Executive Summary

Key Numbers

Sources: noyb's release (October 27, 2026) and the itemized reporting on the complaints by The Record and PPC Land

noyb is a privacy organization based in Vienna, Austria. The lawyer Max Schrems founded it in 2017, and it has since brought complaints against big technology companies before regulators across Europe. On October 27, 2026, the group filed five complaints against Scale AI. Three organizations joined it: Intérêt à Agir in France, DiPLab, which researches platform work, and Reversing.Works, which has reverse-engineered working conditions out of the technology itself.

The filings were split across the regulators of France, Italy, the Netherlands and Austria, with two of the five going to Austria. Each complaint is brought on behalf of a single worker on Outlier, so five people in all. Article 80(1) of the GDPR opens the route for an organization to lodge a complaint on a person's behalf.

Outlier, where all of this takes place, is the freelance work platform Scale AI runs. More than 900,000 people are registered on it. Their job is to score the answers a model produces, write better answers themselves, and attach labels to images and text. Scale AI supplies that output to Meta, OpenAI, Google, xAI, Anthropic and U.S. government agencies. Meta bought 49 percent of Scale AI in June 2025, becoming both customer and largest shareholder.

What noyb asks the regulators for is a full investigation into whether the law was broken and, if it was, a fine. A third request goes with those two. According to The Record, the group also wants them to "study the way tasks are allocated by Scale." Trackers and biometric records raise the question of what gets collected; task allocation raises the question of who gets which job. The articles the complaints have in common are Article 5(1)(c) on data minimization, Article 12(3) on the deadline for answering an access request, Article 15 on the right of access itself, Article 25(1) on protection built in by design, and Article 28(1) on the guarantees required of processors. Added to those is each country's national implementation of Article 5(3) of the ePrivacy Directive, the clause that requires consent before a tracker is placed.

A tracker is a small piece of code loaded into a web page that reports what happens on that page to an outside company. The French complaint says code of that kind on the Outlier work screen reports outward to eighteen destinations. On the advertising and social side there are Facebook, LinkedIn, TikTok, Snapchat, Quora and Twitter Analytics. On the usage-measurement side, Google Analytics, Amplitude, Posthog and Segment. Then the survey tool Sprig, the error tracker Sentry, the customer support tool Forethought and the recruiting service Recruitics. Persona, the identity-verification company, is on the list as well.

The list is not the same in every country. The Dutch complaint rests instead on a log one worker made of their own device's traffic on May 22, 2026, and seven were caught there. Mickey Manakas, a noyb spokesperson who spoke to The Record, said there are definitely more, and that "the number of trackers identified varies by country and is not comprehensive since noyb focused primarily on social media trackers and analytics." Eighteen, then, is not a settled count for the platform. It is what one filing in France counted.

noyb's release picks out five trackers as representative, and one of them is missing from the French list: "the data analysis company Datadog." PPC Land describes it as a name "which appears in the second Austrian complaint." That is why Datadog does not appear among the eighteen laid out below. The upper part of the diagram holds the eighteen the French complaint counted, and the box underneath holds the seven the Dutch complaint caught on the same platform.

The entry noyb weighs most heavily is Fullstory. It belongs to a category called session replay, which records what a user did on screen so the sequence can be played back like video. The French complaint says the tool captured mouse movement, clicks and keystrokes and sent requests outward at intervals of a few seconds. In noyb's reading, records gathered this way could be assembled into video of a freelancer's entire working day.

Working on Outlier means passing an identity check, and Scale AI does not run that check itself. An outside company called Persona handles it. The worker uploads an ID document and records a video of their own face. noyb's objection is that the check does not end after one pass but is demanded again and again.

Data that measures the shape of a face in order to tell one person from another falls into a category the GDPR sets apart and treats more strictly. Processing it is prohibited in principle and permitted only through narrow exceptions. The point noyb presses is that the collection reaches wider than the purpose of verifying identity. According to the release, Persona's own terms claim the right to take IP addresses, device information, location, postal address and credit-related information on top of the biometric record. The complaints invoke the data minimization article on the ground that this gathers more than it takes to confirm that a person is who they say they are.

There is one more layer in the structure. The worker's contract is with Scale AI, while the party actually holding the most sensitive material is a subcontractor that Scale AI chose. That is where Article 28(1), the requirement of guarantees from processors, enters the filings. Whoever hands data over has to hold an assurance that the party receiving it follows the rules. A question of the same shape arrives for any company buying data. Does the contract reach as far as the subcontractor's subcontractor?

The third issue is simpler than the other two. Four freelancers asked for a copy of the personal data collected from them between December 2025 and May 2026, and noyb says Scale AI answered none of them.

The right of access is set out in Article 15, and Article 12(3) requires an answer within one month at the latest. Two further months are available when the circumstances call for them, but even then the reason for the delay has to be communicated inside the first month. Silence is not among the options. Where the first two issues put two readings of the same question — whether there is a lawful basis for the processing — against each other, this one needs only a look at whether a reply went out. It is also the fact a regulator is most likely to check first.

An answer would itself have produced evidence. Had the access requests been handled properly, the company would have had to set out what it collects about one person, from where, and how much. Part of why the complaints fell back on methods like traffic captures to count tracker names is that the list never arrived.

Scale AI told The Register that "the report's claims are unfounded and inaccurate," and that "Outlier's practices are disclosed to contributors and require their consent." The company calls the people who work on Outlier contributors rather than workers. It added that tools recording screen activity and working time are used on some projects, but that contributors switch them on by choice. Its position is that it does not sell personal data to third parties and does not use it to train customers' AI. Biometric verification, it says, is a step taken to prevent fraud and to stay within the law.

The two accounts look like a head-on collision, but read closely they answer different questions. The company says consent was obtained; noyb asks whether that consent works as a lawful basis. For consent to hold under the GDPR it has to be freely given, and what is at issue is whether that freedom exists between a platform and someone who has to be on it to get work. The minimization issue, that the collection is wide relative to the purpose, remains separate even where consent exists.

Neither side has been judged yet. A complaint is a report, not a regulator's conclusion. How five filings scattered across four countries will be bundled, and which authority will hold the lead, is undecided as well. The fame of the complainant is no reason to sketch the ending in advance.

The paperwork that moves when training data is bought and sold usually records volumes and unit prices, quality metrics and delivery dates. It does not record what screen the people who made that data worked at, or what traces they left while working. What these complaints change is the nature of that blank. Working conditions used to be the supplier's own business. From the moment they reach a regulator, they turn into a price attached to the supply chain.

There is a place where the buyer is exposed directly, too. Labeling work usually runs with the buying company's material loaded onto the supplier's platform. If third-party trackers are loaded on that screen, it is not only the worker's behavior that leaves the building. Part of our own material, displayed on that screen, can travel with it. Session replay is by design a tool that records whatever is visible.

For anyone on the buying side of labeled data, three things can be settled in writing before the next contract.

• Which third-party code runs on the work screen. Request the list from the supplier, then ask separately whether screen recording or input logging is among them.
• Whether the screen holding our material gets recorded. If it does, does the contract say where that record is stored, who can view it, and how long it stays?
• Who answers when a worker asks for their own data. Has responsibility been assigned, covering the identity-verification, payment and analytics companies the supplier relies on?

None of the three asks about the accuracy of a label. What they ask about is the structure of the place the label was made in. The idea that data needs a lineage attached so it can be traced back later does not apply only to origin and processing history. The conditions it was made under are a line in that lineage as well, and when that line is blank there is no way to check whether the data we bought is caught up in a legal problem that has surfaced somewhere in the supply chain.

Thanks for reading this far. The substance of the complaints is set out in noyb's release, and Scale AI's rebuttal is collected in The Record's reporting. If you have ever written working conditions or the scope of data handling into a contract with a labeling supplier, we would like to hear how that sentence came out.

Primary Source

• 1.noyb. (2026). "AI training platform Outlier illegally surveils European platform workers." noyb — European Center for Digital Rights, 2026-10-27.

Press

• 2.The Record. (2026). "European digital rights nonprofit noyb sues Scale AI for 'invasive' worker surveillance." Recorded Future News, 2026-10-27.
• 3.The Register. (2026). "EU privacy advocates accuse US data annotation firm of snooping on contractors." The Register, 2026-10-27.
• 4.PPC Land. (2026). "Scale AI faces 5 GDPR complaints over tracking of Outlier AI trainers." PPC Land, 2026-10-28.