Uber has been hit with one of the largest penalties ever imposed under Europe’s data protection rules after Dutch regulators fined the ride-hailing company €824.9 million, or nearly $1 billion, for using automated systems to suspend and deactivate drivers without adequate human oversight.
The Dutch Data Protection Authority, known as the Autoriteit Persoonsgegevens, said Uber violated the European Union’s General Data Protection Regulation (GDPR) by allowing algorithmic systems to make decisions that could have significant consequences for drivers’ livelihoods. The regulator said drivers were not sufficiently informed that automated decision-making was being used and, in certain cases, did not receive meaningful human intervention before losing access to the platform.
The case focuses on Uber’s practices between 2018 and 2022. During this period, the company used automated systems to identify drivers suspected of fraudulent activity or other violations. Accounts could be temporarily suspended when algorithms flagged behavior such as allegedly taking unnecessary detours to increase fares or accepting trips without intending to complete them.
The regulator also found that drivers with persistently low customer ratings could be permanently deactivated through automated processes. Such decisions could have an immediate financial impact because drivers relying on Uber for income could suddenly lose their ability to accept rides.
The Dutch authority argued that decisions with such serious consequences cannot simply be left to computer systems. Under the GDPR, individuals have protections against being subjected solely to automated decisions that have legal or similarly significant effects. The rules are intended to ensure that people can understand decisions affecting them and have access to meaningful human intervention or a way to challenge an outcome.
For Uber drivers, the issue is particularly significant because an account suspension is not merely a technical restriction. For workers who depend on the platform for their income, losing access can effectively mean losing their ability to work through Uber.
The investigation originated with complaints from drivers in France. The matter was ultimately handled by Dutch authorities because Uber’s European headquarters are located in the Netherlands. The investigation examined how Uber processed information about drivers and how its automated systems were used to make decisions affecting their accounts.
The €824.9 million penalty makes the case the second-largest fine issued under the GDPR so far. It follows a €1.2 billion penalty imposed on Meta in 2023 by Ireland’s data protection regulator over the transfer of European users’ personal data to the United States.
Uber has strongly rejected the findings and said it plans to appeal the decision. The company argues that the practices examined by the regulator relate to historical policies that have since been discontinued. Uber also maintains that its current systems include human reviews, safeguards and opportunities for drivers to challenge account suspensions.
The company has disputed the regulator’s characterization of permanent deactivations, saying it has never automatically made permanent deactivation decisions without human involvement. Uber has also argued that the number of drivers affected by certain automated decisions was relatively small. According to the company, 126 drivers in Europe were deactivated because of low customer ratings in 2021.
Despite Uber’s objections, the Dutch regulator maintained that the nature of the decisions and their potential consequences justified the size of the penalty. Regulators have increasingly focused on how companies use algorithms to manage workers, customers and users, particularly as automated decision-making becomes more widespread across the technology industry.
The case is also significant because it extends the debate around artificial intelligence and algorithmic management beyond traditional concerns about personal data. While GDPR is primarily associated with privacy, its provisions can also place limits on how companies use automated systems to make consequential decisions about individuals.
For technology companies and digital platforms, the Uber decision could serve as a warning that automation does not remove responsibility from human decision-makers. Algorithms can process enormous amounts of information quickly, but errors in automated systems can have serious consequences when they determine whether someone can work, access an account or earn an income.
The decision also raises broader questions about the future of platform-based work. Companies such as ride-hailing and delivery platforms increasingly rely on algorithms to monitor performance, detect suspected fraud, calculate ratings and determine access to their services. These systems allow companies to manage large workforces efficiently, but they can also make it difficult for workers to understand why a decision was made or how to challenge it.
The Dutch regulator’s action signals that European authorities expect companies to provide more than automated explanations or standard appeals forms when decisions materially affect people’s lives. Human oversight must be meaningful enough to identify mistakes and, where appropriate, reverse an automated decision.
The fine comes as European regulators continue to increase scrutiny of major technology companies over privacy, competition and digital rights. For Uber, it also adds to its regulatory challenges in the Netherlands. The company was previously fined €290 million by Dutch authorities in 2024 over the handling and transfer of European drivers’ personal data to the United States.
Uber’s planned appeal means the dispute is unlikely to end with the regulator’s decision. The eventual outcome could have implications beyond the company itself, particularly for businesses that rely on automated systems to manage large numbers of workers or users.
At its core, the case highlights a growing tension between technological efficiency and individual rights. As companies increasingly allow algorithms to make decisions at scale, European regulators are making clear that automation cannot come at the expense of transparency, accountability and the right to human review.
For Uber, the nearly $1 billion penalty represents a major financial and regulatory setback. For the wider technology industry, it could become an important test of how far companies can go in allowing algorithms to make decisions that directly affect people’s livelihoods.
