Noyb Files Five GDPR Complaints Against Scale AI Over Alleged Surveillance of Outlier Workers

European privacy group noyb filed five GDPR complaints against Scale AI on October 27, 2026, in France, Italy, the Netherlands and Austria. The complaints target Outlier, Scale’s platform where more than 900,000 freelance workers label data, rate chatbot answers and perform other tasks used to train AI models for clients that include Meta, OpenAI and Google. Noyb alleges that Outlier tracks workers with third-party trackers while they work, forces them through repeated biometric identity checks, and ignored their requests for copies of their data.

Scale disputes the allegations. The company told The Register that the claims are “unfounded and inaccurate,” that Outlier’s practices are disclosed to contributors and require their consent, and that it uses standard tools to verify identities and prevent fraud. None of the four regulators has made any finding. The complaints are the start of a process that typically takes months or years.

What noyb alleges

Noyb filed the complaints with research collective DiPLab, French group Intérêt à Agir and Reversing.Works. According to noyb’s announcement and the redacted Dutch complaint it published, the main claims are:

• Trackers on workers’ devices. Noyb says trackers from companies including TikTok, LinkedIn, Facebook, the survey service Sprig and Datadog run while workers are on the platform, sending IP addresses, contact details, unique identifiers and page information to third parties every few seconds. The Dutch complaint lists trackers from Fullstory, Sprig, LinkedIn, Posthog, Segment and Google in one traffic capture taken on May 22, 2026.
• Session recording. According to Reuters reporting carried by CNA, the complaints say up to 19 trackers follow workers and record keystrokes and mouse movements every few seconds, and a DiPLab investigation found the data could be rebuilt into a video replay of a work session.
• Biometric checks. Workers must submit ID documents and face video to identity verification company Persona, sometimes repeatedly and without explanation. Noyb argues this goes beyond what is needed and breaks EU rules on biometric data.
• Ignored access requests. Four workers asked Outlier for their data between December 2025 and May 2026. The complaints say none received an answer.

The Dutch complaint cites Articles 5(1)(c) (data minimization), 12(3) and 15 (the right of access), 25(1) (data protection by design) and 28(1) (choice of processors) of the GDPR, plus the Dutch telecommunications law rule on cookies and similar trackers. Noyb has asked regulators to investigate and to consider fines. France’s CNIL has acknowledged receipt, according to noyb’s case tracker.

Why this case is different from a cookie banner complaint

Noyb has filed many complaints about tracking on websites, including the cookie banner case covered in our report on the EDPB ordering the Belgian regulator to hear a noyb complaint. This one is about people at work. That changes the analysis in three ways.

1. Consent is weak at work. European regulators have long said consent is rarely freely given when someone’s income depends on saying yes. A freelancer who must accept trackers to receive tasks is in a similar position. If consent does not hold, the company needs another legal basis, and advertising trackers are hard to justify as necessary for the work.
2. Monitoring has to be proportionate. Recording keystrokes and mouse movements every few seconds, if proven, would need a strong justification such as quality control or fraud prevention, and even then the least intrusive option.
3. Biometric data carries extra rules. Face video used to identify someone is special category data under Article 9 of the GDPR. Repeated checks without explanation make it harder to show the processing is limited to what is needed.

The complaint also touches the gig economy debate. Thomas Le Bonniec of DiPLab told Reuters that workers on the platform “work when the platform wants you to.” He cited bonuses of $100 to $200 for finishing 200 tasks in 24 hours, and pointed to Italy’s 2021 fine against delivery platform Glovo over similar gamification. California regulators are looking at gig platforms too, as our report on CalPrivacy’s first formal audit of gig economy platforms describes.

What companies using contractor platforms should check

Many businesses use outside workforces, whether through annotation platforms, crowd-testing services or freelance marketplaces. The same issues can apply to their own worker portals.

• Inventory trackers on worker-facing pages. Advertising and analytics tags often get copied from the marketing site to portals where they do not belong. Remove any that are not needed for the work.
• Separate fraud checks from surveillance. If identity verification is needed, document why, how often, what the vendor keeps and for how long. Set a rule for when a repeat check is triggered.
• Answer access requests on time. The GDPR generally gives one month to respond. Contractors have the same right of access as customers. An unanswered request is one of the easiest violations for a regulator to prove.
• Review processor terms. Session replay and verification vendors need data processing agreements that limit their use of the data.
• Run an assessment before monitoring. Systematic monitoring of workers is a classic trigger for a data protection impact assessment.

Meta’s plans to use employee activity for AI training raised similar questions, as we covered in our piece on workplace surveillance and AI training. In the U.S., biometric checks bring their own exposure, from Colorado’s biometric rules to Illinois litigation such as the Lowe’s voiceprint case.

Where Captain Compliance fits

Captain Compliance’s cookie scanner can produce an inventory of the cookies and trackers on a web page, including worker-facing pages it can reach, so teams can see what loads and decide what to remove. Its data subject request tools help receive, verify and track access requests so they are answered within the legal deadline. A tracker inventory and a closed request ticket are records, not proof of compliance. A closed ticket does not show the data was actually provided or deleted unless the underlying systems were checked.

Frequently asked questions

Has Scale AI been fined?

No. Noyb has filed complaints and asked regulators to investigate. No authority has issued a decision.

Which regulators received the complaints?

Data protection authorities in France, Italy, the Netherlands and Austria. Noyb filed five complaints in total.

Does the GDPR apply to freelancers, not just employees?

Yes. The GDPR protects individuals in the EU regardless of employment status, so contractors have the same rights, including access to their data.

Is identity verification with face video allowed?

It can be, but face data used to identify someone is special category data. The company needs a valid legal basis, an Article 9 condition, and must limit the processing to what is necessary.

What does Scale AI say?

Scale says the claims are unfounded and inaccurate, that Outlier’s practices are disclosed and consent-based, and that it uses standard tools to verify identities and prevent fraud.

The people who train AI have rights too

AI training data is usually discussed as a question about the people whose words and images end up in a model. This complaint is about the people doing the labeling. If European regulators decide that a worker’s keystrokes and face are not the price of a task, AI companies will have to rethink how they manage hundreds of thousands of contractors, and the clients that rely on that work will start asking how the data was made.