Scale AI Faces Privacy Complaints Over Outlier Worker Surveillance

Scale AI is facing five privacy complaints filed by European digital rights organization noyb over alleged surveillance of freelance workers on its Outlier platform, which supplies human-generated data used to train artificial intelligence systems.

The complaints, filed in France, Italy, the Netherlands and Austria, allege that tracking tools monitor workers’ keyboard and mouse activity and that repeated identity checks may violate European data protection rules.

The allegations have not been adjudicated, and Scale AI had not immediately commented when Reuters reported the complaints on October 27, 2026.

The case puts a spotlight on the people behind modern AI systems: contractors who evaluate model responses, label data and complete specialized tasks that help AI companies train and improve their products.

It also raises questions about how platforms collect workers’ personal information, explain their monitoring practices and respond when contributors request access to their data.

According to Reuters, the complaints draw on research by the Distributed AI Research Institute’s DiPLab project.

The research alleges that Outlier uses multiple tracking tools to record keyboard and mouse activity at frequent intervals, potentially allowing sessions to be reconstructed as video.

The complaints also challenge identity-verification procedures involving government identification documents and facial video.

The claims remain allegations.

Their legality and the extent of any violations will depend on the evidence and the assessments of the relevant data protection authorities.

What the complaints allege about Outlier’s tracking systems

Outlier is an online platform through which freelance contributors complete tasks used in AI development.

Work can include evaluating AI-generated answers, following detailed instructions, comparing model outputs and producing specialized training data.

The complaints allege that the platform’s monitoring goes beyond what is necessary to assess the quality of submitted work.

According to Reuters’ account of the filings and associated research, as many as 19 trackers may record keyboard and mouse movements every few seconds.

The researchers say this information could make it possible to reconstruct a worker’s activity as a video-like session.

That distinction matters because monitoring the final result of a task is different from collecting a detailed record of how a person interacts with a computer.

The latter can potentially reveal information about work habits, browsing behavior, mistakes, pauses and activity outside the immediate task, depending on how the tracking system is configured.

The available reporting does not establish that every Outlier worker is monitored in the same way, that every recorded action is retained indefinitely or that unrelated personal information has been collected in every case.

Those questions require evidence about the specific tools, their configuration, the data collected and the purposes for which it is processed.

The privacy complaints ask regulators to examine whether the alleged practices comply with European data protection requirements.

Why the identity-verification process is also under scrutiny

The complaints also challenge repeated identity checks that reportedly require workers to submit identification documents and video of their faces.

Identity verification can serve legitimate purposes, including preventing impersonation, fraud and unauthorized account access.

However, the collection and processing of identity documents and facial images raise separate privacy questions, particularly when verification is repeated or when biometric data is processed.

Under the European Union’s General Data Protection Regulation, biometric data processed for the purpose of uniquely identifying a person receives special protection.

Not every photograph or facial video automatically constitutes special-category biometric data under the law; the purpose and technical processing matter.

Regulators would need to establish what Outlier collects, how the information is processed, the legal basis for that processing and whether the requirements for any applicable biometric-data exception are satisfied.

The complaints argue that the verification procedures raise concerns under European data protection rules.

That is an allegation for regulators to assess, not a final legal determination.

For online work platforms, the issue is practical as well as legal: workers may have limited alternatives if a platform makes identity checks a condition of accessing paid tasks.

Clear explanations of why verification is necessary, how often it occurs, how information is stored and when it is deleted can help users understand the risks and their rights.

Complaints also question how Outlier allocates work

The filings reportedly raise concerns about the way Outlier distributes tasks and uses incentives to encourage workers to complete them.

Reuters reported that the platform uses gamified incentives, including bonuses reportedly worth $100 to $200 for completing 200 tasks in 24 hours.

The complaints also point to the platform’s control over workers’ access to available assignments.

These practices matter because access to tasks can directly affect a contractor’s ability to earn money.

Incentives tied to high output may encourage contributors to work quickly, while the platform’s control over task availability can leave workers with limited visibility into how assignments are distributed.

However, the existence of productivity bonuses or platform-managed task allocation does not by itself establish a privacy violation or unlawful employment practice.

The central legal questions depend on the facts, the terms governing the relationship, the data collected and the applicable laws.

The complaints ask regulators to examine the relevant practices rather than treating the platform’s operational model as automatically unlawful.

Workers reportedly received no response to personal-data requests

Another concern involves requests for access to personal information.

According to Reuters, four workers who requested copies of their personal data between December 2025 and May 2026 reportedly received no response.

Under the GDPR, individuals generally have the right to request access to personal data held about them and obtain information about how it is processed.

Organizations ordinarily must respond without undue delay and within one month, although the regulation allows limited extensions in certain circumstances and provides for exceptions and restrictions.

A request for access can be important when a worker wants to understand what information a platform has collected, whether activity monitoring is involved, how data is used and whether information is shared with other parties.

The reported lack of responses is an allegation that regulators can investigate.

The available reporting does not provide the full correspondence for each request, the precise responses received, or whether any legal exception or extension was invoked.

Those details should be established before drawing a definitive conclusion about compliance.

For companies processing large volumes of contractor data, the issue extends beyond publishing a privacy policy.

They need workable procedures for receiving, verifying, tracking and answering data-subject requests within the required timeframes.

What European privacy law could mean for Scale AI

The complaints have been filed across four European countries, with noyb asking the relevant authorities to investigate the alleged practices.

The proceedings could examine whether the collection of activity data is lawful, whether identity checks comply with the rules governing personal and biometric information, and whether the platform has met its obligations when workers request access to their data.

The GDPR does not prohibit all workplace or platform monitoring.

Instead, the law imposes requirements on the collection and use of personal information, including lawfulness, fairness, transparency, purpose limitation, data minimization and storage limitation.

Organizations must identify an appropriate legal basis for processing and comply with additional conditions where special-category data is involved.

Whether a particular tracking practice is lawful depends on its actual design and context.

Relevant questions may include what data is captured, whether monitoring is necessary for a specified purpose, whether less intrusive methods are available, how workers are informed, who can access the records and how long they are retained.

If authorities identify infringements, the GDPR provides a range of corrective powers, which can include orders to bring processing into compliance and administrative fines where legally justified.

No outcome should be assumed before the authorities assess the evidence and follow the applicable procedures.

The complaints are therefore an important regulatory development, but they are not equivalent to a finding that Scale AI has violated the law.

Scale AI’s position and the wider AI industry

Scale AI provides data services that help companies develop and evaluate AI systems.

Its Outlier platform connects contributors with tasks used in the development of AI models.

Reuters reported that the platform has more than 900,000 freelancers and that Meta owns a 49% stake in Scale AI.

The scale of this workforce helps explain why the complaints could attract attention across the AI industry.

Training and evaluating models often require substantial human input, including work performed remotely by contractors in multiple countries.

The systems used to manage that work can process information about task performance, account activity and identity.

The allegations also follow wider scrutiny of the working conditions and data practices associated with AI training.

In April 2026, The Guardian reported on contributors performing data-collection and labeling tasks through platforms associated with Scale AI, including work involving online material.

That reporting addressed different issues from the current privacy complaints, but it illustrates the broader public interest in how AI training operations are organized and supervised.

Scale AI’s own published privacy documentation distinguishes between different groups of people connected to the company and directs task contributors to the relevant Outlier or Remotasks privacy policy.

The existence of a privacy policy does not, on its own, establish that a particular practice complies with the law; the actual collection and use of data must match the applicable legal requirements and disclosures.

At the time of Reuters’ report, Scale AI had not immediately commented on the new complaints.

The company’s substantive response, if provided, will be important context for understanding how it explains the tracking tools, identity checks and data-access procedures under scrutiny.

What this means for people doing AI training work

For freelance AI workers, the case highlights several practical questions worth asking before sharing identity documents or using a work platform.

Workers should review the privacy notice that applies specifically to their platform and contractor relationship.

They should look for clear explanations of whether keyboard activity, mouse movements, screenshots, screen recordings, device information or identity-verification data are collected.

They should also check whether the platform explains why each category of information is needed, how long it is retained, who receives it and how to exercise applicable privacy rights.

Where a notice is unclear, workers can ask the company to clarify its practices and retain a copy of the request.

People in the European Economic Area may have rights under the GDPR to access their personal data, request correction, seek erasure in qualifying circumstances, object to certain processing or ask for restrictions, subject to the relevant legal conditions.

A person’s rights depend on the nature of the data and the circumstances; not every request must be granted in every case.

Workers should not assume that a complaint filed by a privacy organization has already established that a platform acted unlawfully.

They can, however, use the case as a reason to understand what information they provide, what monitoring they agree to and which authority handles privacy complaints in their country.

What happens next?

The relevant European data protection authorities will need to assess the complaints and decide what action, if any, is warranted.

Their work may require examining the platform’s technical tracking systems, privacy notices, identity-verification procedures, data-retention practices and responses to workers’ access requests.

The authorities may also need to determine which legal entities are responsible for particular processing activities and how the alleged practices operate across different jurisdictions.

The number of complaints does not predetermine the outcome, and the filing itself is not a ruling on the merits.

For the wider AI sector, the case raises a straightforward question: how can companies collect enough information to manage distributed AI training work without gathering more personal data than they need?

The answer will depend on transparent policies, proportionate monitoring, defensible legal bases and practical mechanisms for people to exercise their rights.

The immediate development is clear: noyb has filed five complaints challenging alleged worker surveillance and data-handling practices at Outlier.

Whether those practices breach European law remains for regulators to determine.

SOURCES

1. Channel NewsAsia, carrying Reuters reporting — Privacy group files complaints against Scale AI over alleged worker surveillance
   Provides further details on the reported monitoring tools, identity checks, incentives and concerns about task allocation.

2. The Guardian — “Porn, dog poo and social media snaps: the ‘taskers’ scraping the internet for AI firm part-owned by Meta”
   Provides broader reporting on the people performing data-collection and labeling work associated with Scale AI.

3. Scale AI — Privacy Policy
   Provides the company’s published privacy information and describes certain privacy rights and contact procedures.

4. Scale AI — Personnel, Applicant, and Candidate Privacy Policy
   Clarifies that different privacy policies apply to different groups and directs task contributors to the relevant Outlier or Remotasks policy.