Noyb files five GDPR complaints against Scale AI over worker surveillance

On Oct. 27, 2026, the Austria-based digital privacy group noyb filed five GDPR complaints against Scale AI, alleging unlawful monitoring of contractors on its Outlier platform across France, Italy, the Netherlands and Austria. The complaints target what noyb describes as invasive workplace surveillance of freelance AI data-labeling workers. Filing in four countries means the complaint can be examined by each national data protection authority using its own procedures, so Scale faces several regulators.

noyb alleges that Scale tracks freelance workers’ web activity while they generate AI model training data. This surveillance is the central allegation in the GDPR complaints. The platform captures mouse clicks and keystrokes at intervals of a few seconds, and noyb says the gathered details can become video of a complete workday. Trackers allegedly capture keystrokes and mouse movements and track activity during and outside work sessions, which noyb considers off-hours tracking.

Reports differ on the number of third-party trackers. noyb cited 18 third-party trackers for French freelancers, while another account cited up to 19 on contractor devices, and noyb noted the number varies by country and is not comprehensive. noyb also alleges that data collected by trackers was sent to third parties including LinkedIn and TikTok. Trackers from TikTok, LinkedIn, Facebook, Sprig and Datadog were found embedded in worker devices, according to noyb.

The complaints also target Scale’s biometric verification practices. noyb alleges that Scale requires workers to submit biometric data as a condition for employment and runs identity checks without adequate justification. According to noyb, workers must provide a Persona face video and identification documents to the identity verifier to earn money. Under European privacy law, biometric data falls into a particularly sensitive category, raising GDPR compliance questions about biometric verification.

noyb says Scale has no valid legal basis for the trackers and that the surveillance breaks GDPR data minimization rules. These claims are part of noyb’s press release allegations. Separately, four freelancers asked Outlier for personal data from tracking and biometric checks between December 2025 and May 2026, but Scale never answered them, noyb says. GDPR gives people the right to request information about personal data held on them.

GDPR treats seriously off-hours tracking, alleged data transfers to social platforms, and biometric checks that lack clear justification. The substance of the complaints targets these practices, which are hard to defend in Europe.

noyb wants the four countries’ courts to fine Scale and wants governments to investigate and examine Scale’s task allocation. The nonprofit is asking for fines and investigations.

Scale disputes noyb’s allegations about third-party tracker surveillance and asserts its biometric data practices are appropriate. Scale’s spokesperson dismissed the allegations as unfounded and inaccurate. Scale says it records screen activity and task duration only when workers opt in.

The company says Outlier verifies identities to stop fraud and misuse, follows European law, and lets workers request data deletion anytime. This is Scale’s explanation of biometric verification. Scale also says it never sells contributors’ personal data to others and never uses personal information for customer AI model training. This is Scale’s denial of selling data or using it for customer AI models.

Outlier is used by tech giants including Google, Meta and OpenAI. noyb’s complaints focused on Scale’s Outlier platform. Meta owns nearly half of Scale, reflecting Meta’s stake in Scale AI. A June 2025 deal gave Meta a 49% stake in Scale AI for $14.3 billion, valuing Scale at more than $29 billion. Scale is backed by Meta.

Scale has worked with more than 900,000 people on creating training data and relies on over 900,000 freelance contractors worldwide.

The complaints concern workplace surveillance of AI data-labeling labor, tracking practices, biometric verification, and third-party data sharing in the AI industry. Regulators have not tested any of the allegations yet; they are still claims from an advocacy group.

noyb is an Austria-based digital privacy advocacy group with a history of winning data privacy suits against tech giants. The group’s TikTok case from May 2025 ended with a €530 million ($590 million) fine over European customer data sent to China. A noyb complaint also brought a late 2023 €1.2 billion ($1.3 billion) fine against Meta and an order to halt European data transfers to the U.S. “Such constant and extensive tracking while working really goes against all reasonable expectations,” Lisa Steinfeld Leiser of noyb said.