Uber Fined €825M Under GDPR for Automated Driver Deactivations

The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, announced on August 21, 2026 that it is fining Uber 824,990,000 euros¹. The reason: the AP ruled that Uber made fully automated decisions about its drivers¹.

What was at issue is the process that shut driver accounts down. Uber used software to track drivers’ driving behaviour and their customer reviews, and when that software detected a suspicion of fraud or found reviews that were too low, the accounts concerned were automatically deactivated¹. Where low reviews persisted, accounts could be permanently deactivated¹. The AP states that there was no human assessment involved, and that this occurred between 2018 and 2022¹.

The penalty is about how the decision was made

The AP made two findings. One is a breach of the GDPR’s prohibition of fully automated decision-making; the other is that Uber did not sufficiently inform drivers about the automatic decision-making¹. The AP also states that Uber has now stopped the violations¹.

Monique Verdier, deputy chair of the AP, said in the announcement that drivers were deactivated without pardon and lost their income through Uber from one moment to the next, and that a computer should not make decisions on its own that have major consequences for a person — those decisions should have been looked at first by a human being¹.

So the dispute is not over whether the deactivations were correct. It is over whether a human was meaningfully involved in reaching them. This is not a story about generative AI or LLMs; it concerns the kind of business-logic automation that has existed for years. But for anyone trying to draw a line around how much an agent may decide inside their own company, it shows where regulators are willing to draw that line.

It started with 171 drivers in France

The investigation began after 171 French drivers reported to the Ligue des droits de l’Homme (LDH), a French human rights organization¹. LDH lodged a complaint with the French privacy regulator, the CNIL, on the drivers’ behalf, and because Uber’s European headquarters are in the Netherlands, the case was handled by the AP under the GDPR’s one-stop shop mechanism¹. The AP says it cooperated closely with the French regulator during the investigation and aligned the fine decision with other European supervisors¹.

All European privacy regulators calculate fines the same way. The maximum is 4% of a company’s worldwide annual turnover, and the AP notes that Uber had a global turnover of around 44.5 billion euros in 2025¹.

This is also the fourth fine the AP has imposed on Uber. It fined the company 600,000 euros in 2018, 10 million euros in 2023 and 290 million euros in 2024; Uber is contesting the latter two and those proceedings are still ongoing¹.

Uber calls the fine disproportionate

Uber has filed an appeal against this fine as well¹. As relayed by Reuters, the company rejects both the ruling and the amount². The core of its defence is how it operates today: it does not treat drivers’ rights lightly, a person is involved in reviewing these cases under its current approach, and a suspended driver has a route to challenge the outcome².

The underlying findings are contested too. On Reuters’ account, Uber’s position is that suspensions were normally very short-lived and that no permanent deactivation was ever settled without a person reviewing it — meaning the company does not accept the AP’s conclusion that persistently low ratings could shut an account down for good automatically². As further grounds for calling the amount out of proportion, it points to how few drivers were actually caught by this: 126 in Europe over low ratings during 2021².

Reuters reports that the decision is dated August 17 and that it reviewed the document². The dollar conversion of roughly $966 million, and the characterization of this as the second-largest fine ever issued under the GDPR, also come from Reuters rather than the AP’s own announcement². With proceedings still open, whether the amount stands as issued is not settled.

What this changes for anyone automating decisions

Reuters summarizes the provision at issue this way: consequential judgments cannot be left to an algorithm alone; a person has to review them in substance, and the affected party needs a route to contest the outcome². This case is that rule being applied, and arriving as a fine.

Credit scoring, screening, hiring and account suspension are all being automated in more places. Any business with operations or users in the EU falls within this framework, and even outside it, the case is a reference point for deciding internally how much may be decided without a person. What actually matters in practice is less the automation itself than how human involvement is designed, recorded, and explained to the people affected. Both of the AP’s findings — no human assessment, and insufficient information to drivers — are questions of operational design.

The AP files this announcement under a theme it calls “Algorithms explained”¹, which suggests the regulator treats the case less as a privacy breach than as a question of governing algorithms.

In Europe, institutional demands on AI have been landing in concrete operational form for several months. Claude adding an invisible watermark to generated text in response to the EU AI Act’s transparency obligations and the European Commission publishing a code of practice on labelling AI-generated content were both about what gets displayed on the output. This case is about the step before that: whether a human was present between input and conclusion. If moves like Mistral’s Regional Endpoints answer the question of where processing happens, this one answers the question of who decides.

Rules are being built region by region outside Europe too, and the shape they take varies — as Australia’s announcement of a national AI framework showed. If you are reviewing an automated workflow, the easiest place to start is with two questions: is a person actually looking at this decision, and can you show afterwards that they did?