Dutch Regulator Fines Uber €825 Million Over AI Algorithm That Auto-Banned Drivers

On August 21, 2026, the Dutch Data Protection Authority fined Uber €825 million for allowing algorithms to automatically ban driver accounts between 2018 and 2022 based on behavioral tracking and scoring, with no human involvement whatsoever.

Facts

According to reports, the case originated from complaints by French drivers, but was ultimately handled by the Dutch Data Protection Authority (AP) because Uber's European headquarters is located in the Netherlands. The investigation focused on two systems: one used to detect fraudulent behavior such as unnecessary detours or accepting orders without completing them, and another that could permanently remove drivers based on customer ratings. Both systems suspended or terminated accounts without prior human review. The AP determined this violated Article 22 of the GDPR, which prohibits making decisions with significant effects on individuals based solely on automated decision-making. Uber has informed regulators that it ended the fraud-related suspension process in 2021 and stopped rating-based deactivations in 2022.

Mechanism Breakdown

The AP's investigation showed that the suspension or termination of driver accounts directly led to loss of income, a consequence that falls under the "significant impact" that the GDPR's automated decision-making safeguards are designed to address. Uber's algorithms made decisions without human review or adequate notice, depriving drivers of the opportunity for human intervention and dispute resolution. The AP emphasized that such decisions were not routine account status changes, but substantive interventions in individuals' livelihoods. Uber responded that it strongly opposes the decision and the fine amount, noting that its current policies already include human review and driver appeal processes, but regulators still determined that the practices during 2018-2022 were in violation.

Industry Impact

This fine represents the most significant regulatory action in AI automated decision-making to date, second only to the €1.2 billion fine imposed on Meta by Ireland in 2023. The AP had previously taken multiple actions against Uber, including a €600,000 fine in 2018 for failing to report a data breach, a €10 million fine in 2023 for data retention and disclosure issues, and a €290 million fine in 2024 for transferring European drivers' personal data to the United States. This case focuses on algorithmic management rather than data storage, indicating that European regulators are strictly enforcing the GDPR's restrictions on algorithmic decision-making. Other EU ride-hailing and delivery platforms that rely on automated account management without human approval may face similar risks.

Strategic Assessment

[Analysis] Through the specific fine amount and time span, this case demonstrates that regulators have identified "autonomous algorithm enforcement without human review" as an explicit compliance red line. Platforms that continue to rely on fully automated systems for decisions affecting livelihoods will face hefty penalties and reputational risks. Although regions such as India do not have equivalent data protection laws, similar algorithmic deactivation issues have already drawn attention from labor law and courts, indicating that gig economy platforms worldwide need to reassess the balance between algorithms and human review to reduce cross-jurisdictional compliance uncertainty.