NOYB files 5 GDPR complaints against US-based Scale AI
Published: 27/10/2026
| NOYB
Digital rights advocacy group NOYB, along with Intérêt à Agir, DIPLab and Reversing.Works has filed five complaints in France, Italy, the Netherlands, and Austria against US-based Scale AI over invasive workplace surveillance practices and violations of the EU General Data Protection Regulation (GDPR). Scale AI operates without a main establishment in the EU, resulting in 5 separate complaints lodged in the countries where the workers are based.
Scale AI operates Outlier, a data annotation platform deploying over 900,000 workers to train artificial intelligence (AI) models for major technology companies and the US government. Technical analysis revealed that Outlier embeds third-party trackers, including those from TikTok, LinkedIn, Facebook, Sprig, and Datadog, onto workers' devices without lawful consent. These trackers transmit personal information every few seconds to external parties, exposing IP addresses, contact details, unique device identifiers, and site activity for commercial profiling and targeted advertising.
In addition, the company requires workers to undergo recurring biometric checks administered by verification contractor Persona, including live facial video recordings and uploading their ID under the guise of fraud prevention and skill validation. Persona subsequently reserves the right to collect geolocation and device data along with consumer credit records.
NOYB claims that Scale AI lacks a valid legal basis to place trackers on workers' devices or process biometric data, and violates the data minimisation principle. The company also failed to respond to the complainants' subject access requests (SARs).
Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 3,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.