The complaints against Scale AI: which rules govern the monitoring of platform workers?

On 27 October 2026, the privacy organisation noyb filed five complaints against the US company Scale AI, Inc. with the supervisory authorities in Austria, France, Italy and the Netherlands. The complaints concern the Outlier platform, on which freelancers annotate data and assess the output of language models for customers developing AI systems. They build on the report by the research group DiPLab published on 15 October 2026 and on the complainants’ own traffic analyses. No authority has examined the allegations, and Scale AI had not commented on the complaints when they became public. The case raises the questions of which authorities may handle complaints against a platform with no establishment in the EEA, what the General Data Protection Regulation requires of tracking and biometric checks of platform workers, and what organisations purchasing such services should do.

What do the complaints against Scale AI concern?

The complaints concern three matters, namely tracking tools on the platform, biometric identity checks and access requests that have not been answered. According to the complaint to the Austrian authority, a recording of browser traffic showed that the platform contained tracking tools from, among others, Fullstory, Sprig, LinkedIn, TikTok, Facebook, Snapchat, Google Analytics and Amplitude. Fullstory is a session replay tool that records mouse movements, clicks and keystrokes, and according to the complaint it sent a request every few seconds. A customer support tool is said to have transmitted the complainant’s name and email address to a third party. Outlier’s privacy policy states that automatically collected data are also used to improve its customers’ products, which includes the training of AI systems.

The biometric check is carried out by the subcontractor Persona. The annotator must upload an identity document and record a video of their face, and the check is repeated at irregular intervals. The complainants point out that Persona’s own terms allow it to obtain data from third parties and public registers, and that around 70,000 images of identity documents stored by Persona were stolen in October 2025. The Austrian complainant submitted an access request on 10 February 2026 and sent a reminder on 13 April 2026 without receiving a reply. The request sought, among other things, to establish whether the complainant had been subject to automated decision-making.

The complainants allege infringements of the principle of data minimisation in Article 5(1)(c) GDPR, the requirement of data protection by design in Article 25(1) GDPR, the requirement to choose an appropriate processor in Article 28(1) GDPR and the right of access in Article 15 GDPR and Article 12(3) GDPR. They also allege infringements of the national rules on cookies that implement Article 5(3) of the ePrivacy Directive. The complainants ask the authorities to establish the infringements, to order Scale AI to comply with the access request, to extend the investigation to the company’s use of automated decision-making and to impose a fine under Article 58(2)(i) GDPR and Article 83(5) GDPR. noyb acts as representative of the data subjects under Article 80(1) GDPR.

Why have the complaints against Scale AI been filed with four authorities?

The complaints have been filed with four authorities because Scale AI has no main establishment in the EEA. The one-stop-shop mechanism with a lead supervisory authority in Article 56 GDPR applies only to controllers established in the EEA. Where the controller is established only in a third country, each authority is competent on its own territory under Article 55 GDPR, and the data subject may lodge a complaint with the authority where they reside or work under Article 77 GDPR. The complaint to the Austrian authority founds its competence on the complainant residing and working in Austria, and the French complaint is founded in the same way.

The Regulation applies to Scale AI although the company is established in the United States. Under Article 3(2)(b) GDPR, controllers outside the EEA are covered where the processing relates to the monitoring of behaviour that takes place within the EEA, and in our assessment the tracking of annotators’ activity on the platform clearly falls within that alternative. Outlier’s privacy policy names Lionheart Squared in Dublin as its representative in the EU. A representative under Article 27 GDPR is a point of contact for authorities and data subjects, but it does not constitute an establishment and does not trigger the lead authority mechanism.

The consequence is that Scale AI may face parallel proceedings with different outcomes in several countries. For annotators in Norway, it means that the Norwegian Data Protection Authority may handle a complaint directly, without referring it to another authority. For organisations established in Norway, the opposite applies. Where they have establishments in several EEA states, cross-border cases will normally be handled by the authority of the main establishment.

Are biometric identity checks of platform workers lawful?

Biometric identity checks are not prohibited as such, but they are subject to strict conditions. Biometric data used for the purpose of uniquely identifying a person are special categories of data under Article 9(1) GDPR. The processing then requires both a legal basis under Article 6 GDPR and an exception under Article 9(2) GDPR. Outlier’s privacy policy states, as the sole basis for verification data, a legitimate interest in reducing fraud. Legitimate interest is not an exception under Article 9(2), and consent from an annotator who depends on the platform for work will rarely be freely given.

The complaints focus in particular on the scope of the check. The complainants distinguish between verification, in which the face is compared with the photograph in the identity document (one to one), and identification, in which the face is compared with many stored faces (one to many). They refer to recital 41 of the Platform Work Directive, which presupposes one-to-one verification where biometric data must be used at all. The Platform Work Directive (EU) 2024/2831 is to be transposed in the EU by 2 December 2026, but it has not been incorporated into the EEA Agreement. The complainants also refer to the decision of the Italian authority of 13 November 2024 against Foodinho, which operates Glovo in Italy, in which the authority found that biometric checks of couriers were not necessary for the purpose pursued.

The complaints also hold Scale AI responsible for its choice of subcontractor. Under Article 28(1) GDPR, the controller may only use processors providing sufficient guarantees that the processing will meet the requirements of the Regulation. In the complainants’ view, a controller that allows an identity verification provider to collect more data than the check requires infringes both that requirement and the requirement of data protection by design.

Which rules govern tracking tools used on platform workers?

Tracking tools on a work platform must be assessed under two sets of rules. Storing or accessing information on the user’s device requires consent under the rules implementing the ePrivacy Directive, except where it is strictly necessary to provide the service the user has requested. In Norway the rule follows from Section 3-15 of the Electronic Communications Act, as discussed in the article on cookie consent. The subsequent processing of the data must also have a legal basis under the GDPR and comply with the principles in Article 5 GDPR.

The complaints rely on the position that legitimate interest under Article 6(1)(f) GDPR may only be used where the processing is necessary for the purpose, and that the necessity requirement must be read together with the principle of data minimisation. The complainants refer, among other authorities, to the judgment of the Court of Justice in Case C-252/21 (Meta v Bundeskartellamt). In our assessment, a work platform will find it difficult to justify tracking tools from social media as necessary for allocating tasks, checking quality or paying annotators. Session replay may, on the other hand, serve a legitimate purpose in troubleshooting, but the tool should then be used on a sample basis and with masking of content and identifiers.

What happens to access requests that are not answered?

An access request must be answered without undue delay and at the latest within one month under Article 12(3) GDPR. The period may be extended by two further months where the request is complex or numerous, but the data subject must then be informed within one month. An access request that is not answered at all is an infringement of Article 15 GDPR that is easy for the complainant to document and difficult for the controller to defend. Infringements of data subjects’ rights may lead to fines of up to EUR 20 million or 4 per cent of total worldwide annual turnover under Article 83(5)(b) GDPR.

For platform workers, the right of access has a particular function because it gives access to information on automated decisions on task allocation, rating and deactivation. The data subject is entitled to information about such decisions and the logic involved under Article 15(1)(h) GDPR. The requirements for responding are discussed in more detail in the article on subject access requests under the GDPR.

What should organisations that use or operate work platforms do?

The complaints against Scale AI concern the platform and not its customers. Purchasers of annotation and evaluation services may nevertheless incur responsibility of their own if their data are captured by tracking tools, or if they themselves determine the monitoring measures applied to annotators. The requirements purchasers should include in the supplier agreement are discussed in the article on monitoring of data annotators. Organisations that operate a platform for independent contractors themselves should review their own solutions against the questions raised by the complaints. Further articles on the subject are available on the data protection topic page.

1. Map all tracking and analytics tools in the work interface, with their recipients, purposes and the data transmitted.
2. Remove tracking tools from social media and advertising networks from pages on which contractors perform work.
3. Limit session replay to troubleshooting, with sampling and masking of content and identifiers.
4. Consider whether identity checks can be carried out without biometrics, for example with two-factor authentication, and otherwise use one-to-one verification only.
5. Review the agreement with the identity verification provider and limit the data the provider may collect and use.
6. Establish a procedure ensuring that access requests from contractors are answered within one month, including where the request is sent to the representative in the EU.

Questions and answers

Next legal review: 31 March 2027