Five GDPR complaints against Scale AI put monitoring of European contractors on its Outlier AI platform under scrutiny. For AI teams buying annotation or evaluation services, the immediate question is whether vendor oversight of workers is necessary, transparent, and documented.
EU privacy advocates accuse US data annotation firm of snooping on contractors
Privacy campaigner noyb has filed five GDPR complaints in four EU countries against Scale AI, alleging unlawful monitoring of European contractors on its Outlier AI platform. The allegations concern the treatment of people doing AI data work, not a reported leak of customer datasets or a finding that a model was trained unlawfully. The complaints are allegations; they do not, by themselves, establish a GDPR violation. The Register reports the filings as a challenge to how contractor activity was monitored.
The four-country scope matters because the workers and the platform are part of a distributed operating model, while GDPR obligations attach to the processing of personal data about individuals in Europe. A US-based vendor cannot treat contractor activity data as outside privacy review simply because it is collected to manage work rather than to build a training set. The reported filings do not establish which measures regulators will assess or what remedies, if any, they might require. For now, the concrete development is the complaints and the compliance questions they raise.
For data leads, the distinction between monitoring work quality and monitoring a person is operationally important. An annotation workflow may need records of task completion, review decisions, and access to sensitive material; those records can still identify individual workers. Additional visibility into contractor activity calls for a separate explanation of purpose, scope, retention, and access. Teams should be able to tell workers what is collected and show why each category of data is needed for the stated purpose.
Buyers of outsourced AI data services should not assume their own privacy review ends at the dataset delivered by a vendor. Procurement and compliance teams can ask what worker-level information the platform collects, who can inspect it, how long it is kept, and which entities receive it. They should also clarify the parties' GDPR roles and how the vendor handles requests from affected workers. Those checks are useful regardless of the outcome of noyb's complaints: they expose gaps before monitoring practices become a contractual or regulatory dispute.
- Review contractor-monitoring practices alongside dataset governance, because records about individual workers may create a separate GDPR compliance obligation.
- Ask vendors to document the purpose and necessity of each category of worker-level activity data rather than treating all platform telemetry as routine operations data.
- Check notices, retention periods, access controls, and cross-border data flows before expanding annotation or evaluation programs that use European contractors.
- Track the complaints without treating them as an enforcement finding, and prepare to explain how your own workflows distinguish quality assurance from unnecessary surveillance.