Scale AI GDPR Complaint: Five Filed by noyb

Much of the human work behind AI models is done by freelancers on platforms. On Tuesday, October 27, the European privacy group noyb alleged that one of the biggest companies that hires them is breaking European data law.

noyb filed five GDPR complaints against Scale AI in France, Italy, the Netherlands and Austria (two in Austria). They target Outlier, the platform where more than 900,000 freelancers write prompts and rank model answers. noyb lists Meta, OpenAI, Google and the US government as customers. Reuters adds that Meta owns 49% of Scale AI.

These are complaints, not rulings. Regulators now decide whether to investigate, and Scale AI hadn’t responded to Reuters’ request for comment when the story ran.

What noyb says Outlier does

Four claims, and they should be kept apart.

First, third-party tracking. noyb says its technical analysis found trackers from TikTok, LinkedIn, Facebook, the survey tool Sprig and the analytics firm Datadog running on workers’ devices while they used Outlier. Every few seconds, it says, they send IP addresses, contact details, unique identifiers and the page being visited to those companies. noyb’s position is that EU law requires consent for tracking like this, and that Scale has no valid legal basis for placing these trackers without it.

Second, biometric checks. Workers repeatedly have to upload an ID and record a video of their face through an identity company called Persona. Scale says that’s to stop fraud and to “verify the workers’ skills”, per noyb. noyb says it goes well beyond what’s necessary, and points out that about 70,000 government ID photos held by Persona were exposed by hackers in October 2025.

Third, unanswered requests. Under the GDPR, people can ask a company for the data it holds on them. Reuters, citing the complaints, says four workers asked Outlier for their data between December 2025 and May 2026 and got no answer.

Fourth, and heaviest, is the keystroke claim. Reuters, citing the complaints it saw, says up to 19 trackers follow workers, including recording keystrokes and mouse movements every few seconds. DiPLab, the French research collective that worked with noyb, found that the resulting file could be rebuilt into a video replaying a work session from start to finish. noyb’s release doesn’t mention the 19 or the keystrokes, so my take is to wait for Scale’s side and the filings themselves before treating it as settled.

Where the sources differ

Claim	noyb release	Reuters	Who found it
Ad-tech trackers (TikTok, LinkedIn, Facebook, Sprig, Datadog)	Yes	Not mentioned	noyb technical analysis
Up to 19 trackers, keystrokes and mouse movements	Not mentioned	Yes, from the complaints	Complaints, per Reuters
Work session replayable as video	Not mentioned	Yes	DiPLab
Repeated face and ID checks via Persona	Yes	Yes	Complaints
Unanswered data requests	Yes	Yes, four workers	Complaints

Reuters carries the keystroke and mouse logging detail. noyb’s release centers on the ad-tech trackers and the biometric checks. They aren’t contradicting each other, but a reader of one will miss what the other reports.

Scale hasn’t commented in anything I could find, so every claim above is an allegation by the complainants and their researchers.

Task assignment and bonuses

The pay model is the odd part. Thomas Le Bonniec, the DiPLab researcher, told Reuters: “You don’t work when you want. You work when the platform wants you to and there are tasks available.” He also described bonuses of $100 to $200 for finishing 200 tasks in 24 hours, and noted that Italy’s data protection authority fined the delivery app Glovo in 2021 over similar game-like incentives.

So the complaints ask regulators to look at how tasks are handed out, not just at the trackers. noyb also asks for a fine.

Euronews notes the complaints land in a month when the EU AI Office opened inquiries into OpenAI and Anthropic.

My read: I wouldn’t expect a fine soon, and the first thing to watch is whether any of the five authorities announces a formal investigation. Nothing in the sources says how long that takes.

My take on the bigger picture: this labor is rarely part of the AI news cycle, and if even part of the tracking claim holds, the labs buying it may well be asked what they knew. For how another regulator has handled AI and personal data, see the UK ICO’s commitments from AI companies.

Sources

Note on sources: I read noyb’s full release, the Reuters text as syndicated by The Straits Times, and the Euronews report. I did not open the five complaint filings or the DiPLab report themselves, so the 19-tracker and keystroke details are as Reuters relays them.