Scale AI's data annotation platform Outlier has been hit with complaints in four EU countries. On 27 October 2026, the European privacy advocacy group noyb filed five complaints with regulators in France, Italy, the Netherlands and Austria, alleging that the platform illegally monitored freelancers who annotate training data for AI. Reuters reported the contents of the complaints the same day, and Scale AI did not respond immediately. One point needs to be clear first: these are complaints and allegations. Regulators have not ruled on them, and whether any law was broken will depend on the outcome of their investigations.
More than 900,000 freelancers work through the Outlier platform. Their tasks are recorded and used to produce training data for clients including Meta, OpenAI and Google. Reuters also reported that Meta owns 49% of Scale AI. noyb is asking regulators to fine Scale AI and to examine how the platform assigns tasks.
What the complaints allege
The complaints focus on three practices. The first is tracking of the work process: the complaints say up to 19 trackers follow workers while they work, recording keystrokes and mouse movements every few seconds; an investigation by the Paris-based research collective DiPLab found that the resulting file could be rebuilt into a video replaying the whole work session. The second is identity verification: workers must submit identity documents and a face video to the identity verification firm Persona; the complaints call these checks invasive, repeated without explanation, and in breach of EU rules on biometric data. The third is the right of access: between December 2025 and May 2026, four workers asked the platform for copies of their data, and the complaints say none of them received a reply. The complaints also mention gamification and bonuses: completing 200 tasks within 24 hours could earn a bonus of 100 to 200 US dollars; a researcher involved in the investigation cited a 2021 fine by Italy's data protection authority against the delivery platform Glovo as a precedent for similar practices. That is only the researcher's analogy, not a ruling in this case.
Who is affected — and where the limits are
The people most directly affected are Outlier workers in the EU. The complaints rely on EU data protection rules, and the dispute is whether the monitoring was excessive, whether it had a legal basis, and whether it was explained clearly. The second circle is companies that buy training data: the clients named in the reporting have not thereby done anything unlawful, but buyers will find it harder to ask only about data quality and not about where the data came from, and compliance checks in the supply chain gain an extra link. The third circle is other crowdsourcing and annotation platforms: any platform that also uses keystroke and mouse tracking, face verification and algorithmic task assignment will be measured against the same questions. The boundaries matter too: the five complaints went only to regulators in four EU countries. They cannot be applied directly to freelancers in the United States or elsewhere, and they do not establish that all workplace monitoring is unlawful.
Five checks for platforms and buyers
- Necessity: every form of tracking must be tied to a specific quality-control purpose; the fact that something can be recorded does not justify recording everything. Session records that can reconstruct an entire work session deserve a separate assessment.
- Biometrics: face videos and identity documents need their own legal basis, repeated checks need a reason and a cap, and the verification firm's retention period must be written down.
- Access requests: there must be a named owner and a reply deadline; requests should be acknowledged, answered on time and fully documented. The allegation of four unanswered requests points to exactly the kind of process gap that is easiest to fault.
- Task assignment and bonuses: the logic of task allocation and the bonus rules must be written down; algorithms must not push people into continuous rush work based only on acceptance speed and time online, and workers need real channels to complain and to step away.
- Contractual roles: the platform, the verification firm and the buyer must set out in contracts who is the controller and who is the processor, how long data is kept, and how it is deleted when that period ends. Verbal understandings are not enough.
The risk goes beyond fines
Regulatory risk comes first: the authorities in the four countries may open investigations, impose fines or require corrective action, and the way tasks are assigned is also to be examined, so the cost and time of remediation may exceed expectations. Behind that sits supply-chain risk: the provenance of training data is now being questioned on its own, and buyers will ask in due diligence about monitoring practices in annotation; a supplier that cannot answer may lose orders. There is also a risk of misreading the case: treating the complaints as a conviction overstates the facts, while dismissing them wastes the window for remediation. Before regulators speak, working through the issues listed in the complaints one by one and keeping a record of it is more solid than changing the messaging, denying everything, or carrying on as before.
