform Labor research programme DiPLab, and the security research collective Reversing.Works. Each complaint is brought on behalf of an individual Outlier worker, whom noyb represents under Article 80(1) of the GDPR. The names, addresses and several dates are redacted in the published versions.

The filings carry noyb case numbers C109-01 to C109-05. The French complaint (C109-01) went to the Commission nationale de l'informatique et des libertés (CNIL) in Paris. The Italian one (C109-04) went to the Garante per la Protezione dei Dati Personali in Rome, the Dutch one (C109-05) to the Autoriteit Persoonsgegevens in The Hague. Two Austrian complaints (C109-02 and C109-03) went to the Datenschutzbehörde in Vienna. All are dated October 27, 2026, and all name a single respondent: Scale AI, Inc., 650 Townsend Street, San Francisco.

Why four countries and not one lead authority? According to the complaints, Scale AI is established in the United States "with no principal place of business in the European Union," as the Dutch filing puts it. Without a main establishment in the EU, the GDPR's one-stop-shop mechanism does not channel the cases to a single lead regulator. Each complainant therefore lodged a complaint under Article 77 in the country where they live and work.

The complaints share one structure and three grievances. The first concerns trackers placed on workers' devices. The second concerns biometric verification through Persona. The third concerns access requests that, according to noyb, Scale AI never answered.

Lisa Steinfeld Leiser, data protection lawyer at noyb, put the tracking claim this way in the group's announcement: "Such constant and extensive tracking while working really goes against all reasonable expectations. Why should LinkedIn or Facebook know which tasks you're working on?"

Scale AI, Outlier and the people who train AI

Outlier is a data annotation marketplace. Workers, classed as independent contractors rather than employees, are paid by the task to write prompts, rank chatbot answers or correct model output in fields such as coding, physics and mathematics. According to noyb's announcement, Outlier has more than 900,000 "freelance" workers. noyb names Meta, OpenAI, xAI, Google, Anthropic and the US government among Scale AI's customers. The complaints themselves cite Meta, OpenAI and X.ai as clients.

The government link noyb draws is to a May 6, 2026 Scale AI announcement that the US Department of War's Chief Digital and Artificial Intelligence Office had raised the ceiling of its enterprise agreement with the company from $100 million to $500 million.

Ownership matters to the tracking allegations. Meta bought 49% of Scale AI in June 2025, and PPC Land reported at the time that the $14.8 billion deal exposed antitrust vulnerabilities and that OpenAI, Microsoft and xAI were scaling back their work with Scale after Alexandr Wang moved to Meta. The DiPLab report that accompanies the complaints puts Meta's investment at $14.3 billion in its introduction and at 14.5 billion dollars in its executive summary. Whatever the figure, the report draws a direct line from the ownership to the pixels: "Meta owns Facebook and holds a significant stake in Outlier. This raises concerns about the concentration of workers' data and its impact on their rights."

The complaints describe the workflow in plain terms. A client sends data to Scale AI. Scale, "using algorithms", assigns an individual a task related to that data. The platform then reviews errors and assigns another individual to correct them and confirm the quality of the work. Workers get a notification when a task is assigned and have a limited time to complete it, after which the hourly rate falls.

Thomas Le Bonniec, sociology researcher at DiPLab, said in noyb's announcement: "Platform work seems to be fertile ground for a whole new type of workplace surveillance. This would be seen as unacceptable in any other form of employment in the European Union. This system only thrives because of its deliberate lack of transparency."

What the complainants did on Outlier

The five complainants span very different levels of activity, from a handful of tasks to several hundred.

The tasks described are typical of AI model evaluation: comparing conversational AI models by rating the answers an LLM gives to a prompt. The French complainant, after receiving no further work after April 2025, kept logging in at intervals, either to wait for new tasks or to use Playground AI, a service on Outlier that lets workers interact with models including Grok and Gemini.

What the browser logs show

Each complainant recorded the traffic between their browser and Outlier as one or more HAR files, a log format available in any browser's developer tools that captures every request a web page makes. The complaints attach these logs as evidence and describe the method in a separate annex. The traffic was recorded on May 22, 2026 for the Dutch complainant and on July 8, 2026 for one of the Austrian complainants. The other dates are redacted.

The lists of third parties differ by complaint. The Dutch log shows seven: Fullstory, Sprig, LinkedIn, Posthog, Segment, Run.app and Google. The French one shows eighteen: Fullstory, Sprig, LinkedIn, TikTok, Facebook, Posthog, Segment, Quora, Forethought, Sentry, Snapchat, Run.app, Twitter Analytics, Google Analytics, Recruitics, Withpersona, Amplitude and Featureassets. noyb's announcement also names the data analysis company Datadog, which appears in the second Austrian complaint.

According to noyb's announcement, "Every few seconds, these trackers send the workers' personal data to third parties. This includes IP addresses, contact details, unique identifiers and information about the visited page." The complaints are more specific about which tool does what.

Social media pixels

The French complaint gives the most detailed account of the Facebook tracker. According to that filing, its requests assign the complainant a unique identifier labelled "workerTeamId", attach a project identifier ("projectId"), record whether the complainant has been assigned a task - in this case, no - and explain why: no task matched the complainant's expertise. The tracker also carries identifiers that, according to the complaint, allow Meta to associate website visits with users' browsers, "which is generally used for targeted advertising."

The DiPLab report adds detail from its own analysis. LinkedIn pixels fire when a worker clicks the "Start task" button, "which can give Linkedin an idea of when they start working, which task they are working on, and for how long." A TikTok pixel "is fetched for every data worker", with a unique ID attached to each worker "regardless of whether they are also logged into a TikTok account on the same browser session." The Facebook pixel, the report says, "collects information on the tasks they are working on, (e. g. hourly rate, project associated with a task, etc.)."

Snapchat, Twitter Analytics and Quora complete the advertising set in the French and first Austrian complaints. The Dutch complaint states the objection directly: "the purposes pursued by the Platform are completely distinct from those of social media platforms. It is therefore all the more difficult to establish the usefulness of tracking, let alone its necessity." For a marketer, the list reads like the standard conversion-tracking stack of a consumer website. Here it runs on the pages where people do paid work.

Session replay, surveys and support bots

Fullstory, which the complaints describe as a session replay tool that records mouse movements, clicks and keystrokes, sends a request every few seconds. According to the French complaint, it logs the number of tasks available and completed. Fields labelled "SetNodeAttribute" and "SetInputValue" indicate what is typed into form fields, while "PointerEvent / NetworkReq" track cursor movements and network requests. The DiPLab report says Fullstory lets Outlier's management "closely monitor workers' activity, almost in real time."

That detail connects to a live regulatory file. In February 2026, France's CNIL put session replay tools under the privacy microscope with a draft recommendation calling for prior consent, sampling and masking by default. The complaints cite that draft directly, arguing that Outlier could have used session replay only occasionally and at random, masked or hashed inputs, or avoided unique identifiers.

Sprig, a survey tool an employer can use to poll its staff, collected data even though none of the complainants was answering a survey. According to the Dutch complaint, the tracker collected the complainant's "full name, phone number, email address, unique identifiers, device information, pay information and page visited." The Italian complaint says that for other data subjects Sprig also collected payment information.

Forethought, a US company that builds AI customer support agents, received a unique identifier ("data-ft-corp-user-id"), first name, surname and email address, according to the French and Austrian complaints. In the two Austrian logs, the tracker also recorded which page the worker was on: "marketplace" in one case, "earnings" in the other. The DiPLab report says workers' personal data was sent to Forethought, "likely to train and tune Outlier's own support bot."

What the logs do not establish

The complaints show what data left the browser and where it went. They do not show what Meta, LinkedIn, TikTok or the analytics vendors did with it, or whether Outlier used any of it for advertising. The French complaint notes that Outlier's cookie policy refers to profiling and targeted advertising purposes, and the DiPLab report says Outlier recruits through social media, including LinkedIn, Instagram and Facebook. The step from transmission to use is an inference the regulators would have to test.

The pattern is not unique to Outlier. In October 2026, PPC Land reported that six of nine AI chatbots passed chat titles or links to trackers, with Datadog and Sentry among the recipients named by IMDEA Networks researchers.

The biometric checks

To open an Outlier account, each complainant had to verify their identity through Persona, a service run by Persona Identities Inc. According to the complaints, they uploaded an identity document and then switched on the camera of their phone or computer to record a video of themselves. The verification was then repeated at irregular intervals.

The Dutch complaint quotes Outlier's privacy policy on the point: "(...) when you sign up to use the Services, and at regular intervals thereafter, we may collect, store, and analyze images as well as video or audio recordings depicting you - including selfies and images of your official ID - and use those images and recordings to check your skills or generate information and measurements about your face ("Verification Data"), which may be considered "biometric" data or "sensitive" data under the laws of some jurisdictions". The stated purpose, per the same policy, is "to help preserve the integrity of the Services and combat fraud."

Workers interviewed for the DiPLab report described the routine. "I need to re-identify myself really really often through that external platform where they scan my face to verify it's me," one said. "And that happens every time I change countries. Right now I'm in Italy, and I had to reidentify myself again." According to the report, "Workers are required to perform further ID checks when they are geolocated from a different country, or for unknown reasons."

Biometric data used to identify someone is special category data under Article 9 of the GDPR, processing of which is banned unless an exception applies. The complaints, however, do not build their case mainly on Article 9. They rely on minimisation and on Scale AI's choice of processor.

Persona's data practices

The complaints quote Persona's privacy policy, to which Outlier refers. Persona reserves the right to collect data from "third parties" and lists open-ended categories that include device information, IP address, publicly available data "from public records, the public internet and social media", and "Additional Age Assurance data" verified through "government and national ID registries, consumer credit bureaus, utility companies, mobile network providers and postal address databases."

According to the complaints, Persona uses about fifteen subprocessors, including OpenAI, Groqcloud and Anthropic, for data extraction and analysis tasks, with processing on US infrastructure including Amazon Web Services and Google Cloud. The DiPLab report, citing an external analysis of Persona's privacy policy, puts the number of third parties at "at least 17". Persona's role in AI extends beyond Outlier: PPC Land reported in June 2026 that Anthropic's new privacy policy added biometric checks to Claude accounts, with a tech lawyer identifying Persona as the vendor.

The complaints say Persona's privacy policy changed on April 9, 2026. Its earlier version, in force since the complainants registered, allowed identity documents to be processed for "service training" through Persona's AI systems. The DiPLab report dates the removal of that wording to April 10, 2026.

Security claims about Persona

noyb's case against the processor leans on Persona's security record. According to the complaints, Persona's source code was found publicly accessible in February 2026. That code, the complaints say, showed that Persona may run 269 distinct checks for each identity verification, including comparisons against databases, and that it filters "unfavorable media" across 14 categories including terrorism and espionage, assigning risk and "similarity" scores. The complaints say Persona confirmed the vulnerabilities, citing a post-incident review on Persona's own blog, and that the episode led Discord to end its contract with Persona for age verification. The Register reported that Discord said Persona had failed to meet its requirements for on-device facial age estimation.

A second claim needs a caveat. noyb's announcement and all five complaints state that in October 2025, about 70,000 photos of government-issued IDs "stored with Persona" were taken by hackers. The NBC News report that noyb's announcement links for that figure attributes the October 2025 breach to an unnamed third-party vendor of Discord and does not mention Persona.

One-to-one or one-to-many?

The legal argument on biometrics runs in two steps. First, according to the complaints, the processing is not necessary at all. They cite a November 13, 2024 decision by the Italian Garante involving Glovo, in which the company conceded that biometric verification was not a sufficient anti-fraud measure but a deterrent, and the authority concluded it was not strictly necessary. Less intrusive options exist, the complaints argue, such as two-factor authentication or a physical security key.

Second, even if biometrics were needed, Persona's practice goes too far. With no answer to their access requests, the complainants rely on Persona's own policy, which says it compares the data it receives with other databases. The complaints call this "one-to-many" identification, matching a face against other faces in a database, as opposed to "one-to-one" verification against a single ID document. They point to recital 41 of Directive (EU) 2024/2831 on platform work, adopted on October 23, 2024, which says that where biometric data must be processed, one-to-one verification should be used. The directive is not yet transposed; member states have until December 2, 2026.

Is one-to-one matching a safe harbour? Not necessarily. Spain's data protection authority fined Yoti €950,000 in March 2026 after finding that a facial template used for one-to-one matching still counted as special category data, and that keeping it for the life of an account was disproportionate.

Baptiste Delmas, project coordinator at Intérêt à Agir, framed the stakes in noyb's announcement: "The violations highlighted in the complaints against Scale AI clearly show that the AI boom relies on a vast workforce whose privacy is at stake. Data protection authorities must now take these issues seriously and impose strict enforcement measures."

The unanswered access requests

Every complainant asked Scale AI for a copy of their data, using the addresses given in Outlier's privacy policy: privacy@outlier.ai and outlier@lionheartsquared.eu. One purpose stands out. According to the complaints, each request asked whether the complainant had been subject to automated decision-making, a question with obvious weight on a platform that, according to the complaints, assigns tasks by algorithm, and where workers interviewed for the DiPLab report describe accounts being deactivated without explanation.

The dated requests went out between December 17, 2025 and February 10, 2026. Follow-ups were sent between January 23 and April 13, 2026. According to the complaints, Scale AI has answered none of them. Under Article 12(3) of the GDPR, a controller must respond to a right of access request without undue delay and within one month.

Requests to Persona went no further. Two complainants received only an acknowledgement of receipt. Two others were redirected to Outlier.

The legal theory

The complaints group the alleged violations into three categories.

On tracking, they argue that Scale AI breached the data minimisation principle in Article 5(1)(c) GDPR. Outlier's privacy policy lists "Automatically Collected Data", including device identifiers, IP address, information from cookies or pixels and the website visited before the platform. It processes that data under its "legitimate interest in operating the platform", for personalisation, to improve its products, and to research and test improvements to its clients' services - which the complaints read as training their AI. "It is difficult to see how the processing of all Data Collected Automatically - including via the trackers described in Section 3.4 - could be strictly necessary for the purposes cited," the Dutch complaint states. "For example, knowing which website was visited before the Platform or sharing the name of data subjects is clearly not necessary for any of those purposes."

The complaints then link minimisation to the legal basis. Citing the CJEU in Meta v Bundeskartellamt (C-252/21) and Koninklijke Nederlandse Lawn Tennisbond (C-621/22), and EDPB Guidelines 1/2024, they argue that legitimate interest under Article 6(1)(f) is only valid when processing respects minimisation, so a breach of one voids the other. They also cite a June 18, 2026 CJEU judgment, NTH Haustechnik (C-484/24), on minimisation as an expression of proportionality.

Separately, placing trackers on a device falls under Article 5(3) of the ePrivacy Directive, which requires consent unless storage is strictly necessary for a service the user requested. Each complaint invokes the national transposition: Article 82 of the French Loi Informatique et Libertés, Article 122(1) of the Italian privacy code, Article 11.7a of the Dutch Telecommunicatiewet and section 165(3) of Austria's Telekommunikationsgesetz 2021. Scale AI relies on legitimate interest rather than consent for its trackers, according to the complaints, which argue that this alone breaches those provisions.

On biometrics, the complaints allege breaches of Articles 5(1)(c), 25(1) on data protection by design and default, and 28(1), which obliges controllers to use only processors that can guarantee GDPR compliance. On access, they allege breaches of Articles 15 and 12(3).

What noyb asks the regulators to do

The requests are largely the same across the filings. noyb asks each authority to declare the violations, to order Scale AI to answer the access request, and to investigate, extending the inquiry to Scale AI's use of automated decision-making. It suggests an administrative fine under Articles 58(2)(i) and 83(5)(a) and (b), the tier that allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. The French complaint also asks the CNIL to publish Scale AI's identity in its decision.

What the DiPLab report found

The complaints draw on a 45-page report, "Surveillance at Scale. How AI Training Platforms Gather Personal Data from European Workers", by Thomas Le Bonniec, Antonio A. Casilli, Mathilde Abel, Simone Robutti, Gaetano Priori and two former Outlier workers identified as Paul S. and Donatella D. It is published as a DiPLab/Reversing Works report dated October 2026, under a CC BY-NC-SA 4.0 licence. According to its record on the HAL open archive, it was deposited on October 12, 2026 and revised on October 26.

Method

The research ran from September 2024 to February 2026, according to the report. The team interviewed 35 Outlier workers across 13 European countries, 12 EU member states and Norway. Eleven of them generated HAR files from their own browsers for analysis. The team also collected 94 annotation guideline documents over nine months, covering four main clients - Meta, Alphabet, xAI and OpenAI - and analysed them with natural language processing, using the MiniLM embedding model to sort 50-word segments into 12 clusters.

Pay and work

The report describes a young, highly educated workforce: more than half under 30, nearly all holding a bachelor's or master's degree. Average monthly income in the month surveyed was €1,214, which the report says is 30% below the average cost of living in the workers' countries.

According to the report, Outlier pays a fixed rate for a limited time - 20 minutes per task - and halves the rate for extra time. "An hourly rate of $20 could drop to half after just 10 to 20 minutes of work." Rates for identical projects ranged from $10 an hour for Portuguese speakers to $50 for Swiss German workers. Time spent reading guidelines, discussing tasks with other workers and attending training is unpaid. Only four participants earned more than €5,000, and they derived 70% to 100% of their income from the platform. Ten earned nothing.

"They send you e-mails and then you look and there is no task - you're prepared to work the whole day," said B., a 46-year-old worker in Greece quoted in the report.

The tracker inventory

The report counts 16 unique trackers that collected workers' personal information and sent it to third parties, grouped into three tiers: social media behavioural trackers (Facebook, LinkedIn, Snapchat, TikTok, Twitter, Quora); tools capturing clicks, keystrokes, mouse movements and screen activity (FullStory, Amplitude, Google Analytics, PostHog, Sprig, Segment); and what it calls high-liability identifiers (Persona, Recruitics, Forethought, Sentry).

It maps the findings to GDPR articles: Article 5 on minimisation, Article 9 on sensitive data, Article 12 on transparency (Outlier's privacy and cookie policies are in English only), Article 22 on automated decisions, Articles 32 and 33 on security and breach notification, and Articles 44 and following on transfers. On security, the report says press articles in June 2025 revealed that Outlier had used publicly accessible Google documents containing personal data of many workers, with "several hundred people within the European Union" believed to be affected, and that Scale AI did not disclose what "appears to be a breach." On transfers, it says data went to US companies including Sprig, PostHog, FullStory, LinkedIn and Facebook that are not named in Outlier's policies.

The report also covers two features beyond the complaints: the Outlier Playground, which it calls "an unpaid feature for testing experimental AI models" whose users "are monitored to train AI", and a short-lived language correction system called "Linter" that, according to a former worker, blocked task completion unless workers followed instructions "which were often wrong."

The policy argument

The final section turns to politics. It describes ties between AI companies and the US military, and argues that the Digital Omnibus would let companies claim a legitimate interest in transferring EU data abroad for AI training. The report says the European Parliament is expected to vote on the package in early 2027. PPC Land reported on October 25, 2026 that the EU Council had agreed its Digital Omnibus mandate, including a provision that AI development may rely on legitimate interest, and that no date for a Parliament vote is set in the Council document.

Scale AI's response

noyb's announcement contains no statement from Scale AI. Reuters reported on October 27 that Scale AI did not immediately respond to a request for comment. The Register later updated its report with a statement from Scale: the company said the report's claims were unfounded and inaccurate, that Outlier's practices are disclosed to contributors and require their consent, and that it uses standard tools to verify identities, prevent fraud, protect confidential project information and ensure accurate payment. No statement from Persona on the complaints appears in noyb's materials.

The consent point is where the two sides meet head-on. The complaints say Scale AI's own privacy policy grounds its trackers in legitimate interest, not consent. The DiPLab report adds that consent from workers who depend on a platform "cannot automatically be considered to be freely given." Which reading prevails is now a question for four regulators.

Why this matters for the marketing community

Three threads run from this case into advertising.

The first is the pixel. The legal question in the complaints - whether a business can load Meta, LinkedIn, TikTok and Snapchat tags without consent on the strength of legitimate interest - is the same one that applies to any EU website. What is new is the setting. A logged-in work platform transmits attributes such as pay rate, project assignment and task availability, the kind of data a consumer site rarely holds. The Facebook requests described in the French complaint carry task data alongside identifiers that, according to the complaint, let Meta match website visits to browsers.

The second is enforcement on platforms that manage people through software. The Dutch authority, which now has the Netherlands complaint, fined Uber €824.99 million in August 2026 for deactivating drivers' accounts without human review, after earlier fines of €10 million in 2024 for transparency and access failures and €290 million for transfers of driver data to the US. France's Council of State in December 2025 cut Amazon's warehouse monitoring fine from €32 million to €15 million but upheld the finding that keeping scanner indicators for 31 days breached minimisation. Worker monitoring cases have ended in fines; their size has not always survived appeal.

The third is timing. Complaints against ad tech can take years. The 2020 complaint behind Norway's decision to fine Microsoft's Xandr NOK 92 million, lodged by the Norwegian Consumer Council in cooperation with noyb, was decided on October 12, 2026. The group's resources are also finite: PPC Land reported that noyb filed only 21 GDPR complaints in 2025, down from more than 40 in 2023, as its Digital Omnibus work absorbed capacity. Five coordinated filings against one company, after December 2025 complaints over TikTok's tracking of Grindr use, show where part of that capacity is now going.

Inconsistencies in the source material

Several figures and names differ across the documents.

• Meta's investment in Scale AI is $14.3 billion in the DiPLab report's introduction and 14.5 billion dollars in its executive summary. PPC Land reported the deal at $14.8 billion in 2025.
• The report's executive summary says workers were surveyed in 12 European countries; its methodology says 13, including Norway.
• Persona's third parties number "about fifteen" in the complaints and "at least 17" in the report. The privacy policy change is dated April 9, 2026 in the complaints and April 10 in the report.
• Three complaints name "Datahog HQ" among trackers seen during Persona verification; noyb's announcement and the second Austrian complaint name Datadog. The spelling suggests the same company, but the documents do not say so.
• noyb's announcement credits the Digital Freedom Fund as a funder of the AI-WORLD project; the report's funding line reads "DFF (Digital Frontier Foundation)".
• The Dutch complaint refers to the complainant as both "he" and "her".
• The claim that 70,000 ID photos "stored with Persona" were stolen in October 2025 is not supported by the NBC News report noyb links for it, as noted above.

Timeline

• 2016 - Alexandr Wang and Lucy Guo found Scale AI, according to the DiPLab report.
• 2021 - Persona raises $150 million from Founders Fund, according to the report.
• February 1, 2024 - Dutch DPA fines Uber €10 million over driver data transparency and access failures.
• May 2024 - The Dutch complainant opens an Outlier account.
• August 26, 2024 - Dutch DPA fines Uber €290 million for transfers of driver data to the US.
• September 2024 - DiPLab's Outlier fieldwork begins.
• October 23, 2024 - The EU adopts Directive 2024/2831 on platform work.
• November 13, 2024 - Italian Garante decision involving Glovo, cited in the complaints on biometric checks and trackers.
• December 19, 2024 - noyb files a complaint over Ryanair's facial recognition verification.
• February 4, 2025 - The Italian complainant's last recorded tasks, about 488 in total.
• April 2025 - The French complainant completes about 50 tasks; the second Austrian complainant opens an account.
• June 13, 2025 - Meta announces its 49% investment in Scale AI.
• June 2025 - Press reports reveal public Google documents with Outlier worker data, according to the DiPLab report.
• October 2025 - Breach of about 70,000 ID photos that noyb attributes to Persona; the NBC News report it links blames an unnamed Discord vendor.
• December 17, 2025 - The Italian complainant sends an access request to Scale AI.
• December 22, 2025 - The second Austrian complainant sends an access request.
• December 23, 2025 - France's Council of State cuts Amazon's warehouse monitoring fine to €15 million.
• February 2, 2026 - The French complainant sends an access request.
• February 10, 2026 - The first Austrian complainant sends an access request.
• February 2026 - Persona's source code is found publicly accessible, according to the complaints; DiPLab fieldwork ends.
• February 25, 2026 - CNIL opens consultation on session replay tools.
• March 10, 2026 - Spain's AEPD fines Yoti €950,000 over biometric data.
• April 9, 2026 - Persona updates its privacy policy, dropping wording on using ID documents for service training.
• May 6, 2026 - Scale AI announces the Pentagon CDAO agreement ceiling rising to $500 million.
• May 12-25, 2026 - Three complainants ask Persona for access to their data.
• May 22, 2026 - The Dutch complainant records Outlier traffic.
• June 8, 2026 - Anthropic publishes a privacy policy adding biometric checks to Claude accounts.
• June 18, 2026 - CJEU rules in NTH Haustechnik (C-484/24), cited in the complaints.
• July 8, 2026 - The second Austrian complainant records Outlier traffic.
• August 21, 2026 - Dutch DPA fines Uber €824.99 million over automated driver deactivation.
• October 5, 2026 - IMDEA study finds six of nine AI chatbots share data with trackers.
• October 12, 2026 - DiPLab report deposited on HAL; Norway fines Xandr NOK 92 million.
• October 21, 2026 - EU Council agrees its Digital Omnibus mandate.
• October 26, 2026 - DiPLab report revised on HAL.
• October 27, 2026 - noyb files five complaints against Scale AI in France, Italy, the Netherlands and Austria; Scale AI calls the claims unfounded in a statement to The Register.
• December 2, 2026 - Transposition deadline for the Platform Work Directive.

Related PPC Land coverage

• Meta's $14.8 billion Scale AI deal exposes antitrust vulnerabilities - the June 2025 deal that gave Meta 49% of Scale AI and moved Alexandr Wang to Meta.
• Meta's $14.8B Scale AI deal signals AI industry decline - Scale AI's customer losses after the Meta investment, including OpenAI's wind-down.
• Dutch regulator fines Uber 825 million euros over automated driver blocking - the August 2026 Article 22 fine against a platform that manages workers by software.
• France's CNIL puts session replay tools under the privacy microscope - the draft recommendation the complaints cite on Fullstory-style recording.
• France slashes Amazon's GDPR fine from €32M to €15M over warehouse monitoring - the Council of State ruling on worker monitoring and minimisation.
• Spain fines Yoti €950,000 over biometric data and consent failures - a verification provider fined over facial templates used for one-to-one matching.
• Anthropic's new privacy policy adds biometric checks to Claude accounts - Persona's role in identity checks at another AI company.
• 6 of 9 AI chatbots pass chat titles or links to trackers, IMDEA finds - third-party trackers, including Datadog and Sentry, on AI services.
• Your dating app activity is TikTok's business now - noyb's December 2025 complaints over TikTok tracking of Grindr use.
• Ryanair faces GDPR complaint over mandatory facial recognition for new accounts - noyb's December 2024 complaint over biometric identity checks for airline accounts.
• noyb filed 21 GDPR complaints in 2025 as Omnibus fight limited resources - noyb's 2025 annual report and caseload.
• Norway fines Microsoft's Xandr NOK 92m over Grindr users' sensitive data - the October 2026 decision on a 2020 complaint.
• EU Council agrees 4-month cookie re-ask wait for Digital Omnibus talks - the Council mandate, including legitimate interest for AI development.

Summary

Who: noyb - European Center for Digital Rights, working with Intérêt à Agir, DiPLab and Reversing.Works, on behalf of five Outlier workers; Scale AI, Inc., which operates Outlier and is 49% owned by Meta; Persona Identities Inc., Outlier's identity verification provider; the CNIL, the Garante, the Autoriteit Persoonsgegevens and Austria's Datenschutzbehörde.

What: Five GDPR complaints allege that Scale AI placed social media and analytics trackers on workers' devices without consent and in breach of data minimisation, processed biometric data through Persona beyond what was necessary, and failed to answer access requests that asked about automated decision-making. noyb asks for investigations and suggests fines. Scale AI told The Register the report's claims are unfounded and that Outlier's practices are disclosed and require consent.

When: The complaints are dated October 27, 2026. The underlying access requests date from December 2025 to February 2026, and the DiPLab report was first deposited on October 12, 2026.

Where: France, Italy, the Netherlands and Austria, where the complainants live and work. Scale AI is based in San Francisco and, according to the complaints, has no main establishment in the EU.

Why: Outlier recruits workers across Europe to train AI models for some of the largest technology companies. The complaints test whether advertising pixels, session replay and repeated face scans can run on a work platform on the basis of legitimate interest, at a time when Dutch regulators have already fined Uber €824.99 million over automated management of drivers and the EU is negotiating changes to the GDPR through the Digital Omnibus.