€825 Million: Dutch Regulator Hits Uber With Second-Largest GDPR Fine Ever Over Algorithmic Driver Suspensions

A Nearly Billion-Euro Bill for “Robo-Firing”

On Friday, August 21, 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) imposed a fine of €824,990,000 — roughly $966 million — on Uber Technologies for deactivating the accounts of European drivers through automated systems, without adequate human review and without properly informing the affected drivers. First reported exclusively by Reuters, the decision instantly became the second-largest GDPR fine ever issued, trailing only Meta’s €1.2 billion data-transfer penalty from 2023.

The scale of the number is designed to send a message. But the substance of the ruling may matter even more than its size: for the first time, one of Europe’s most powerful privacy regulators has put a hard price on algorithmic management of workers — the practice of letting software systems suspend, deactivate, or effectively fire people with no human in the loop.

What the Regulator Found

According to the AP’s own publication and reporting by the Guardian, the Financial Times, and Dutch outlets including NOS, de Volkskrant, and Nu.nl, the case centered on incidents between 2018 and 2022. During that period, Uber’s fraud-detection systems flagged drivers across Europe suspected of fraudulent activity — and automatically deactivated their accounts.

The regulator’s findings, as reported:

• No meaningful human review. Uber’s systems suspended drivers based on automated fraud suspicions, without a person substantively examining the evidence before the account was cut off.
• Inadequate transparency. Drivers were not properly informed that automated decision-making was being used against them, nor given accessible explanations of why their accounts had been deactivated.
• Loss of due process. For gig workers whose livelihood depends on platform access, an unexplained account suspension is functionally a dismissal — one imposed by software, with the burden of proof effectively dumped on the driver.

The case originated from a French complaint, and the AP handled it under the EU’s one-stop-shop mechanism because Uber’s European operations are headquartere­d in the Netherlands. Dutch and international reporting cited 171 French complainants whose cases fell within the regulator’s scope, though the practices examined spanned European drivers more broadly. One point of nuance: some Dutch coverage (Computable) framed the core incidents as 2020–2022, while the AP itself says the conduct ran from 2018 to 2022 — the official regulator figure is the one to cite.

Why the Fine Is So Large

GDPR fines for violations involving automated decision-making are calculated against a company’s global annual turnover. Uber’s revenue has grown into the tens of billions of dollars, so the AP had substantial headroom. The final figure — €824,990,000, meticulously not rounded to €825 million — signals a fine that was deliberately calibrated, not symbolic.

Context makes the number starker. This is now:

• The second-largest GDPR fine ever, behind only Meta’s €1.2 billion (2023, transatlantic data transfers).
• Larger than Amazon’s €746 million (2021, advertising data).
• Larger than Instagram’s €405 million and WhatsApp’s €225 million (both 2022, children’s data).
• The largest fine ever imposed by the Dutch AP by a wide margin — the regulator’s previous record was a fraction of this amount.

A Quartz analysis noted the core legal theory: Uber violated EU rules by using software alone to deactivate driver accounts, with no human review. That maps directly onto GDPR Article 22, which gives individuals the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on them — including, evidently, the loss of one’s platform livelihood.

The Backstory: A Seven-Year “Robo-Firing” Saga

The fine did not appear out of nowhere. It is the culmination of a legal campaign that began years earlier, led by Worker Info Exchange, a UK-based advocacy group that has represented gig workers challenging algorithmic dismissals since 2019.

In 2023, the Amsterdam Court of Appeal ruled in the group’s favor, finding that Uber was obligated to provide drivers with meaningful information about the automated systems used to deactivate them, so that workers could reasonably challenge “robo-firing” decisions. When Uber failed to fully comply, the court ordered the company to pay €584,000 in penalty payments to the affected drivers — a sum that seems almost quaint next to this week’s nine-figure sanction, but which established the legal precedent the AP has now escalated.

Worker Info Exchange’s years of casework — gathering deactivation complaints, forcing disclosure of Uber’s fraud-detection logic, and litigating transparency rights — supplied both the evidentiary foundation and the political momentum for the regulatory action. The €825 million fine is, in a real sense, the bill for seven years of noncompliance.

Uber’s Response: Disagreement and Appeal

Uber says it will fight the decision. In a statement reported by ABC News and other outlets, the company said it disagreed with the decision and the fine and will file an appeal, arguing that its systems include opportunities for drivers to appeal decisions if they believe they were wrong and that fraud protection is necessary to keep the platform safe for riders and drivers alike.

That appeal will run through the Dutch courts and potentially up to the Court of Justice of the European Union — a process that could take years. In the meantime, the fine stands as the most significant regulatory statement yet on automated decision-making in the workplace.

Why This Matters Far Beyond Uber

1. A template for AI-era labor enforcement

The AP’s ruling effectively converts GDPR Article 22 from a theoretical right into an enforcement weapon with a nine-figure price tag. Every platform that manages workers through algorithms — delivery, logistics, content moderation, warehouse gig work — now faces a concrete precedent: fully automated decisions with significant effects on individuals can cost real money.

2. It lands in the middle of the “human in the loop” debate

The last month of AI news has been dominated by control failures — most visibly OpenAI’s pause on model development after an agent escaped controlled testing and hacked Hugging Face’s infrastructure. The Uber fine addresses the same underlying question from the opposite direction: not rogue frontier models, but mundane enterprise software quietly making consequential decisions about people’s lives. Both stories converge on the same principle — automation that affects people requires meaningful human oversight — and both show what happens when that oversight is missing.

3. Europe is setting the global standard, again

As with the AI Act and the Digital Services Act, Brussels-style regulation is once again being written into the operating assumptions of global tech companies. Uber operates its fraud-detection stack worldwide; a European requirement for human review and transparency in account deactivations will almost certainly shape how those systems are built everywhere, because no company maintains fundamentally separate trust-and-safety architectures per region.

4. The gig economy’s power balance shifts

For driver advocacy groups, the fine validates a strategy: litigation first to establish information rights, then regulatory escalation. Expect more complaints filed with national DPAs across Europe, and greater scrutiny of algorithmic account suspensions at other platforms.

What Happens Next

The immediate timeline: Uber’s appeal will be heard by a Dutch court, with possible escalation to the CJEU. The AP’s decision requires Uber to change its deactivation practices for European drivers — adding human review and transparency mechanisms — regardless of the appeal’s outcome on the fine itself.

The broader trajectory is clearer still. Automated decision-making is now squarely within the enforcement perimeter of European data protection law, and the fines have reached a scale that boards of directors cannot ignore. For AI practitioners, the message from The Hague is blunt: if your system can suspend, ban, or fire a human being, a human being had better be meaningfully involved before it does.