This is for teams that pay EU-based contractors through a portal, check their identity with a selfie or a video, or run marketing tags inside a tool people log into to work. On October 27, 2026, the privacy group noyb filed five GDPR complaints against Scale AI over Outlier, its platform for freelance AI trainers. Read as a list of what not to copy, the complaints are useful well beyond Scale. Our verdict: the trackers and the unanswered access requests are the claims most likely to stick, and they are the cheapest for a small team to fix in its own setup this week.
Event date: October 27, 2026. noyb published the complaints that morning, and Reuters, Euronews and The Register reported them the same day. Scale AI told The Register the claims are "unfounded and inaccurate." We read noyb's announcement, Outlier's privacy policy and the EU texts the complaints rely on, and on October 28 we loaded Outlier's login page ourselves.
What noyb says Outlier does
The complaints were filed in four countries: two in Austria and one each in France, Italy and the Netherlands, according to Euronews. They build on a DiPLab report on Outlier, "Surveillance at Scale", published earlier this month. Outlier has more than 900,000 freelance workers, noyb says. The complaints make three claims.
- Trackers while people work. noyb says trackers "from companies such as TikTok, LinkedIn, Facebook, the survey platform Sprig and the data analysis company Datadog" are placed on workers' devices while they're on the platform, and "every few seconds, these trackers send the workers' personal data to third parties." Reuters, which saw the complaints, reports up to 19 trackers, "including recording keystrokes and mouse movements every few seconds." DiPLab found the resulting file could be rebuilt into a video that replays a whole work session.
- Repeated face checks. Workers have to go through Persona's verification "repeatedly", noyb says, and it "includes video recordings of their face and uploading their ID."
- No answer to access requests. Four workers asked Outlier for copies of their data between December 2025 and May 2026. None got an answer, the complaints say, according to Reuters.
noyb asks the authorities for a full investigation and suggests a fine. Scale AI's reply, given to The Register: "Outlier's practices are disclosed to contributors and require their consent. We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment."
Screenshot: noyb, "AI training platform Outlier illegally surveils European platform workers", October 27, 2026. Captured October 28, 2026.
What we saw on Outlier's login page
We can't see inside a logged-in Outlier session, so we checked the part anyone can load. On October 28 at 02:16 UTC we opened Outlier's login page in headless Chromium, from an IP address in Vietnam, without touching any consent prompt, and logged every request. Before anyone signed in, the page made 86 requests to 9 outside services: TikTok's analytics (38), Datadog (16), Segment (12), FullStory (6), X (5), Sprig (3), Google (3, sign-in and tag manager), Meta (2) and one host we couldn't identify.
Chart: AI Policy Desk. Source: our request log from one page load of the Outlier login page, October 28, 2026.
Two caveats. A visitor in the EU may get a different page, because sites often switch tags on and off by region, and we don't know what loads after login. What the test does show is that four of the five companies noyb names (TikTok, Facebook, Sprig and Datadog) are wired into the login page itself, at least for a visitor outside Europe. Outlier's privacy policy says it shares personal information "with third-party social media networks, advertising networks, and websites, so that we can market and advertise."
Where the consent argument gets thin
Scale's answer leans on consent. Its own privacy policy, as we read it on October 28, gives a different legal basis for the face checks. It says Outlier and providers "like Persona" may, "when you sign up to use the Services and at regular intervals thereafter," collect "images and video or audio recordings of you," and it calls this data something that "may be considered" biometric. The legal basis it lists for identity verification is "our legitimate interest in minimizing the amount of fraud."
GDPR Article 9 prohibits processing "biometric data for the purpose of uniquely identifying a natural person" unless one of the exceptions in Article 9(2) applies. Legitimate interest isn't on that list. Explicit consent is, but Recital 43 says consent is not a valid ground "where there is a clear imbalance between the data subject and the controller." That is the argument we'd expect for a worker who can't get paid without passing the check. The trackers fall under a separate rule: under the ePrivacy Directive, storing or reading information on someone's device "is only allowed on condition that the subscriber or user concerned has given his or her consent."
That's our reading of the texts, not a ruling. Four national authorities now decide.
| What the complaints target | The rule | What it says | It reaches a small team when |
|---|---|---|---|
| Trackers on workers' devices | ePrivacy Directive, Art. 5(3) | Storing or reading information on a device needs consent | You run ad or analytics tags in a portal contractors have to use |
| Face and ID checks | GDPR Art. 9(1), with the Art. 4(14) definition | Biometric data used to uniquely identify a person is prohibited unless an Art. 9(2) exception applies | You or a vendor take selfies, video or ID scans from contractors or candidates |
| Unanswered access requests | GDPR Art. 12(3) | Answer within one month, extendable by two months | Anyone in the EU asks what you hold on them |
| Data collected outside work time | Platform Work Directive, Art. 7(1)(c) | No collection while the person "is not offering or performing platform work" | You are a digital labour platform (national laws due December 2, 2026) |
| One-to-many face matching | Platform Work Directive, Art. 7(1)(f) | No identification against stored biometric data "in a database" | Same |
Screenshot: Directive (EU) 2024/2831 on improving working conditions in platform work, Article 7, EUR-Lex. Captured October 28, 2026.
Who this reaches beyond Scale AI
The Platform Work Directive is narrower than the coverage around it. Its Article 7 limits bind "digital labour platforms", apply "from the start of the recruitment or selection procedure", and member states have to adopt the national laws "by 2 December 2026." Most small teams aren't platforms. The GDPR and ePrivacy points apply to anyone, though. A 12-person agency that pays freelancers through a portal with a Meta pixel on it, or that verifies new hires with a selfie video, has the same three questions to answer as Scale does.
The Directive also draws the line we'd use for face checks. Recital 41 keeps "one-to-one verification or authentication" possible, meaning a match against data "previously provided by that same person", where the processing is lawful under the GDPR. Matching a selfie to the ID the same person just uploaded is a different act from searching a database of faces, and a narrower one to defend.
Screenshot: Directive (EU) 2024/2831, Article 29, EUR-Lex. Captured October 28, 2026.
What to check this week
- List the tags in anything contractors log into. Open your contractor portal, time tracker or task tool in a private window with the browser's developer tools on, and write down every outside domain it calls. Ad pixels from Meta, TikTok, LinkedIn or X have no business on a page where people work. Remove them, or put them behind consent the person can refuse without losing work.
- Find your face checks. If you or a vendor take selfies, video or ID scans from contractors or candidates, note the vendor, the retention period and the legal basis your privacy notice gives. If the notice says "legitimate interest" for biometric matching, fix that line first. Keep the check one-to-one, and keep the images no longer than the check needs.
- Ask whether monitoring stops when work stops. Keystroke, screenshot and activity trackers should run only during paid sessions. Ask your vendor in writing whether its agent keeps collecting after a task is closed, and keep the reply. Our employee monitoring tracker covers the US notice rules if your contractors are there too.
- Put access requests on a clock. Log the date each one arrives. You have one month, and you can extend by two only if you tell the person why within the first month. Four unanswered requests are a whole complaint here.
- Write it down. Add each tracker and each verification vendor to your record of processing, with its purpose and legal basis. Our Article 30 template has the columns.
If you work on Outlier and want to know what it holds on you, the access request is the same tool the complainants used. Send it in writing and keep the date.
What people said
Outlier workers have been arguing about this since before the complaints. In an r/outlier_ai thread on October 14 about getting Outlier to delete personal data, one user asked: "So all of my voice and face recordings will forever be with them? What happened to the right to be forgotten?" Another answered that "some of your info has to be retained for tax and legal purposes", partly so a former worker can't "come back pretending to be a totally new person." Both have a point, and the second is exactly why a retention period has to be written down rather than assumed.
The thread that brought the DiPLab report to the subreddit on October 15:
https://www.reddit.com/r/outlier_ai/comments/1x6gc0y/report_on_outlier_extensive_privacy_violations/
What we could not confirm
We have not seen the complaints themselves. What they allege comes from noyb's announcement and from Reuters, which saw them. We couldn't test a logged-in session or a connection from the EU, so the 19 trackers and the keystroke recording are noyb's and DiPLab's findings, not ours. We don't know which national authorities will lead or how long they'll take. Scale AI disputes the claims, and nothing has been decided.
Related Reading
- Employee Monitoring Laws by State: AI Notice Tracker 2026
- Meta MCI Leak: What Your Employee Monitoring Policy Must Say
- Anthropic ID and Face Scan Checks: What They Mean for Teams
- GDPR Article 30 RoPA Template for AI Tools
- AI Data Privacy for Small Teams: GDPR and CCPA Checklist
- AI Agent Workforce Policy Template for HR Teams
