Summary

• Five complaints have been filed against Scale AI with authorities in France, Italy, the Netherlands and Austria.
• Researchers allege extensive tracking of Outlier workers, repeated biometric checks and failures to respond to personal data requests.
• The complaints seek regulatory action but do not establish that Scale AI has violated the GDPR.

European privacy campaigners have filed five complaints against Scale AI, alleging that its Outlier platform subjects freelance workers producing artificial intelligence training data to extensive monitoring, invasive identity verification and inadequate access to their personal information.

The complaints were submitted to data protection authorities in France, Italy, the Netherlands and Austria by privacy organisation noyb, working with researchers investigating the conditions under which people produce and evaluate material used to develop AI systems.

Outlier uses freelance specialists to assess responses, write prompts, review technical information and undertake other tasks supporting AI development. Its customer base includes major technology companies such as Meta, OpenAI and Google, although the complaints concern the practices of the platform operator rather than establishing misconduct by those customers.

Noyb says more than 900,000 freelancers have participated in Outlier’s work. The organisation alleges that workers are subject to monitoring exceeding what is necessary to manage their assignments, while essential information about the collection and use of personal data is not adequately disclosed.

Monitoring extends beyond completed assignments

Research conducted by the Paris-based Digital Platform Labour research group, DiPLab, identified as many as 19 trackers operating in connection with Outlier’s work environment. According to the investigation, some collect information about workers’ keyboard and mouse interactions at intervals of only a few seconds.

The researchers describe recordings detailed enough to reconstruct activity during a work session. Such information can reveal more than whether a task was completed, potentially showing how a person moves through an interface, which sections receive attention and how they interact with the platform over time.

The complaints also identify tracking technologies associated with third-party services, including companies operating advertising and social platforms. Noyb questions why those third parties should receive information generated while freelancers perform paid work for an AI training service.

Online platforms may legitimately collect some information to administer accounts, investigate misuse and assess task completion. The GDPR nevertheless requires an appropriate legal basis for processing personal data, alongside transparency, purpose limitation and proportionality.

Those principles become particularly important when information is collected continuously. A record showing that a worker submitted a completed assessment may serve a different operational purpose from detailed behavioural tracking that records their interactions throughout the task.

Noyb argues that Outlier has not established an adequate justification for the scope of the monitoring identified by the researchers. Whether the disputed processing breaches European law will be determined by the competent authorities after examining the evidence and the company’s response.

Biometric checks create additional exposure

The complaints separately challenge identity verification carried out through Persona, a third-party provider used by Outlier. Freelancers can be required to submit official identity documents and recordings of their faces, with some encountering repeated verification demands before being permitted to continue work.

Remote work platforms have reasons to verify identity. They may need to prevent impersonation, account sharing, payment fraud or unauthorised access to confidential information supplied by customers.

However, identity verification does not automatically justify every method of collecting or retaining personal data. The proportionality of a particular process depends on its purpose, the information involved, available alternatives and safeguards controlling subsequent use.

Biometric information can be subject to additional restrictions under European data protection law where it is processed for the purpose of uniquely identifying an individual. The applicable legal obligations depend on the actual processing activity rather than the mere presence of a photograph or video.

Noyb contends that Outlier’s repeated checks go beyond what is necessary and that workers lack sufficient information about how their biometric data is handled. The allegations remain disputed matters for regulatory assessment rather than established findings of unlawful processing.

Workers challenge access to their information

Four freelancers reportedly requested copies of their personal data between December 2025 and May 2026 but did not receive the responses required under the GDPR, according to the complaints.

The right of access allows individuals to understand what information an organisation holds about them, how it is processed and, where applicable, the parties to whom it has been disclosed. That right is particularly significant where automated systems influence work allocation or account access.

Without meaningful visibility into the information held about them, workers may struggle to challenge inaccurate records or understand why their access to paid tasks has changed. The consequences can be immediate when platform work provides an important source of income.

The researchers also examined how Outlier distributes tasks and uses performance incentives. Their findings describe bonuses that can encourage workers to complete large volumes of assignments within restricted periods, including reported offers worth $100 to $200 for completing 200 tasks in a day.

Such arrangements raise broader questions about platform labour, but the complaints focus principally on data protection. Whether particular working practices are fair under employment legislation involves separate legal tests and potentially different regulatory authorities.

AI training depends on human expertise

AI development involves substantial human work, including evaluating generated responses, correcting mistakes and producing specialist material used in training and testing. Platforms such as Outlier provide a way for developers to obtain this expertise without directly employing all the people performing those tasks.

That commercial arrangement can make the responsibilities of different organisations less visible. A worker may interact primarily with the platform operator, while the resulting material is supplied to a separate AI developer that determines the objectives of the work.

European data protection requirements still apply where personal information about workers is processed within their scope. Organisations must identify their responsibilities and comply with the obligations associated with the processing they undertake.

Noyb has asked the relevant authorities to investigate Scale AI’s practices and consider enforcement measures, including potential fines. Scale AI had not immediately responded publicly when the complaints were reported, and no final regulatory determination has been established.

The proceedings place greater scrutiny on the infrastructure supporting AI development beyond computing hardware and software models. Human evaluation remains an important part of model training, while the systems used to distribute, monitor and verify that work create their own legal and operational responsibilities.