Uber's €825 Million GDPR Fine: The Price of Letting an Algorithm Fire Drivers

On 21 August 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) published a decision that instantly became a landmark in the governance of automated decision-making: a fine of €824,990,000 — roughly $966 million — against Uber for deactivating driver accounts through automated systems without meaningful human review. It is the second-largest penalty ever imposed under the GDPR, behind only the €1.2 billion Ireland’s regulator levied on Meta in 2023. And unlike most AI-policy stories, this one did not require any new law: the machinery that produced it has existed on paper since 2018.

What Uber’s systems actually did

The violations span 2018 to 2022. During that period, Uber operated systems that continuously scored driver behavior and customer ratings. When the software flagged a suspected fraud incident, or when a driver’s average customer rating fell below a threshold, the account was deactivated — temporarily on a first flag, permanently when low ratings persisted. At no stage in that pipeline did a person assess the outcome before the decision took effect.

Because a driver’s income on the platform depends entirely on having an active account, deactivation meant an immediate, often unexplained, loss of livelihood. The AP’s findings describe a system where the affected person frequently could not even determine that a machine had made the call, let alone contest it on the merits.

The regulator’s legal reasoning maps cleanly onto three provisions of the GDPR:

• Article 22 — the prohibition on decisions based solely on automated processing that have legal or similarly significant effects on individuals, such as loss of income. No applicable exemption covered Uber’s use case.
• Articles 13 and 14 — transparency obligations requiring that people be informed when automated processing produces consequential decisions about them, including meaningful information about the logic involved. The AP found Uber’s notification practices fell short: a deactivation notice is not an explanation.
• Article 5’s fairness principle — underpinning the finding that scoring thresholds with livelihood-level consequences cannot operate in the dark.

Monique Verdier, deputy chair of the AP, summarized the case in one sentence that has since been quoted across Europe: “A computer should not make decisions on its own that have major consequences for you.”

How the case reached the Netherlands

The investigation did not begin in Amsterdam. It began in Paris: 171 French drivers, represented by the human rights organization Ligue des droits de l’Homme (LDH), filed a complaint with France’s CNIL. Because Uber’s European headquarters are in the Netherlands, the GDPR’s one-stop-shop mechanism routed the file to the AP as lead supervisory authority, with CNIL collaborating on the probe.

This is now the fourth Dutch penalty against Uber, and the cumulative total is striking: €600,000 in 2018, €10 million in 2023 (over retention terms and obstructed access requests), €290 million in 2024 (over unlawful driver data transfers to the US), and €824.99 million now — a nominal sum of more than €1.12 billion against a single company from a single regulator. Three of those four decisions remain open, as Uber is appealing the 2023, 2024, and 2026 penalties simultaneously.

Where the number comes from

GDPR fines are capped at 4% of worldwide annual turnover. The AP estimated Uber’s 2025 global turnover at roughly €44.5 billion, which sets the theoretical ceiling near €1.78 billion. The final penalty lands at about 1.85% of turnover — a little under half of what the regulator could have imposed, and calculated at the maximum 4% rate basis according to legal analyses of the decision.

For scale: according to the European Data Protection Board’s annual report published in April 2026, all data protection authorities across the European Economic Area combined issued roughly €1.15 billion in GDPR fines during the entire year of 2025. This single Uber decision is worth about 72% of that year-long, 30-country total.

The “meaningful human review” fight

Uber disputes the characterization. The company calls the fine disproportionate, argues that most suspensions were brief, that permanent deactivations always involved a human, and that drivers had channels to appeal. It has also emphasized that the examined practices were discontinued years ago, and that current policies build in human review before consequential action.

The AP’s contrary finding — that some permanent deactivations occurred without any human review — sets up the legally consequential fight: where exactly is the line between a system that flags a case for a person to decide, and a system whose recommendation is functionally the decision, rubber-stamped after the fact?

The AP’s own draft guidance on meaningful human intervention, opened for consultation in 2025, offers a blunt test: the person reviewing an automated outcome must have the standing to reverse it — and must actually reverse it when the file warrants. A reviewer who has never once said no is not oversight. That framing will matter far beyond ride-hailing, because nothing in the AP’s reasoning depends on transport or on whether a system is marketed as “AI.” Credit refusals, fraud blocks, automated account suspensions, eligibility screening, and revoked access all sit inside the same frame. Austria’s regulator reached a parallel conclusion about automated credit-scoring indicators in 2025, and a German administrative court has ordered Schufa to disclose how it computes individual scores.

Why this lands at the convergence of gig work and AI governance

The decision arrives at the exact moment two regulatory streams are merging in Europe. The EU’s Platform Work Directive, which member states must transpose into national law by 2 December 2026, contains its own algorithmic-management protections — including, in some configurations, a presumption of employment and explicit limits on automated deactivation. Draft implementations go further: Sweden’s inquiry (SOU 2026:3, delivered January 2026) proposes requiring platforms that are employers to negotiate with trade unions before introducing or changing automated monitoring or decision systems, to hand over data protection impact assessments, and to evaluate in writing at least every two years how automated decisions affect the people subject to them.

The Uber ruling previews how regulators intend to police this overlap: not by waiting for AI-specific rules to bite, but by applying existing GDPR machinery to platform labor practices right now. For any company that uses scoring systems, fraud models, or rating thresholds to manage a distributed workforce — food delivery, freelance marketplaces, logistics platforms — the signal is that “the algorithm decided” is no longer a viable shield.

One complication deserves honesty: the legal ground itself is shifting. The European Commission’s Digital Omnibus, published in November 2025, proposes reframing Article 22 from an individual right into a list of conditions under which automated processing is permitted — and states plainly that offering a human alternative does not stop a controller from deciding by machine alone. Had that text been law in 2018–2022, the AP would have been arguing a different case. Whether that reform survives is now entangled with the same decision it post-dates.

What happens next

Two things will determine how far this precedent reaches. First, the appeal: if Uber narrows the AP’s findings — particularly the claim that permanent deactivations bypassed human review — the precedent weakens considerably. An analysis published in May 2026 found nearly 40% of the €7.1 billion in announced GDPR penalties to date has been struck down or remains under challenge; Rome’s tribunal killed a €15 million OpenAI penalty on jurisdictional grounds, and Amazon’s €746 million fine went back to the regulator after a Luxembourg court intervened. Treat €824.99 million as an opening position, not a bank transfer.

Second, contagion: drivers’ unions and regulators in France, Germany, and the UK have long campaigned against automated deactivation and are likely to treat this decision as a template. The fine also lands amid rising transatlantic friction — Washington has threatened tariffs over what it calls unfair treatment of American firms by European regulators, and Uber’s penalty will become Exhibit A in that argument.

Either way, the operational takeaway for anyone building agentic or automated decision systems is already clear. Automated systems can flag, score, and recommend — but the moment a decision meaningfully affects someone’s livelihood, a human has to actually make it, and the person affected has to be told that’s what happened. In Europe, that sentence now carries a nine-figure price tag when you get it wrong.

Corrected attribution note: the €1.2 billion Meta penalty was imposed by Ireland’s Data Protection Commission in 2023 over EU-US data transfers; the AP’s cumulative Uber total is €1,125,590,000 across four decisions since 2018.