Privacy / Security / AI Industry
noyb files five GDPR complaints against Scale AI over tracking and biometric checks of Outlier workers
Complaints in France, Italy, the Netherlands and Austria target third-party trackers, mandatory Persona face-and-ID verification and unanswered access requests on the AI training platform.
Privacy group noyb, working with Intérêt à Agir, DIPLab and Reversing.Works, has filed five GDPR complaints against Scale AI in France, Italy, the Netherlands and Austria. According to noyb, Scale AI’s Outlier platform engages more than 900,000 ‘freelance’ workers who annotate data and rank model outputs for AI developers.
The French complaint to the CNIL alleges breaches of GDPR Articles 5(1)(c), 12(3), 15, 25(1) and 28(1), as well as the French transposition of the ePrivacy cookie rule. It cites traffic captures showing trackers from Facebook, TikTok, LinkedIn, Fullstory, Sprig and others, which noyb says were placed without consent and sent names, email addresses and task status to third parties. It also challenges repeated biometric verification via processor Persona and an access request sent on 2 February 2026 that went unanswered.
noyb asks the authorities to investigate, including automated decision-making, and suggests fines. No authority has ruled.
Editor’s note: This article relies on noyb’s own announcement and its complaint, both from an advocacy group; the claims have not been tested by any authority.
Why it matters
The complaint treats processor choice as a data protection by design issue: it argues a controller breaches Articles 25(1) and 28(1) if its identity-verification vendor collects more than needed, for example one-to-many matching instead of one-to-one checks. Organisations using biometric onboarding for contractors or gig workers should review what their verification vendor actually collects and whether less intrusive authentication would serve. The tracker findings are also a reminder to inventory analytics, session-replay and social pixels on worker-facing portals, not only customer sites, and to check that access requests sent to listed addresses are routed and answered within one month.
Status: Alleged. Complaints filed with four national authorities; no investigation or decision yet
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Complaint
- Authority
- noyb and partners (complaints to DPAs in France, Italy, the Netherlands and Austria)
- Concerning
- Scale AI (Outlier platform)
- Law
- GDPR Articles 5(1)(c), 12(3), 15, 25(1), 28(1); French ePrivacy rule
Case status: Open
Enforcement trackerWho should care
- DPO
- Legal & compliance
- CISO
- HR data owners