Summary
- Five complaints target Scale AI practices in France, Italy, the Netherlands and Austria.
- Researchers allege granular workplace tracking and intrusive repeated identity checks.
- Scale AI disputes the allegations, which have not been determined by regulators.
European privacy group noyb has lodged five complaints against Scale AI over monitoring and identity-verification practices on its Outlier platform, which supplies human work used in training artificial intelligence systems. The cases were filed in France, Italy, the Netherlands and Austria and ask supervisory authorities to examine whether the company’s handling of freelance workers’ information complies with European data protection rules.
Outlier relies on freelancers completing data annotation and other tasks for AI development. Its large pool of contributors does not mean each worker has a conventional employment relationship with Scale AI, but contractual classification does not by itself remove obligations governing the collection and use of personal data. The complaints focus on the information generated while people work, the necessity of repeated verification and their ability to obtain copies of their records.
Research conducted with Paris-based DiPLab alleges that the platform uses as many as 19 trackers and records mouse movements and keystrokes at short intervals. The researchers say collected traces can allow a detailed replay of work activity. Such monitoring differs from collecting a completed task and recording how much should be paid: it creates a time-based record of behaviour that may reveal work patterns, interruptions and other information beyond the output a customer purchased.
The complaints also address identity checks carried out through verification provider Persona, including identity documents and face videos. Whether a particular biometric processing operation receives special protection under the GDPR depends on how the data is technically processed and used to identify a person. Regulators will need to examine the purposes, legal bases, retention periods and information provided to workers, rather than assuming that every face image is automatically an unlawful biometric database.
Privacy law requires an organisation to explain why personal data is being gathered and how long it will be retained, with more demanding requirements where particularly sensitive information is involved. Continuous tracking may be defended as a way of monitoring task quality or preventing abuse, but regulators can examine whether the same purpose could be achieved through less intrusive measurement. The complaints question whether the monitoring was proportionate to those purposes and whether workers received adequate information about the collection. A platform operating across several countries also faces questions about which supervisory authority is competent and how the cases should be coordinated.
The complaints also involve data-handling arrangements relevant to customers purchasing AI training services, because information about workers may be processed separately from training datasets. Records about the people preparing that material may be processed by the platform operator and specialist verification suppliers, each potentially performing a different role under applicable law. Those relationships require careful contractual and legal analysis. The presence of customers with well-known AI brands is not evidence that the customers directly operated the contested surveillance or instructed Scale AI to use a particular monitoring system.
Four workers reportedly sought access to their personal data between December 2025 and May 2026 without obtaining responses, according to the complaints. European data protection law establishes rights to information and access, subject to defined qualifications and response rules. Regulators may consequently need to examine both the monitoring itself and the arrangements for workers to obtain and challenge their records.
The advocacy group also cites task-allocation arrangements and bonus incentives, which can influence when workers take jobs and how many they complete. Those employment-related concerns overlap with questions about transparency, automated decision-making and the extent to which freelance workers can exercise meaningful control over their information. The filings do not amount to regulatory findings. Scale AI rejects the allegations as unfounded and inaccurate. It says its monitoring practices are disclosed to workers and require consent, that some projects use separately activated recording tools, and that identity verification helps prevent fraud. Supervisory authorities have not determined whether the company’s practices comply with European law.
