Uber fined €825M — Here's what it actually means

Last week, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) announced that it had fined Uber €824,990,000 — roughly $966 million — for violating the EU’s General Data Protection Regulation (GDPR) by using fully automated systems to deactivate driver accounts. The penalty targets Uber’s practices between 2018 and 2022, where algorithms suspended or permanently blocked drivers based on fraud suspicions or low customer ratings without human oversight or adequate transparency.

The AP ruled that Uber breached GDPR’s Article 22, which prohibits solely automated decisions with significant consequences for individuals, such as loss of income. The regulator also cited violations of Articles 13 and 14, which mandate transparency about automated processing. Uber’s systems scored driver behavior and customer ratings, triggering deactivations based on algorithmic thresholds. Drivers were not informed that machines made these decisions, preventing them from contesting outcomes. Monique Verdier, Deputy Chair of the AP, stated, "A computer should not make decisions on its own that have major consequences for you."

The fine represents 1.85% of Uber’s 2025 global turnover of €44.5 billion. It is the second-largest under GDPR after Meta’s €1.2 billion fine in 2023. Focusing solely on numbers would be simplistic; this decision shows that an entire category of platform management violates a right European workers have had on paper since 2018.

How did the investigation against Uber start?

The investigation stemmed from a complaint filed by 171 French drivers represented by the Ligue des droits de l’Homme (LDH). Due to Uber’s European headquarters being in the Netherlands, the AP handled the case as the lead supervisory authority under GDPR’s one-stop-shop mechanism. The AP collaborated with France’s CNIL during the probe. This is the fourth Dutch fine against Uber, bringing the cumulative total to over €1.12 billion, including penalties of €600,000 in 2018, €10 million in 2023, and €290 million in 2024.

What the AP actually found

According to the regulator, when Uber's systems detected suspected fraud or noticed that a driver's customer ratings had dropped below a threshold, the driver's account was deactivated. Initially, the deactivation was temporary for a first flag, then permanently for persistent low ratings — without a human being involved in the decision.

Because driving income depended entirely on having an active account, deactivation meant an immediate, often unexplained, loss of livelihood. The AP also found that Uber failed to adequately tell drivers that these were automated decisions in the first place, denying them the ability to understand or meaningfully contest what had happened to them.

Both findings map directly onto Article 22 of the GDPR, which bars decisions with legal or similarly significant effects on a person from being made "solely" by automated means, absent an exemption, and onto the broader transparency obligations that require people to be told when algorithms are making consequential calls about them.

Why the impact goes beyond Uber

The decision lands at a moment when "gig economy" regulation and AI governance are converging across Europe. The EU's Platform Work Directive, still being transposed into national law across member states, contains its own algorithmic-management protections — including a presumption of employment in some cases and explicit limits on automated deactivation. The Uber ruling effectively previews how national regulators intend to police that overlap: not by waiting for new AI-specific rules to bite, but by applying existing GDPR machinery to platform labor practices right now.

For any company that uses scoring systems, fraud models, or rating thresholds to manage a distributed workforce — food-delivery apps, freelance marketplaces, warehouse-adjacent gig platforms — this is a signal that "the algorithm decided" is no longer a viable shield, and that meaningful human review has to be real, not a rubber stamp appended after the fact.

It also matters for how "meaningful human review" gets defined going forward. Uber has disputed the AP's characterization, arguing that most suspensions are brief, that permanent deactivations always involve a human, and that drivers can appeal. The AP's contrary finding — that some permanent deactivations occurred without human review — sets up a fight over where exactly the line sits between a system that flags a case for a person to decide and a system whose recommendation is functionally the decision, rubber-stamped after the fact. Regulators and courts across the EU will likely look to this case, and to Uber's appeal, for guidance on that boundary.

The financial and reputational stakes

For Uber, the fine — its second major Dutch penalty in two years, after a €290 million fine in 2024 over unlawful data transfers to the US — is financially absorbable but reputationally costly, arriving as European regulators intensify scrutiny of large American platforms generally.

The American company said the fine was disproportionate as only a small number of drivers were affected. In 2021, 126 of them were deactivated in Europe as a result of low customer ratings. The company stated its policies include dispute opportunities and meaningful human intervention and that it would appeal the decision. Uber has also noted that the practices covered by the decision were discontinued years ago and that current policies already build in human review and dispute channels.

The fine lands amid rising friction between Washington and Brussels over penalties on US tech companies, with President Trump having threatened tariffs in response to what he has called unfair treatment of American firms.

What comes next

Two things will determine how far this ruling reaches. First, the appeal: if Uber succeeds in narrowing the AP's findings — particularly its claim that some permanent deactivations bypassed human review — the precedent will weaken considerably. Second, contagion: other European regulators, and drivers' unions in France, Germany, and the UK who have long campaigned against automated deactivation, are likely to treat this decision as a template for their own investigations. Either way, the message platforms are meant to take away is straightforward — automated systems can flag, score, and recommend, but the moment a decision meaningfully affects someone's livelihood, a human has to actually be the one making it, and the person affected has to be told that's what happened.