Uber Fined €825 Million for Letting Algorithms Fire Drivers — Europe's Second-Largest GDPR Penalty

Europe’s privacy regulators have just delivered one of the largest data protection penalties in history — and it landed squarely on the practice of letting algorithms fire people. On August 21, 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) announced a fine of nearly €825 million (about $966 million) against Uber for deactivating driver accounts through fully automated systems, without adequately informing the drivers and without any human being checking the decision first.

It is the second-largest GDPR fine ever issued, behind only Meta’s record €1.2 billion data-transfer penalty from 2023. It is also, arguably, the most consequential enforcement of GDPR Article 22 — the provision that gives people the right not to be subject to purely automated decisions with significant consequences — since the regulation took effect in 2018.

What Uber’s software did

According to the AP’s findings, Uber used software to continuously monitor two signals: drivers’ driving behaviour and their customer ratings. When the system flagged a suspicion of fraud, or when a driver’s customer reviews fell below threshold, the account was automatically deactivated. No human review occurred before the suspension took effect. The AP found this practice ran from 2018 through 2022.

The consequences for drivers were immediate and severe. “Uber has committed serious infringements. Drivers were deactivated without pardon,” said Monique Verdier, deputy chair of the AP. “From one moment to the next, they no longer had any income through Uber. That’s forbidden. A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being.”

For gig workers whose entire livelihood runs through the platform, an automated deactivation is functionally an automated dismissal — one that arrives with no explanation, no appeal channel visible to the driver, and no human to call. The AP concluded that Uber both violated the prohibition on fully automated decision-making and failed its transparency obligations: drivers were not sufficiently informed that such automatic decisions were being made about them at all.

A case that started with 171 French drivers

The enforcement action has unusually deep roots. The AP’s investigation began after 171 French drivers took their complaints to the Ligue des droits de l’Homme (LDH), a French human rights organization. LDH lodged a formal complaint with the French privacy regulator CNIL on the drivers’ behalf.

Because Uber’s European headquarters are in the Netherlands, the case then moved to the Dutch authority under the GDPR’s “one-stop-shop” mechanism, which routes cross-border cases to the lead supervisory authority where a company’s EU establishment sits. The AP cooperated closely with the CNIL during the investigation, and aligned the fine decision with other European supervisors before issuing it — a sign that the penalty reflects a coordinated European position rather than a single regulator acting alone.

How the €825 million figure was reached

European privacy regulators calculate fines using a common methodology, with a statutory ceiling of 4% of a company’s worldwide annual turnover. Uber’s global turnover was around €44.5 billion in 2025, putting the theoretical maximum near €1.8 billion. The €825 million penalty sits at roughly 1.85% of that base — large enough to sting, and a deliberate escalation from the previous fines Uber has absorbed from the same regulator.

This is, remarkably, the fourth time the Dutch DPA has fined Uber:

• 2018 — €600,000 for violating data breach notification obligations
• 2023 — €10 million for infringing drivers’ privacy rights, including obstructing data access
• 2024 — €290 million for unlawful transfers of EU drivers’ data to the US
• 2026 — €825 million for fully automated account deactivations

Uber is still contesting the 2023 and 2024 penalties; those procedures remain ongoing. The company has already filed an appeal against the new fine and has reportedly described the amount as disproportionate.

Why this matters beyond Uber

The fine matters on three levels.

First, it is a warning shot at the entire gig economy. Automated account suspension is not a Uber-specific practice — deactivation algorithms are standard tooling across delivery, ride-hailing, and freelance platforms. Every platform operating in the EU that terminates or suspends workers based on fraud scores, rating thresholds, or behavioural flags without meaningful human review is now on notice that Article 22 has teeth. The economic logic of platform moderation — automate first, review on complaint — is precisely what the AP has ruled illegal.

Second, it redefines the stakes for AI-driven decision systems generally. As companies rush to deploy AI agents for screening, triage, moderation, and fraud detection, the AP’s decision draws a clear line: consequential decisions about people require a human in or on the loop, and the people affected must be told when algorithms are making decisions about them. GDPR Article 22 predates the current AI boom, but it is now the most battle-tested legal instrument in the world for contesting automated decisions — and this fine shows regulators are willing to price violations near the billion-euro mark.

Third, it strengthens the enforcement playbook. The case demonstrates the one-stop-shop mechanism working as designed: complaints from individual workers in one member state were aggregated by a civil-society organization, escalated to a national regulator, transferred to the lead authority, investigated with cross-border cooperation, and resulted in a coordinated multi-supervisor-sanctioned fine. Worker advocates across Europe will study this path.

What happens next

Uber’s appeal will likely take years, judging by the pace of its pending challenges to the 2023 and 2024 fines. In the meantime, the AP notes that Uber has now stopped the violations — meaning the automated deactivation pipeline as investigated no longer operates in its 2018–2022 form.

But the deeper question the fine poses is forward-looking. Platforms and AI vendors frequently argue that human review at scale is economically impossible — that automation is the only way to police millions of transactions and ratings. The Dutch regulator’s answer is effectively: your business model does not get an exemption. If an algorithm can cut off someone’s income, a person must check it first, and the person must know it is happening.

For a technology industry building ever-more-autonomous agents, that principle is now attached to a nine-figure price tag. The era of “the algorithm decided” as a defense is, at least in Europe, drawing to a close.