The Dutch privacy regulator put a price on automation. Spain already put a price on what replaces it, at a company Uber agreed to buy this year.
The Autoriteit Persoonsgegevens fined Uber €824,990,000 on 21 August 2026 for deactivating driver accounts by software alone between 2018 and 2022, the second-largest penalty ever issued under the GDPR. The figure equals 1.85% of Uber’s roughly €44.5 billion 2025 turnover and about 46% of the 4% statutory ceiling. Uber has appealed. The larger number sits outside data-protection law: GDPR fines carry a hard cap at 4% of global turnover, retroactive social-security claims for worker misclassification carry none, and from 2 December 2026 the EU Platform Work Directive requires a human being to make every decision to suspend or terminate a platform account across all 27 member states.
Brahim Ben Ali lost his Uber account in Paris in 2019. He gathered testimony from 171 other drivers, handed it to the Ligue des droits de l’Homme, and the LDH filed with France’s CNIL. Uber runs its European business from Amsterdam, so the file travelled to the Dutch regulator under the GDPR’s one-stop shop. Seven years later that stack of driver statements has produced the biggest privacy penalty in Europe outside Meta.
What Happened
The AP found that Uber’s software watched two data streams, driving behaviour and rider ratings, and cut off accounts when either crossed a threshold. A fraud flag triggered a temporary deactivation. Persistent low ratings triggered permanent removal. No person looked at the outcome before the driver stopped earning. The AP also found Uber failed to tell drivers that automated systems were making these calls.
Deputy chair Monique Verdier said Uber had “committed serious infringements” and that a computer should not decide something with consequences that large on its own.
Uber called the penalty “disproportionate” and disputed the finding on permanent deactivations, saying it never automated those. In its own defence the company offered a number: 126 drivers across Europe lost accounts over low ratings in 2021. Uber says human review now precedes deactivations and that drivers can appeal.
This is the fourth AP fine against Uber. The sequence runs €600,000 in 2018, €10 million in 2023, €290 million in 2024 over transfers of driver data to the United States, and now €825 million. The nominal total reaches €1.126 billion, and Uber is still contesting the 2023 and 2024 decisions.
The Backstory
The legal theory here is not new, and Uber is not the first platform to lose on it.
Italy’s Garante fined Deliveroo €2.5 million and Glovo subsidiary Foodinho €2.6 million on the same day in July 2021, both over algorithmic management of riders. Foodinho had about 19,000 riders in Italy at the time. In November 2024 the Garante came back and fined Foodinho €5 million over 35,000-plus couriers, ordering the company to have trained operators verify algorithmic decisions and to rewrite the messages riders receive when an account is blocked.
The Dutch regulator spent two years building toward its own position. It opened a consultation in March 2025 on what meaningful human intervention requires, arguing that a reviewer needs real authority to overturn an algorithm and has to use it. A rubber stamp fails. In April 2026 it opened a second consultation on the right to an explanation, and published survey work showing that close to two in five Dutch residents did not know they had a right to human review at all.
The Uber decision converts that guidance into a nine-figure invoice.
The Plan
Uber is appealing, which is a reasonable bet on the numbers. An analysis published in May 2026 found that close to 40% of the €7.1 billion in announced GDPR fines has been annulled or is under active challenge. A Luxembourg court sent Amazon’s €746 million penalty back to the regulator. Announcement and collection are separate events, and the appeal buys years.
The appeal does not buy an exemption from the calendar. Directive (EU) 2024/2831 entered into force on 1 December 2024 and member states must transpose it by 2 December 2026, 103 days after this fine. The directive requires that any decision to restrict, suspend or terminate an account be taken by a human. Oversight staff must be trained, must hold authority to override the system, and are protected from dismissal for using it. Platforms must review the impact of automated systems on workers every two years. Those rules apply to self-employed platform workers as well as employees, which decouples them from the classification fight entirely.
The directive also creates a rebuttable presumption of employment.
The Business Model Angle
Start with what the fix costs.
A trust-and-safety reviewer in a European support hub runs roughly €35,000 a year fully loaded. Across 1,600 productive hours that is about €22 an hour, or €5.50 for a fifteen-minute case review. On Uber’s own figure of 126 rating-based European deactivations in 2021, the penalty works out at €6.5 million per driver. Even push the review scope to half a million European cases a year, covering every temporary fraud flag many times over, and the wage bill lands near €2.7 million. The fine is roughly 300 times that.
Read the other direction, €824,990,000 buys about 23,600 reviewer-years at €35,000 each. Uber employs 34,000 people in total.
So Uber did not skip human review to save money on wages. The wages are a rounding error against a company generating $10.1 billion of trailing free cash flow. Something else was worth more than €825 million.
Look at the ratio Uber runs. In Q2 2026 the platform carried a record 10.2 million monthly drivers and couriers who earned over $25 billion in the quarter, against 34,000 employees. That is 300 workers per employee, counting every engineer, lawyer and ad salesperson at Uber who never touches a driver file. Adecco, running the same essential trade of matching labour to demand, puts about 449,000 associates on assignment each day against roughly 30,000 company-based staff. Fifteen to one.
The 300-to-1 ratio is the product. It exists because no employee of Uber exercises judgement over an individual worker. Put a trained human with override authority between the algorithm and the driver, in every member state, and Uber starts generating a documented record of its own staff making disciplinary decisions about specific people. That record is exactly what a labour inspectorate reads when it tests the presumption of employment. Paul-Olivier Dehaye of PersonalData.io, whose group helped the drivers assemble their data, framed the trade directly: Uber can use humans to punish drivers, but then it has to take responsibility like an employer rather than a marketplace.
John Gruber pushed back on the regulator’s framing, arguing that blaming “a computer” is like blaming the time clock when a company fires a habitually late employee, since managers set the policy either way. The point cuts, and it lands somewhere Uber will not enjoy. If Uber’s managers set the policy, Uber’s managers manage.
Now look at what Uber bought.
In Q2 Uber deployed about $4 billion to take a roughly 37% economic interest in Delivery Hero and then offered for the rest, targeting a close in the second half of 2027. Delivery Hero owns Glovo. Glovo has already walked the entire path this fine opens.
The sequence at Glovo runs: Italian privacy fines in 2021 and 2024 over algorithmic management. Spanish labour fines of €79 million in 2022 and about €57 million in January 2023. Court rulings in Turin, Palermo and the Portuguese Supreme Court finding riders to be employees. Then in December 2024 Glovo gave up, announced it would convert Spanish riders to employment, took a roughly €100 million hit to FY2025 adjusted EBITDA, and raised its contingency range to €440-770 million. Delivery Hero added €253 million of Italian rider provisions in April 2025 and cut its FY2024 adjusted EBITDA figure from about €750 million to €693 million. By June 2025 Glovo had hired 14,000 riders as salaried staff. On 31 July 2025 Spanish Social Security demanded €450 million in unpaid contributions and penalties, with contingencies estimated between €562 million and €923 million, and Glovo has to pay or guarantee that sum to keep appealing. Delivery Hero told investors this creates significant uncertainty about Glovo continuing in Spain without parent support.
Fourteen thousand riders in one country produced a €450 million demand. That is roughly €32,000 a head across a multi-year back period. The demand is not directly transferable to Uber, whose drivers work fewer hours and sit under different national rules, and Spain’s Riders Law is stricter than most. The shape still holds: the privacy fine is the leading indicator, the contribution bill is the trailing one, and only the first has a ceiling.
The Risk
The strongest case against this reading is Uber’s own. If 126 permanent deactivations is the true scope, €825 million is a penalty calculated from turnover rather than harm, and appeal courts have cut fines on exactly that ground before. Uber says it already installed human review, which would make the compliance question historic rather than forward-looking.
The Digital Omnibus proposal the European Commission published in November 2025 would rewrite Article 22 from an individual right into a set of permissible processing conditions, and would state that offering a human alternative does not stop a controller from deciding by automated means. Had that text been law during 2018 to 2022, this decision would read differently. Brussels may be softening the exact provision the AP just enforced.
There is also a reason the classification bill may never arrive at Glovo’s scale. Uber restructured its UK arrangements already, and the accounting shows it: a business model change moved driver payment costs from cost of revenue to contra-revenue, knocking $1.1 billion off Q2 revenue and about 400 basis points off Mobility revenue margin with no change to underlying economics. Uber has demonstrated it can absorb a legal restructuring in a major European market and keep its margin trajectory.
Watch one thing Uber disclosed on 5 August. The company told investors that in English-speaking markets an AI agent now reconstructs trips, investigates routes and resolves eligible fare disputes end to end. Fare disputes have two sides. If the agent’s decision moves money away from a driver, Uber has built a new automated system with financial consequences for a worker, sixteen days before a regulator fined it €825 million for the last one.
Quick Questions
Is this the same as the €290 million fine from 2024? No. That decision covered unlawful transfers of driver data to the United States. This one covers automated decision-making and the failure to inform drivers about it. Both came from the same group of French drivers.
Will Uber actually pay €825 million? Unclear. Uber has appealed, and roughly 40% of announced GDPR fines have been annulled or challenged. Uber is also still contesting the 2023 and 2024 penalties.
How reliable is the €35,000 reviewer cost? It is our estimate for a fully loaded European support role, not a disclosed Uber figure. Uber does not break out trust-and-safety headcount or cost. The conclusion holds across a wide range of inputs, because the fine exceeds any plausible wage bill by two orders of magnitude.
Are the driver and employee counts on the same basis? Not exactly. The 10.2 million figure is monthly active drivers and couriers in Q2 2026; the 34,000 employee count comes from the 10-K as of 31 December 2025. The Adecco comparison mixes a daily on-assignment figure with company-based FTEs from the same document.
Does this hit Uber Eats couriers too? The AP decision concerns drivers. The Platform Work Directive covers all platform work, so couriers fall inside the human-oversight rules from December.
The Business Model Analyst Take
Every wire story priced this as a privacy fine. Price it as a labour cost instead and the number changes meaning.
Uber’s cost advantage over a staffing company has never been the app. It is that 10 million people work through the platform and nobody at the company is responsible for any of them. That structure survives on one condition: no Uber employee makes a judgement call about a named individual. Automation was the mechanism, not the motive.
The AP has now attached €825 million to breaking that condition, and the Platform Work Directive removes the option in 103 days regardless of how the appeal goes. Uber will staff the review desk, because the wages were never the problem. What follows is a paper trail of Uber managers deciding who works and who does not, filed in 27 jurisdictions, arriving at the same moment those jurisdictions adopt a presumption that platform workers are employees.
Glovo already ran this experiment and lost in a way you can read on Delivery Hero’s income statement. Uber has agreed to buy the company holding those results. The €825 million is the invoice you can see.
