Dutch regulator fines Uber €824.99 million over automated driver blocking

The Dutch Data Protection Authority, or Autoriteit Persoonsgegevens (AP), announced a €824,990,000 fine against Uber B.V. and Uber Technologies Inc. on August 21. It found that the platform used fully automated decisions to deactivate driver accounts between 2018 and 2022, directly affecting the income of people who could no longer accept rides.¹

Uber has appealed the penalty and disputes both the finding and the amount.¹ ⁵ The case remains open: this is an administrative decision by a regulator, subject to review, rather than a final court judgment.

The case applies Article 22 of the General Data Protection Regulation. It protects a person from a decision based solely on automated processing when that decision produces legal effects or affects them in a similarly significant way.³ The AP found that cutting off access to work through the platform met that threshold.

Fraud flags and low ratings led to different blocks

According to the AP, Uber used software to track driving behavior and customer ratings. Suspected fraud could trigger an automatic temporary deactivation. Low ratings could also suspend an account; persistently low ratings could lead to permanent deactivation.¹

The regulator examined temporary and permanent decisions and concluded that the identified flows lacked human assessment before the block. France's CNIL records suspected fraud tied to temporary deactivation and low ratings tied to temporary or definitive measures.²

While an account was deactivated, the driver could not take rides or earn income through Uber.¹ ² The AP found that this economic impact met Article 22's significant-effect requirement. It also found that drivers received insufficient information about the automated decision-making.¹

The regulators' releases do not describe the code, statistical models or weights used by the software. They document the outcome of the process and the AP's finding that human intervention was absent. The public record does not support calling the system generative AI or assigning it to a particular artificial-intelligence technique.

Article 22 combines impact with a fully automated process

The GDPR provision addresses a defined class of decisions. Processing must be solely automated, and the result must have a legal or similarly significant effect on the person.³ When a system only flags a case, the human review must have real influence over the outcome.⁴

The regulation makes exceptions when a decision is necessary to enter into or perform a contract, is authorized by European Union or member-state law with safeguards, or rests on explicit consent. In the contract and consent cases, the controller must provide at least a way to obtain human intervention, express a point of view and contest the decision.³

The AP found both central elements in the deactivations it investigated: the decisions were fully automated and stopped drivers from earning through the platform.¹ In the regulator's reasoning, Article 22 applied to the resulting deactivation without human assessment, not to fraud detection in isolation.

Uber gives a different account. The company told Reuters that current policies include human reviews and ways to challenge suspensions; it also denied that permanent deactivations had occurred without human review.⁵ The AP says the violations have ended while maintaining its finding about processes used from 2018 through 2022.¹

The complaint began with 171 French drivers

The investigation grew out of reports that 171 drivers brought to Ligue des droits de l’Homme, a French human-rights organization. LDH filed the complaint with CNIL on the group's behalf. Because Uber's European headquarters are in the Netherlands, the AP led the case through the GDPR's one-stop-shop system, working with the French authority and other European regulators.¹ ²

CNIL participated in the checks, evidence analysis and review of the draft decision. The French authority's notice says the fine was imposed on Amsterdam-based Uber B.V. and US-based Uber Technologies Inc.²

The AP also ties the amount to the European method for calculating fines. GDPR penalties can reach 4% of a company's worldwide annual turnover, and the authority says Uber had global revenue of about €44.5 billion in 2025.¹ The release does not present the penalty as direct compensation for the 171 complainants or allocate the amount among drivers.

Sources

1. Uber fined nearly 825 million euros for automated driver blocking · Autoriteit Persoonsgegevens · https://autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking · August 21, 2026
2. Automated decisions: UBER fined nearly EUR 825 million · CNIL · https://www.cnil.fr/en/automated-decisions-uber-fined-nearly-eur-825-million · August 24, 2026

Show 3 more sourcesHide sources

3. Regulation (EU) 2016/679 — Article 22 · EUR-Lex · https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng · April 27, 2016
4. Automated decision · Autoriteit Persoonsgegevens · https://autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/algorithms-explained/automated-decision · accessed August 26, 2026
5. Exclusive-Dutch regulator fines Uber $966 million for automating driver suspensions · Reuters / Euronext · https://live.euronext.com/en/financial-news/exclusive-dutch-regulator-fines-uber-966-million-automating-driver-suspensions · August 21, 2026