A privacy complaint aimed at the AI supply chain
Noyb, the Austria based privacy advocacy group with a track record that already includes a 530 million euro fine against TikTok and a 1.2 billion euro fine against Meta, filed five separate GDPR complaints on October 27 against Scale AI in France, Italy, the Netherlands, and Austria, where it filed two distinct complaints covering slightly different aspects of the same underlying practices. The target of all five filings is Scale's Outlier platform, which the company uses to coordinate work from more than 900,000 freelancers worldwide who generate and label the training data that today's frontier AI models depend on.
The complaints matter well beyond Scale itself because the company's customer list includes Google, Meta, and OpenAI, and Meta separately owns nearly half of Scale outright through its own investment stake. Any enterprise currently running AI products built on models trained with Scale sourced data is, several steps removed from the original complaint, now connected to labor practices that sit under formal privacy complaint in four separate European jurisdictions simultaneously, whether that enterprise is aware of the connection or not.
What the surveillance allegedly looked like
Noyb's complaints describe ongoing tracking of freelancers' web activity while they generate training data for Scale's clients, with some documented cases recording mouse clicks and keystrokes at intervals of just a few seconds throughout an entire shift. The group argues that level of granularity in the collected data could realistically be used to reconstruct something close to video of a worker's entire workday from start to finish. Separately, noyb found trackers collecting IP addresses, contact details, unique device identifiers, and detailed information about visited pages, data the group argues could plausibly support targeted advertising rather than simply monitoring task completion as Scale has claimed.
An analysis of devices used by French freelancers identified 18 distinct third party trackers running simultaneously, including ones associated with TikTok, LinkedIn, Facebook, Sprig, and Datadog. Noyb spokesperson Mickey Manakas said that count is likely incomplete, telling reporters there are definitely more trackers present than the investigation managed to catalog. The complaint also flags that Scale requires face video and government issued ID documents submitted through a third party identity verifier called Persona, as a baseline condition of being allowed to work on the platform at all.
The legal theory behind the complaints
Noyb's core legal argument is that Scale lacks a valid legal basis under GDPR for deploying this level of continuous tracking, and that the practices violate the regulation's data minimization requirement, which limits data collection strictly to what is genuinely necessary for a clearly stated purpose rather than whatever a platform finds operationally convenient. Lisa Steinfeld Leiser, a data protection lawyer at noyb, said the constant and extensive tracking documented here goes against all reasonable expectations any worker would reasonably have while simply doing their assigned job for a client.
The complaint also cites a more specific and procedurally straightforward failure worth noting separately. Four freelancers submitted formal data access requests between December 2025 and May 2026 that noyb says went entirely unanswered by the company. Unanswered data access requests are often an easier claim for regulators to act on quickly than the broader surveillance allegations, because they involve a clearly documented request paired with a clearly documented non response, rather than a more subjective dispute over proportionality that can take years to resolve through litigation.
Scale's response and the gap it leaves open
A Scale AI spokesperson disputed noyb's characterization of the third party trackers found on worker devices and defended the company's biometric verification process as entirely appropriate, telling reporters directly that the report's claims are unfounded and inaccurate. The company says it records screen activity and task duration only when workers affirmatively opt in beforehand, that identity verification helps combat fraud and misuse while supporting compliance with European law, and that workers can request deletion of their personal data at any time they choose to do so.
Those denials leave the specific unanswered data access requests entirely unaddressed, and they do not meaningfully engage with the granularity noyb describes in its filing, namely mouse clicks and keystrokes captured every few seconds throughout a working shift. Regulators reviewing these complaints will likely focus closely on whether the opt in consent Scale describes was genuinely informed and freely given, given the real power imbalance between a freelance labor platform and workers who depend on steady task assignment for their actual income.
Why enterprise AI buyers should care
This case is a useful reminder that meaningful AI governance has to extend well beyond the model card itself and reach into the data pipeline that actually produced it. The training data pipelines behind widely deployed enterprise AI products increasingly depend on a global contingent labor force whose working conditions are now drawing direct regulatory scrutiny, and that scrutiny can reach back toward the labs themselves and, eventually, toward enterprise customers who are starting to ask harder questions about data provenance before signing new contracts.
If regulators act on noyb's complaints with anything resembling the fines the group has previously secured against TikTok and Meta, expect real downstream pressure on AI labs to audit and potentially restructure their data labeling supply chains entirely. For enterprises building out formal AI governance frameworks, supply chain labor practices belong squarely in the same risk register as model security and data residency, not treated as a separate ESG concern handled quietly by an entirely different team somewhere else in the organization.
