The Dutch Data Protection Authority (AP) has fined Uber €825 million — roughly $966 million — for using automated systems to deactivate drivers' accounts without adequately informing them, in what is believed to be the second-largest penalty ever issued under Europe's General Data Protection Regulation.

The decision, reported Friday by Reuters after the news agency reviewed the regulator's findings, lands at the intersection of two of the most consequential trends in technology: the spread of algorithmic management in the gig economy, and Europe's increasingly assertive enforcement of the rules that govern automated decision-making. For ongoing coverage of how governments are policing AI systems, follow AI Buzz Wire's regulation reporting.

What the Regulator Found

According to the AP, Uber's automated systems temporarily suspended the accounts of multiple drivers in Europe who were suspected of fraud between 2020 and 2022. In some cases, drivers with low customer ratings were suspended permanently.

The regulator concluded that the practice violated drivers' rights under the GDPR, which restricts companies from letting a computer algorithm make decisions that have a significant impact on people's lives. Being cut off from a platform that individual drivers depend on for their livelihood is considered a substantial consequence.

"The AP has determined that Uber violated drivers' rights, specifically the right not to be subject to automated decision-making that has significant consequences," the regulator said in its decision, as quoted by Reuters. "Uber has also violated their right to be informed."

Why a Dutch Regulator Took the Case

The investigation stemmed from a complaint filed by Uber drivers in France. The AP handled the case because Uber's European headquarters is located in the Netherlands, making the Dutch authority the lead privacy supervisor for the ride-hailing company's operations across the European Union.

The scale of the penalty is what makes the case exceptional. The €825 million fine is believed to be the second-highest ever issued under the GDPR, surpassed only by the €1.2 billion penalty imposed on Meta in 2023 by Ireland's data protection regulator over unlawful transfers of European user data to the United States. Meta, like Uber, appealed against that fine, and the case remains unresolved.

Uber's Response

Uber said it would appeal against the decision, arguing that it did not permanently deactivate accounts without human review. The company told Reuters that it no longer makes permanent decisions about deactivation solely through automated systems.

"We strongly disagree with this decision and disproportionate fine," an Uber spokesperson said in a statement, adding that the company takes drivers' rights seriously and that its current policies include human reviews and opportunities for drivers to dispute account decisions.

Why the Case Matters Beyond Uber

At its core, the decision is a warning to every company that lets software make consequential choices about people — deactivating accounts, cutting payouts, restricting access to a platform — without meaningful human oversight or transparency.

The GDPR's automated decision-making provisions were written years before the current wave of AI agents and algorithmic management tools, but European regulators are increasingly applying them to modern machine-learning systems. The Uber fine demonstrates that the rules carry teeth: penalties can now reach the same order of magnitude as major antitrust actions, and they apply to decisions made by systems operating at the scale of millions of users.

For gig economy platforms, the case is likely to prompt a broad re-examination of fraud detection, rating-based deactivation, and identity verification systems — precisely the kind of automated workflows that have historically been cheap to run and difficult for affected workers to challenge. Drivers in Europe have long complained that account suspensions arrive with little explanation and no practical avenue for appeal, and the AP's decision directly validates the core of those complaints.

The ruling also arrives as Brussels layers additional obligations onto AI systems through the EU's AI Act, which imposes transparency and risk-management requirements on systems that affect individuals. Companies that have not already mapped which of their automated processes fall under these regimes now face mounting legal and financial exposure — a signal reinforced by the Financial Times, which noted that the Uber penalty ranks among the largest GDPR sanctions on record.

What Happens Next

Uber's appeal will run through the Dutch courts, a process that in precedent cases such as Meta's has already stretched across years. In the meantime, the fine stands as the most significant European enforcement action to date against algorithmic account management, and privacy regulators across the bloc are expected to study the AP's reasoning closely.

For drivers, the immediate practical change may be limited — Uber maintains its current systems already include human review. But the decision establishes that suspending someone from a platform they rely on for income is a "significant consequence" under European law, and that companies must inform people when such decisions are made about them.

As automated systems take on more decision-making across the economy, from lending to hiring to platform access, the Uber case offers one of the clearest signals yet of where the legal boundaries lie — and of the price of crossing them.

Stay Ahead of AI Regulation Read more AI news →