noyb files five GDPR complaints against Scale AI over Outlier worker surveillance

Complaints filed in four countries

noyb filed the complaints in France, Italy, the Netherlands and Austria, with two of them in Austria. It worked together with Intérêt à Agir, DIPLab and Reversing.Works. According to noyb, Outlier employs more than 900,000 "freelance" workers who train AI systems by solving tasks such as writing prompts and ranking answers.

noyb lists Meta, OpenAI, xAI, Google, Anthropic and the US government among Scale AI's best-known customers. The group argues that the AI industry depends heavily on this kind of platform work, noting that tools such as ChatGPT, Gemini and Grok are also trained by people who manually review or annotate their output.

Trackers and biometric checks

According to noyb's technical analysis, trackers from companies including TikTok, LinkedIn, Facebook, the survey platform Sprig and the data analysis company Datadog are placed on workers' devices while they use Outlier. Every few seconds, these trackers send personal data to third parties, the group says. This includes IP addresses, contact details, unique identifiers and information about the visited page. noyb says such data can be used for targeted advertising and profiling.

Lisa Steinfeld Leiser, data protection lawyer at noyb, said: "Why should LinkedIn or Facebook know which tasks you're working on?"

noyb also criticises the biometric verification that workers must repeatedly complete through a company called Persona. It includes video recordings of the worker's face and an ID upload. Scale AI says the process is meant to prevent identity fraud and to "verify the workers' skills". noyb argues it goes far beyond what is necessary. It also points to a security incident: in October 2025, approximately 70,000 photos of government issued IDs stored with Persona were exposed by hackers. In addition, noyb says Persona grants itself the right to collect data such as IP addresses, device information, geolocation data, addresses and consumer credit data.

Alleged GDPR violations

noyb says Scale AI has no valid legal basis to place trackers on the complainants' devices without consent. It also accuses the company of breaching the GDPR's principle of data minimisation, and says the same applies to the processing of biometric data. In addition, noyb states that Scale AI did not respond to the complainant's access requests, which it describes as a violation of the right of access under the GDPR.

The group asks the competent authorities for a full investigation and suggests an administrative fine to deter similar violations in the future.

What it means for platform workers

Thomas Le Bonniec, sociology researcher at DIPLab, said platform work seems to be "fertile ground for a whole new type of workplace surveillance". Baptiste Delmas of Intérêt à Agir said data protection authorities "must now take these issues seriously and impose strict enforcement measures".

noyb notes that more than 40 million people already have their work organised by platforms, and that some companies wrongly claim workers are self-employed, which can exclude them from social benefits. The complaints are part of AI-WORLD, an initiative on working conditions across AI value chains led by Intérêt à Agir with DiPLab, supported by the European AI & Society Fund and the Digital Freedom Fund. The outcome now rests with the data protection authorities. The source does not include a response from Scale AI.