noyb Files Five GDPR Complaints Against Scale AI in Four Countries, Alleging Outlier Tracked European Annotators

What happened

The complaints point to three categories of allegations: installing tracking software on contractors' devices without consent and without a legal basis; violating the data minimization principle by collecting data beyond what is strictly necessary for specific purposes; and violating the rules on biometric data processing, while leaving data subjects' access requests unanswered. Noyb asks the four countries' data protection authorities to investigate fully and, where necessary, impose administrative fines.

The alleged data collection runs on two tracks: identity verification handled by Persona, collecting biometric data such as face videos and ID documents, and able to collect IP addresses, device information, geolocation, addresses and consumer credit data; and work tracking that collects system data and device activity, including activity outside Outlier work, transmitting it to third parties including LinkedIn, TikTok and Facebook and other analytics services as often as every few seconds, which noyb says could be used for profiling and targeted advertising.

Both sides' positions and the background appear in the same reports: Scale AI responded that the claims are unfounded and inaccurate, that Outlier's practices are disclosed to contributors and require their consent, and that the tools verify identities, prevent fraud, protect confidential project information and ensure accurate payment. Outlier contractors label data and evaluate AI-generated responses, among other tasks, and customers include OpenAI, xAI, Anthropic, Google and the US government; the complaints belong to an interdisciplinary project on working conditions across AI value chains run by noyb with Intérêt à Agir and DipLab.

Key facts

1. Complaint scale: noyb filed 5 GDPR complaints in France, Italy, the Netherlands and Austria, announced on Oct 27.
2. Respondent: US data annotation company Scale AI, concerning European contractors on its Outlier AI training platform.
3. Core allegations: tracking software installed without consent and without a legal basis, violation of data minimization, unlawful biometric data processing, and unanswered access requests.
4. Identity checks: Persona handles identity verification, collecting face videos and ID documents, and able to collect IP, device, geolocation, address and consumer credit data.
5. Work tracking: system data and device activity are collected, including activity outside Outlier work, and sent to third parties including LinkedIn, TikTok and Facebook as often as every few seconds.
6. Scale's response: the company called the claims unfounded and inaccurate, saying practices are disclosed to contributors and require consent, and the tools verify identities, prevent fraud, protect confidential information and ensure accurate payment.
7. Ask: noyb requests full investigations by the four countries' data protection authorities and, where necessary, administrative fines to prevent similar violations.