Scale AI, the company that helps teach AI models how to behave, is now accused of behaving badly itself. European privacy group noyb has filed five complaints under the EU’s General Data Protection Regulation (GDPR), alleging that Scale unlawfully monitors contractors who work on its Outlier platform.
The complaints were filed on October 27, 2026, across four EU countries: France, Italy, the Netherlands, and Austria.
What noyb is alleging
Outlier is where Scale recruits freelancers to do the unglamorous work behind modern AI. Contractors label data, grade chatbot answers, and complete other tasks that help models improve.
According to noyb, the work comes with an uninvited supervisor. The group alleges that up to 19 different trackers were reportedly deployed on contractor devices.
Those trackers allegedly capture keystrokes and mouse movements. They also allegedly monitor activity both during work sessions and outside of them.
noyb further alleges that data collected this way was sent to third parties, including LinkedIn and TikTok.
The complaints also take aim at biometric verification. noyb alleges Scale ran these identity checks without adequate justification, which raises its own GDPR compliance questions. Biometric data sits in a particularly sensitive category under European privacy law.
Finally, workers reportedly waited months for answers after asking Scale what personal data it held on them. Under GDPR, people can request that information.
Why Scale is a big target
Scale AI is not a scrappy startup operating in obscurity. The company relies on a workforce of more than 900,000 freelance contractors around the world.
The company also has a very large and very famous backer. In June 2025, Meta acquired a 49% stake in Scale AI for $14.3 billion. That deal valued Scale at more than $29 billion.
Filing in four countries at once is also a deliberate move. Each national data protection authority can examine the complaint under its own procedures. For Scale, that means facing several regulators instead of just one.
What this means for Scale and the AI industry
For Scale, the immediate risk is regulatory. Data protection authorities in France, Italy, the Netherlands, and Austria will each decide how to handle the complaints.
None of the allegations have been tested by a regulator yet. They remain claims made by an advocacy group, and Scale’s response will be a key part of how the cases develop.
Still, the substance of the complaints targets practices that are hard to defend in Europe. Alleged off-hours tracking, alleged data flows to social platforms, and biometric checks without clear justification each touch areas that GDPR treats seriously.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.