Uber now owes what regulators say is the second-largest fine in GDPR history — €825 million, or roughly $966 million — for letting algorithms suspend and, in some cases, permanently deactivate driver accounts without the human review and appeal rights EU law requires. The Dutch Data Protection Authority’s August 17, 2026 decision, reported by Reuters and relayed by outlets including KFGO and Yahoo Finance on August 21, found Uber violated both the right against purely automated decisions with significant consequences and the right to be informed. For any company running gig-worker platforms, fraud-scoring systems, or algorithmic HR tools in Europe, the operational bar just moved: a fraud flag or low-rating score can no longer trigger an account-ending action without a documented human check and a real dispute path.
What changes in practice is less about whether platforms can use automated fraud detection — the AP didn’t ban that — and more about who has to sign off before the algorithm’s output becomes final. Uber insists its current process already includes human review and dispute channels, and argues the fine is disproportionate given that only 126 drivers lost accounts across Europe in 2021 over low ratings, per the figure Uber cited to Reuters. But the AP’s finding suggests documentation and process design, not intent, are what regulators are pricing here: if a system can end someone’s livelihood, the burden is on the company to prove a human meaningfully intervened, not just that one theoretically could have.
A near-$1 billion fine for automated account suspensions tells every platform running algorithmic worker management that Article 22 compliance is now a balance-sheet line item, not a policy footnote.
This is also the fourth Dutch fine against Uber, and each has dwarfed the last — from €600,000 in 2018 to €10 million in early 2024 to €290 million over data transfers, and now €825 million, according to Dealroom’s accounting. That trajectory matters for data-market watchers beyond Uber: it shows a single national regulator, sitting where a company’s EU headquarters happens to be, can escalate enforcement pressure on the same firm repeatedly and steeply, effectively setting policy for the whole bloc under GDPR’s one-stop-shop mechanism.
Uber has said it will appeal, and Reuters noted that headline GDPR fines against large U.S. tech firms are often reduced or overturned after years-long appeals — Meta’s €1.2 billion Irish fine from 2023, still the largest ever, remains under appeal. So the $966 million figure is a ceiling, not a settled bill. The number to watch next isn’t just Uber’s appeal outcome but whether other regulators start applying the same automated-decision-making theory to AI-driven scoring, ranking, or moderation systems well beyond ride-hailing.
"The AP has determined that Uber violated drivers' rights, specifically the right not to be subject to automated decision-making that has…significant consequences," the decision said. "Uber has also violated the right to be informed," the decision said, saying the agency considered it a serious matter worthy of the large fine.
