AI Trainers and the Privacy Fight Behind Models

A model can answer in a second. Someone still compared the drafts, marked a mistake, or wrote the example the product now sounds as if it had always known. On 27 October 2026 that work became a European privacy dispute. The dispute is a set of allegations, plus a denial. It is not a judgment.

The useful question for a buyer is narrower than "who is right". Public accounts already describe different kinds of monitoring. Treating them as one surveillance system produces the wrong question for the next vendor. A complaint opens scrutiny. A company statement is not an audit.

Five complaints, and still no decision

On 27 October 2026, noyb said it had filed five complaints against Scale AI, with Intérêt à Agir, DiPLab and Reversing.Works, in France, Italy, the Netherlands and Austria. The page says Scale AI operates Outlier, which "employs more than 900,000 'freelance' workers". Freelance is in quotation marks on that page, and the verb is "employs". That is the organization's description of scale. It is not an audited count of active people, full-time jobs, or people whose main income is the platform.¹

The same announcement names customers. The opening lists Meta, OpenAI, Google and the US government. A later paragraph adds xAI and Anthropic to that list of "best-known customers". This article reports noyb's list. It is not a review of contracts.¹

Reuters, in a 27 October dispatch, reported the same five complaints and the same four countries, and said noyb was asking regulators to fine Scale AI and to examine how the platform assigns tasks. Reuters wrote that more than 900,000 freelancers perform tasks recorded to create training data for clients such as Meta, OpenAI and Google, and that Meta owns 49% of Scale AI. Those sentences are Reuters, not a line on the noyb page retrieved for this article. reuters.com returned HTTP 401, so the wire was read on the Yahoo republication.²

Five complaints in four countries need a split that the noyb page, as retrieved on 5 November 2026, does not spell out. Euronews, citing noyb's statement, reported two complaints in Austria and one each in France, the Netherlands and Italy.³

noyb's own case page C109-04, checked the same day, says the case was filed on 27 October 2026 and is "Pending (0 - 6 months)". The summary on that page is singular: tracking, biometric verification by Persona, and a failure to reply to the access request of "the complainant". One public case card is not a published decision on all five files.⁴

Thomas Le Bonniec, described on the noyb page as a sociology researcher at DiPLab, is quoted there: "Platform work seems to be fertile ground for a whole new type of workplace surveillance. This would be seen as unacceptable in any other form of employment in the European Union. This system only thrives because of its deliberate lack of transparency." Reuters quoted a different remark, from two years of studying the platform: people do not work when they want; they work when the platform wants them to, and when tasks are available. The Reuters sentence in the original dispatch uses a contraction; this article paraphrases it. The interviews behind that remark are not printed in the wire.¹²

Three accounts of monitoring, not one system

The word "tracking" is doing too much work in the coverage. The documents read for this article describe different mechanisms. They should stay apart.

noyb says its technical analysis found that, while people are on Outlier, trackers from companies such as TikTok, LinkedIn, Facebook, the survey platform Sprig and the data analysis company Datadog are placed on their devices. Every few seconds, noyb says, those trackers send personal data to third parties: IP addresses, contact details, unique identifiers and information about the visited page. noyb says that data can be used for targeted advertising and profiling. Lisa Steinfeld Leiser, a data protection lawyer at noyb, is quoted: "Such constant and extensive tracking while working really goes against all reasonable expectations." The next sentence in the release asks why LinkedIn or Facebook should know which tasks a person is working on. The original uses a contraction; this sentence is a paraphrase.¹

Reuters, citing complaints it said it had seen, added a further description: up to 19 trackers follow workers while they work, including recording keystrokes and mouse movements every few seconds. Reuters also wrote that a DiPLab investigation found the resulting file could be rebuilt into a video that replays a work session from start to finish. That video claim is Reuters' account of DiPLab. It is not a sentence on the noyb press page, and it was not re-checked inside a report PDF.²

The Record, on 28 October, quoted noyb spokesperson Mickey Manakas by email: an analysis identified 18 third-party trackers used to track French freelancers' data. Manakas said "There are definitely more", that the number varies by country, and that the count is not comprehensive because noyb focused primarily on social media trackers and analytics. Eighteen on that email, and "up to 19" in the complaints as Reuters described them, are not the same census. This article does not merge them. The Record's headline says noyb "sues", and one sentence says noyb is asking courts for fines. noyb's own page says it filed GDPR complaints and suggests that authorities impose an administrative fine. Reuters says noyb is asking regulators. This article follows noyb and Reuters on that point, not the "courts" wording.⁵

Scale AI answered on 28 October. In a statement Reuters reported that day, the company rejected the complaints as unfounded. It said the platform's practices were disclosed to workers and required their consent. The emailed line was: "The report's claims are unfounded and inaccurate." Scale said it uses standard tools to verify identities, prevent fraud, protect confidential project information and ensure accurate payments, and that contributors know their pay rates before accepting tasks. A spokesperson said certain projects use a separate tool that records time spent and screen activity, which contributors opt into and manually activate before starting work. Scale said it does not sell workers' personal data to third parties or use it to train customers' AI models. The Record's account of the same response adds that Scale disputes the allegations about how third-party trackers surveil workers, that it considers the biometric practices appropriate, and that people can request deletion of their data.⁵⁶

A DiPLab publication page dated 15 October 2026 announces a report, Surveillance at Scale: How AI Training Platforms Gather Personal Data from European Workers, with Reversing.Works and Intérêt à Agir. The page says Outlier collects workers' personal data, financial records, biometric information and facial recognition scans, used for surveillance "and probably for further AI training". It also says the project reveals extraction of personal data "for purposes ranging from covert AI training to potential military applications". Those are the announcement's words. The PDF was not read for this article, so they are not treated as demonstrated findings. They sit next to Scale's statement that personal information is not used to train customers' models. This article does not choose a winner from a page and a denial.⁶⁷

For a department that already uses software to score or schedule people, the same caution applies at a smaller scale. A vendor log, an analytics tag and an opt-in screen recording are different tools. Asking "are we surveilling staff?" is less precise than asking which data, which purpose, who receives it, and who can challenge a score. That question is the one in who oversees the algorithmic manager. The checking time itself is a different problem, covered in why human review becomes the bottleneck once agents are fast.

Identity checks, access requests, and a withdrawn sentence

noyb says Scale AI requires people to go repeatedly through biometric verification by a company called Persona, including video recordings of their face and an upload of an identity document. noyb says Scale AI's stated reasons are to prevent identity fraud and to "verify the workers' skills", and that the collection goes beyond what is necessary. noyb also says Persona grants itself the right to collect IP addresses, device information, geolocation data, addresses and consumer credit data. That is noyb's description of Persona's terms. This article did not read those terms.¹

Identity checks are not improper merely because they are checks. A platform that pays people has reasons to resist fraud, impersonation and duplicate accounts. The open question is whether each category is necessary, whether people are told what it is for, and whether a lawful basis exists. Calling a practice "security" does not answer that.

Reuters, citing the complaints, wrote that four workers asked Outlier for copies of their data between December 2025 and May 2026 and that none received an answer. noyb says the failure to respond violates the right of access. If that account is established, it is a separate issue from whether a tracker was lawful. It is still an allegation. The Record attributes the same four requests to noyb.¹²⁵

There is also a sentence that should not travel. On 29 October 2026 noyb updated the release. It said the text had incorrectly claimed that in October 2025 hackers exposed approximately 70,000 photos of government IDs stored with Persona. That claim is withdrawn. It is not reported here as an event. The correction does not close the complaints about trackers, identity checks or access requests.¹

What the GDPR text asks, and what it does not decide

This section is not legal advice. EUR-Lex returned HTTP 202 and an empty body on 5 November 2026, so the wording below follows the regulation text as reproduced the same day on gdpr-info.eu, not a fresh EUR-Lex download.

Article 5(1)(c) says personal data shall be adequate, relevant and limited to what is necessary for the purposes. That is the minimisation principle noyb says is breached. Article 6 says processing is lawful only if at least one condition applies, including consent, a contract, a legal obligation, vital interests, a public-interest task, or legitimate interests that are not overridden. Consent is one basis, not the only one. noyb says there is no valid legal basis to place trackers on the complainants' devices without consent. Scale says the practices were disclosed and required consent, and that the screen tool is opt-in and manually started. Whether any consent was specific and freely given is for the authorities, not for a press exchange.⁸⁹

Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a natural person, unless an exception applies. Article 9(2)(a) includes explicit consent. Article 9(2)(b) covers processing necessary to carry out obligations or exercise rights in employment and social security law, where Union or Member State law, or a collective agreement, authorises it and provides safeguards. A face video is not automatically inside Article 9, and it is not automatically outside it. The hinge is the purpose of unique identification, and then the exception. This article has not seen the verification design.¹⁰

Article 15 gives a person the right to obtain confirmation of whether personal data are being processed and, if so, access to the data and to stated information: purposes, categories, recipients, and where possible the storage period, among other points. An unanswered request, if the complaints are right, matters even when the underlying collection is later found to be lawful.¹¹

These files are GDPR complaints. They are not an AI Act decision, and this article does not classify Outlier as a high-risk system. A separate rule can matter for an employer's own software. Annex III, point 4(b), of the EU AI Act lists systems intended to make decisions affecting terms of a work relationship, promotion or termination, to allocate tasks based on individual behaviour or personal traits, or to monitor and evaluate performance and behaviour. The Commission service desk says Annex III rules apply from 2 December 2027. Prohibited practices, some transparency duties and the rules for general-purpose AI models are enforceable from 2 August 2026. A question in a procurement form is not, by that description alone, such a system. Classification depends on the intended purpose.¹²¹³

noyb links a Council of the EU infographic for a claim that more than 40 million people already have their work organised by platforms. That Council page returned HTTP 403 on 5 November 2026, so this article does not repeat the figure.

A buyer can ask before any ruling

Imagine a contractor asked to check a medical explanation produced by a model. The person spends longer on an uncertain sentence. A timer that only counts minutes can treat that care as delay. The scene is hypothetical. It is not a documented Outlier task, and it is not a finding in the five complaints.

The practical response, for a small business, a social organization or a department, is a set of questions to any vendor that organises work or records staff activity. None of them replaces a lawyer.

• Which categories of personal data are collected, for which purpose, for how long, and which subcontractors receive them? Include analytics tags and identity-verification firms, not only the screen the employee sees.
• What is the lawful basis for each category, and what can a person actually obtain when they ask for a copy?
• If a tool records a screen or a score, is it opt-in, and can a named person reverse a flag that blocks pay or access?
• Do speed targets make a careful check irrational? If the work needs judgment, the metric should be able to show accuracy and escalation, not only pace.

Those questions do not assume the noyb account or the Scale account. They assume the buyer will not know which account fits until someone writes the data trail down. Organizations that already live with scheduling and scoring tools can start there, without waiting for a decision about one US platform. The staffing of that oversight is a separate hiring problem, discussed in what AI oversight work actually is.

Have regulators found that Scale AI broke the GDPR?

No. noyb filed five complaints on 27 October 2026 and asked authorities to investigate and to consider a fine. Case page C109-04 was still marked pending on 5 November 2026. A complaint is the start of scrutiny. Scale AI told Reuters on 28 October that the claims are unfounded and inaccurate, that relevant practices were disclosed, and that a screen-recording tool on certain projects is opt-in. Neither the filing nor the denial is a decision.¹⁴⁶

Does "more than 900,000" mean 900,000 jobs?

No. noyb says Outlier employs more than 900,000 "freelance" workers, with the word freelance in quotation marks. Reuters describes a platform on which more than 900,000 freelancers perform tasks. Neither figure is an audited count of active accounts, full-time jobs, or people who earn their main income there. A registration, an occasional task and a livelihood are different measures.¹²

Did hackers expose about 70,000 identity photos held by Persona?

Do not treat that as fact. On 29 October 2026 noyb said its release had incorrectly claimed that in October 2025 hackers exposed approximately 70,000 photos of government IDs stored with Persona. The sentence was withdrawn. The update does not decide the remaining allegations about trackers, identity checks or unanswered access requests.¹

How hilighter can help

hilighter does not audit a vendor's trackers, decide a GDPR complaint, or record keystrokes. The question this dispute leaves for an employer is which tasks in a role still depend on a person, and how that person can show the judgment a timer will not capture.

hilighter helps teams map skills by role, compare people with those requirements in Skills & Talent Insights, record proof of capability in Skills Evidence & Recognition and set personalized growth paths. Its AI Job Impact view is indicative. It is not a prediction that a role will disappear, and it is not a reading of anyone's surveillance risk. A free plan covers up to three job roles, with unlimited employees.

Sources

1. noyb, AI training platform Outlier illegally surveils European platform workers, 27 October 2026, updated 29 October 2026. Five complaints with Intérêt à Agir, DiPLab and Reversing.Works, in France, Italy, the Netherlands and Austria. "More than 900,000 'freelance' workers." Customers as named on the page. Trackers including TikTok, LinkedIn, Facebook, Sprig and Datadog. Persona face video and identity documents. Access requests. The 29 October correction withdrawing the claim about approximately 70,000 government-ID photos stored with Persona. The page's title states illegality; that is the complainant's framing, not a decision.
2. Reuters, Leo Marchandon, "Privacy group files complaints against Scale AI over alleged worker surveillance", 27 October 2026. Read on the Yahoo republication because reuters.com returned HTTP 401: Yahoo copy. Five complaints; regulators; more than 900,000 freelancers; clients such as Meta, OpenAI and Google; Meta owns 49% of Scale AI. Complaints seen by Reuters: up to 19 trackers, including keystrokes and mouse movements. DiPLab video-reconstruction account, as Reuters reports it. Four workers, December 2025 to May 2026, no answer, "the complaints said". Le Bonniec's remark on when work is available is paraphrased above because the wire uses a contraction.
3. Euronews, Why should Big Tech know what you are working on? Scale AI accused of spying on AI trainers, Jonathan Benton with AP, 27 October 2026. Two complaints in Austria and one each in France, the Netherlands and Italy, cited to noyb's statement. The headline URL contains a contraction; the headline is reworded in this citation. The article's other political context was not used.
4. noyb, case C109-04, filed 27 October 2026, status "Pending (0 - 6 months)" when checked on 5 November 2026. Singular complainant on that card.
5. The Record, Suzanne Smalley, European digital rights nonprofit noyb sues Scale AI for "invasive" worker surveillance, 28 October 2026. Manakas: 18 third-party trackers for French freelancers, "definitely more", varies by country, not comprehensive. Scale spokesperson on trackers, biometrics, opt-in screen activity and task duration, deletion, and not selling personal data or using it to train customer models. The headline's "sues" and a "courts" sentence are not followed here; noyb and Reuters describe complaints to regulators. The page's "900,00" figure is treated as a truncated typo, not a second statistic.
6. Reuters, "Scale AI rejects claims it illegally surveils AI-training workers", 28 October 2026. Read on the Yahoo republication: Yahoo copy. Complaints rejected as unfounded; practices disclosed and consent required; "The report's claims are unfounded and inaccurate." Identity tools, fraud, confidential project information, accurate payments, pay rates known before a task. Separate tool on certain projects records time spent and screen activity; contributors opt in and manually activate it. Personal data not sold to third parties and not used to train customers' AI models.
7. DiPLab, New DiPLab Report: Surveillance at Scale, publication page by Stella Lopez, 15 October 2026. Report title and authors as printed there (Thomas Le Bonniec, Antonio A. Casilli, Mathilde Abel, Simone Robutti, Gaetano Priori, Donatella D., Paul S.), with Reversing.Works and Intérêt à Agir. The page's "probably" for further AI training, and the phrase on covert AI training and potential military applications, are the announcement's wording. The PDF was not read. Not a finding that Scale uses contributor data to train customer models.
8. Regulation (EU) 2016/679, Article 5(1)(c), data minimisation. Text read on gdpr-info.eu, Article 5 on 5 November 2026, after EUR-Lex returned HTTP 202 with an empty body. Not legal advice.
9. Regulation (EU) 2016/679, Article 6(1), lawfulness. Text read on gdpr-info.eu, Article 6 the same day, on the same limitation.
10. Regulation (EU) 2016/679, Article 9(1) and 9(2)(a) and 9(2)(b), biometric data for unique identification and the exceptions noted. Text read on gdpr-info.eu, Article 9.
11. Regulation (EU) 2016/679, Article 15(1), right of access. Text read on gdpr-info.eu, Article 15.
12. European Commission, AI Act Service Desk, Annex III, point 4(b), employment, workers' management and access to self-employment. Read on 5 November 2026.
13. European Commission, AI Act Service Desk, When does enforcement start?. Prohibited practices, certain transparency duties and general-purpose AI model rules enforceable from 2 August 2026. Annex III rules from 2 December 2027.

Sources last reviewed: 5 November 2026. The five complaints are allegations. Scale's 28 October statement is a denial, not an acquittal. The 18-tracker email and the "up to 19" line in Reuters are not one count. The DiPLab PDF and Persona's terms were not read. The Council infographic behind a platform-work headcount returned HTTP 403, so the figure is omitted. EUR-Lex did not return the GDPR text that day. EU dates follow the Commission service desk. This article is not legal advice. Neither an AI-detector score nor the absence of Google penalties can be guaranteed.