Source: Noyb
The European privacy organisation Noyb has filed five GDPR complaints against US company Scale AI, filed on 27 October 2026 together with Intérêt à Agir, DIPLab and Reversing.Works. Two complaints were lodged in Austria, one in France, one in the Netherlands and one in Italy. The complaints target the way Scale AI’s AI training platform Outlier handles the personal data of its more than 900,000 freelance workers.
Constant tracking and forced biometric checks
Noyb’s technical analysis found that while workers are active on the Outlier platform, trackers from companies such as TikTok, LinkedIn, Facebook, Sprig and Datadog are placed on their devices. Every few seconds these trackers transmit personal data to third parties, including IP addresses, contact details, unique identifiers and information about the pages visited, which can be used for targeted advertising and profiling.
On top of the tracking, Scale AI forces workers to repeatedly complete a biometric verification process run by a company called Persona, which includes video recordings of the worker’s face and uploading an identity document. Noyb also points out that Persona suffered a data exposure in October 2025 in which roughly 70,000 photos of government issued IDs were leaked. According to Noyb, Scale AI also failed to respond to workers’ data access requests, which violates the GDPR right of access.
Why this matters for European businesses
The complaints argue that Scale AI lacks a valid legal basis for placing trackers on workers’ devices without consent, and that the processing violates the GDPR principles of data minimisation and the rules for biometric data. Noyb is asking the national data protection authorities to open a full investigation and impose administrative fines.
The case is a reminder that GDPR obligations reach every part of the supply chain, including the platforms your contractors and data workers use. If your business works with external platforms, annotation services or freelance talent across the EU, you need clarity on who processes what data and on what legal basis. If you want a professional review of your data protection posture and supplier relationships, contact us for expert advice.