Automated decisions: Uber fined nearly €825 million
On 21 August 2026, the Dutch data protection authority (the Autoriteit Persoonsgegevens, or AP) published a press release announcing that, in cooperation with the CNIL (French data protection authority), it had imposed a fine of €824,990,000 on Uber B.V. and Uber Technologies Inc. At issue: fully automated decisions to deactivate the accounts of the platform’s drivers.
The legal framework: the general prohibition in Article 22 GDPR
A fully automated decision is defined as “a decision taken in respect of a person by means of algorithms applied to their personal data, without any human being involved in the process”. The GDPR strictly regulates such processing so that individuals are not subjected to decisions made solely by a machine.
Article 22 GDPR thus lays down a principle: every person has the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning them or similarly significantly affects them. A decision significantly affects a person where it influences their circumstances, behaviour or choices, for example where it has consequences for their financial situation.
A fully automated decision nevertheless remains permissible in three cases:
- where it is based on the individual’s explicit consent;
- where it is necessary for entering into or performing a contract;
- or where it is authorised by specific statutory provisions.
Even in these cases, however, the processing must be accompanied by safeguards: enhanced information on the existence of the decision, the logic involved and its consequences, as well as a right to human intervention enabling the individual to obtain a review, express their point of view and contest the decision.
The origin of the penalty: a complaint by 171 drivers
The investigation stemmed from a referral by 171 French drivers to the Ligue des droits de l’Homme (LDH, French human rights league). The association then lodged a complaint with the CNIL on the drivers’ behalf.
As Uber’s European headquarters are located in the Netherlands, the Dutch authority led the investigation under the cooperation mechanism between European authorities. That mechanism designates a “lead” authority, competent to conduct the sanction procedure where the processing is cross-border, while involving the other supervisory authorities concerned in the decision. Throughout the procedure, the AP therefore worked closely with the CNIL and aligned its decision with those of the other European authorities.
The facts: account deactivations without human intervention
The AP found that Uber was taking fully automated decisions concerning its drivers. Where fraud was suspected or customer ratings were too negative, drivers’ accounts were automatically deactivated, temporarily or even permanently where poor ratings persisted. The drivers concerned then lost their Uber income for the entire period of deactivation.
In practice, Uber used software to monitor its drivers’ driving behaviour and customer reviews. When that software detected suspected fraud or an excessively low rating, the driver’s account was deactivated automatically, without any human intervention. These practices took place between 2018 and 2022.
On that basis, the AP held that Uber had breached the GDPR’s general prohibition on fully automated decisions and that the company had not adequately informed its drivers of the existence of this automated decision-making process.
Monique Verdier, Vice-Chair of the AP, summarised the authority’s position by stressing the seriousness of the infringements: drivers found themselves deactivated without notice and, overnight, deprived of all income earned through Uber. She also pointed out that a computer should not, on its own, take decisions with such serious consequences for individuals, and that such decisions should have been subject to prior human review.
The amount of the fine
Under Article 83 GDPR, fines may not exceed 4% of the undertaking’s total worldwide annual turnover. As Uber generated worldwide turnover of around €44.5 billion in 2025, the fine imposed, of nearly €825 million, therefore remains well below the applicable ceiling of €1.78 billion. Uber has appealed against the fine.
A fourth Dutch penalty
This is the fourth fine imposed on Uber by the AP. The company had already been fined €600,000 in 2018, €10 million in 2023 for failing to inform its drivers, and then €290 million in 2024 for transfers of data outside the European Union. Uber is contesting the last two fines, and those proceedings are still pending.
Key takeaways
This decision confirms the practical reach of Article 22 GDPR in the platform economy. A decision qualifies as fully automated without any need for a sophisticated algorithm: as soon as a measure producing significant effects, such as a deactivation depriving a worker of their source of income, is taken without genuine human intervention, the safeguards of Article 22 apply.
For operators using automated suspension, sanction or blocking mechanisms, three points call for vigilance: genuine, rather than purely formal, human intervention; clear information to individuals on the existence of the automated decision and its logic; and the availability of channels for challenge allowing a review. The size of the penalty underlines that these requirements are not a mere compliance formality.
Sources
To go further and secure your practices against GDPR requirements, through our expertise we support you in achieving compliance and preventing personal data risks.