European privacy group noyb filed five complaints under the EU’s General Data Protection Regulation (GDPR) against Scale AI on 27 October in France, Italy, the Netherlands and Austria. In its announcement of the filings, noyb alleged that Scale AI’s Outlier platform unlawfully tracks freelance workers who produce AI training data. The group has asked data protection authorities to investigate and impose a fine.
Key points
- noyb challenges tracking on Outlier, compulsory identity checks and unanswered requests from workers for their personal data.
- The complaints allege that up to 19 trackers monitor workers, including by recording keystrokes and mouse movements.
- noyb wants regulators to investigate, consider a fine and examine how Outlier assigns tasks.
- Scale AI rejects the allegations and says it discloses its practices to contributors.
Outlier’s trackers face GDPR complaints
Outlier is Scale AI’s platform for people who write prompts, rank answers and perform other tasks used to train AI systems. noyb says more than 900,000 freelance workers use it. The group names Meta, OpenAI, xAI, Google, Anthropic and the US government among Scale AI’s customers. CNA reported that Meta owns 49 per cent of Scale AI.
According to CNA, the complaints allege that up to 19 trackers follow Outlier workers as they work, recording keystrokes and mouse movements every few seconds. Paris-based research collective DiPLab found that a file produced by the tracking could be reconstructed as a video of an entire work session. Those allegations concern the monitoring of work used to produce training data for Scale AI’s customers.
noyb says its technical analysis found trackers associated with TikTok, LinkedIn, Facebook, survey platform Sprig and data analysis company Datadog on workers’ devices while they used Outlier. It says data sent to third parties every few seconds included IP addresses, contact details, unique identifiers and information about the page a worker visited. The group argues that placing trackers on complainants’ devices without consent lacks a valid legal basis and breaches the GDPR principle of data minimisation.
Lisa Steinfeld Leiser, a data protection lawyer at noyb, questioned why social-media companies would receive information about workers’ tasks. The complaint puts the authority to collect and share that information before data protection regulators in four countries. noyb wants them to investigate the alleged violations and consider an administrative fine intended to prevent similar conduct.
Persona checks and Scale AI’s response
Outlier workers must also provide identity documents and a video of their face to Persona, an identity verification firm, CNA reported. The complaints allege that the checks are invasive, repeated without explanation and contrary to EU rules on biometric data. noyb says Scale AI has claimed the checks prevent identity fraud and verify workers’ skills. noyb disputes that justification and argues that the processing of biometric data breaches GDPR requirements.
The two accounts of Scale AI’s response differ. CNA reported that Scale AI did not immediately respond to a request for comment. LavX reported that Scale AI rejected the allegations as “unfounded and inaccurate”. According to LavX, the company said it discloses its practices to contributors and requires consent. Scale AI also said its tools serve identity verification, fraud prevention, protection of confidential project information and accurate payment.
The disagreement extends to what a worker must do to earn money on the platform. noyb describes the Persona verification as compulsory and repeated. Scale AI, in the account carried by LavX, presents its checks as safeguards for contributors and projects. The complaints ask regulators to assess the processing of workers’ data under GDPR, rather than accept either account as a finding.
Outlier task assignments and access requests
noyb is also asking regulators to examine how Outlier assigns tasks. Thomas Le Bonniec, who studied the platform for DiPLab, said workers depend on when the platform makes tasks available. DiPLab found that Outlier uses game-like mechanisms and that bonuses form an important part of its incentives. Le Bonniec said worker interviews in his investigation described offers of $100 to $200 for completing 200 tasks in 24 hours.
Le Bonniec pointed to a 2021 fine imposed by Italy’s data protection authority on delivery platform Glovo over similar gamification. In the Outlier complaints, the question about task assignment sits alongside challenges to tracking and identity checks: noyb wants authorities to examine the conditions under which workers perform tasks as well as the personal data collected while they do them.
The complaints also invoke workers’ right of access under GDPR. Four workers requested copies of their data from Outlier between December 2025 and May 2026. None received an answer, according to the complaints.
