Dutch DPA fines Uber €824.99M for automated driver deactivation without human review

The problem

Uber operates a ride-hailing platform whose drivers depend on continued access to the app for their income. Between 2018 and 2022 Uber decided whether to cut that access using software rather than people. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) found that “Uber used software to track drivers’ (driving) behaviour and to track customer reviews. If that software detected a suspicion of fraud or customer reviews were too low, the accounts of the drivers concerned were automatically deactivated. There was no human assessment here” (source). This is a regulator-origin, adjudicated public record — a national data-protection authority ruling on an automated decision system, not a vendor case study.

What was built

The system made two kinds of automated call: a temporary deactivation on a suspicion of fraud, and a permanent deactivation for persistently low ratings. Per the AP, “In case of suspicions of fraud or customer reviews that were too low, drivers’ accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation” (source). NOS, the Dutch public broadcaster, described the same mechanism: “de taxidienst zou accounts van chauffeurs hebben gedeactiveerd via automatische systemen en zonder de chauffeurs daarover goed te informeren” (the taxi service allegedly deactivated driver accounts through automated systems and without properly informing them) (source). The AP’s legal characterisation was that this breached the GDPR: “Uber has violated the prohibition of fully automated decision-making under the General Data Protection Regulation (GDPR). The AP also found that Uber did not sufficiently inform drivers about automatic decision-making” (source).

The outcome

On 21 August 2026 the AP “imposes a fine of 824,990,000 euros on Uber” (source). Reuters, via TechCrunch, corroborates the penalty firsthand: “The Dutch Data Protection Authority is fining Uber €825 million (around $966 million) — the second largest penalty issued so far under Europe’s General Data Protection Regulation” (source). NOS independently confirms the figure and its rank: “De Autoriteit Persoonsgegevens (AP) heeft Uber een boete van 825 miljoen euro opgelegd … Het is de op een na grootste boete tot nu toe” (the AP has imposed a fine of 825 million euros on Uber … it is the second-largest fine so far) (source). The AP sets out how the amount was reached: “These fines amount to a maximum of 4% of a company’s worldwide annual turnover. Uber had a global turnover of around 44.5 billion euros in 2025. Uber has filed an appeal against the fine” (source). Uber contests the decision: “We strongly disagree with this decision and disproportionate fine,” an Uber spokesperson told Reuters (source). The investigation began with drivers, not regulators: per the AP, “The AP launched this investigation into Uber after 171 French drivers reported to the Ligue des droits de l’Homme (LDH) … LDH then lodged a complaint with the French privacy regulator, the CNIL … The AP then did research, because Uber’s European headquarters are in The Netherlands” (source).

A note on the weakest link

The exact euro figure — €824,990,000 — is stated precisely by only one source, the AP’s own press release; the independent press rounds it to “€825 million” / “around $966 million” (Reuters via TechCrunch, NOS), so the precise nine-digit figure rests on the Tier-1 primary alone, while the rounded €825M and its second-largest-GDPR-fine ranking are what the two independents carry firsthand. The AP press release states the ruling as a breach of “the prohibition of fully automated decision-making” but does not print the GDPR article number (Article 22); the specific article and the penalty calculation would be confirmed by the full boetebesluit (fine decision) PDF, which the AP had not yet published in text-extractable form at capture time, so this page does not assert an article number. Uber’s own position — that most suspensions are brief and that permanent deactivations now involve human review — is recorded as a disputed claim, not as fact (source).

How this was verified

• Method: Tier-1 regulator-origin adjudication — the Dutch DPA’s English press release of 21 August 2026 (“Uber fined nearly 825 million euros for automated driver blocking”), the primary for both critical claims (the €824,990,000 fine and the human-review-free automated deactivation, 2018–2022). Every quoted line above was captured live this session into sources/.
• Corroboration: the fine and the automated-deactivation finding are carried firsthand by two independent Tier-2 newsrooms — Reuters (via TechCrunch, “€825 million (around $966 million) — the second largest penalty … under Europe’s GDPR”) and NOS (“boete van 825 miljoen euro … op een na grootste boete tot nu toe”). Uber’s appeal and the €44.5bn 2025 turnover / 4%-of-turnover cap are stated by the AP; Uber’s rebuttal is quoted from Reuters.
• Date verified: checker-granted 2026-08-24 (confidence 1.000; substance verified round 1, durable archives bound and re-verified round 2). Awaits the owner’s validation.
• Archives: all three sources carry a durable Wayback snapshot, re-confirmed by the checker via the availability API (status 200, timestamps matching the record) and content-checked verbatim: AP primary web/20260822084252, TechCrunch/Reuters web/20260824134258, NOS web/20260824134345.
• Residual: for the exact GDPR article and penalty calculation, the AP’s full boetebesluit PDF when published would add primary detail; the ruling and the €824,990,000 figure are already carried by the Tier-1 AP press release. Green never depends on Uber confirming anything; it rests on the AP decision plus the independent public record.

Related case files

• Italy’s Garante fines Foodinho €2.6M for its rider-management algorithm — the closest sibling: another European DPA fine of a gig-economy platform for an automated algorithm that managed and penalised riders/drivers without adequate safeguards.
• Dutch DPA fines the Tax Administration €2.75M for unlawful algorithmic nationality profiling — the same regulator (Autoriteit Persoonsgegevens) striking down another automated risk-classification system on GDPR grounds.
• Louis v. SafeRent: a $2.275M settlement over algorithmic tenant screening — another automated scoring system that cut people off from an essential resource, adjudicated on the public record.
• Mobley v. Workday: AI hiring tools certified for a nationwide age-discrimination collective — automated decision-making about people’s livelihoods drawing regulatory and judicial scrutiny.

Sources

1. Autoriteit Persoonsgegevens (Dutch DPA) · “Uber fined nearly 825 million euros for automated driver blocking” · 2026-08-21 · https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking — Tier 1 (regulator-origin primary; the adjudicating authority’s own press release; independent-origin, not counted toward corroboration; live session capture in sources/01-ap-primary-en.txt; durable Wayback snapshot web/20260822084252, re-verified by the checker).
2. TechCrunch (relaying Reuters) · “Uber faces fine of nearly $1B over automated driver suspensions” · 2026-08-23 · https://techcrunch.com/2026/08/23/uber-faces-fine-of-nearly-1b-over-automated-driver-suspensions/ — Tier 2 (independent newsroom carrying the fine, the second-largest-GDPR-fine ranking and Uber’s rebuttal firsthand via Reuters; live session capture in sources/02-techcrunch-reuters.txt).
3. NOS (Nederlandse Omroep Stichting) · “Uber schond rechten chauffeurs, AP legt megaboete van 825 miljoen op” · 2026-08-21 · https://nos.nl/artikel/2627738-uber-schond-rechten-chauffeurs-ap-legt-megaboete-van-825-miljoen-op — Tier 2 (independent Dutch public broadcaster; confirms the €825M fine, the automated-deactivation mechanism and the second-largest-GDPR-fine ranking firsthand; live session capture, quoted in dossier.json).