The infrastructure behind your favorite LLMs is facing a serious compliance audit. noyb has filed five GDPR complaints against Scale AI, the US company operating the data annotation platform Outlier AI. The complaints, lodged in France, Italy, the Netherlands, and Austria, allege that Scale AI is illegally surveilling European platform workers. With more than 900,000 "freelance" annotators training models for giants like Meta, OpenAI, xAI, Google, Anthropic, and the US government, the scale of this potential violation is massive.

Invasive Tracking and Third-Party Data

Technical analysis reveals that Outlier’s platform injects trackers from TikTok, LinkedIn, Facebook, Sprig, and Datadog onto workers' devices. These trackers send personal data, including IP addresses, contact details, unique identifiers, and information about visited pages, to third parties every few seconds. Lisa Steinfeld Leiser, a data protection lawyer at noyb, stated that such extensive tracking violates reasonable expectations, asking why LinkedIn or Facebook should know which tasks a worker is performing. The lack of a valid legal basis for this consent-free tracking is a core component of the complaints.

Biometric Verification Risks

Beyond digital tracking, Scale AI enforces biometric verification through Persona, requiring video recordings of faces and ID uploads. This process is criticized for exceeding necessary data minimization principles, especially given Persona’s security history. In October 2025, hackers exposed approximately 70,000 government-issued ID photos stored with Persona. Furthermore, Persona’s terms allow them to collect extensive data, including geolocation and consumer credit information, raising significant privacy concerns for the workforce.

Regulatory Response and Industry Impact

Scale AI failed to respond to data access requests from complainants, violating the GDPR’s right of access. Thomas Le Bonniec from DIPLab described platform work as fertile ground for unacceptable workplace surveillance, thriving on deliberate lack of transparency. Baptiste Delmas of Intérêt à Agir emphasized that the AI boom relies on a workforce whose privacy is at stake, calling for strict enforcement measures from data protection authorities. The complaints are part of the broader AI-WORLD initiative examining working conditions across AI value chains.

Key Takeaways

  • noyb filed five GDPR complaints against Scale AI in four European countries.
  • Outlier AI tracks workers with third-party scripts from TikTok, LinkedIn, and Datadog.
  • Biometric verification via Persona is challenged for excessive data collection and security risks.
  • Scale AI ignored GDPR data access requests, compounding legal violations.

The Bottom Line

If your AI pipeline relies on human-in-the-loop data, check your vendor's privacy compliance. The days of ignoring GDPR for the sake of rapid development are ending, and the bill is coming due.