Outlier faces five EU privacy complaints over AI contract work

Privacy group noyb said on October 27 that it had filed five data-protection complaints against Scale AI over its Outlier training platform: one each in France, Italy and the Netherlands, and two in Austria. The disputes concern contractor tracking, biometric processing and responses to requests for personal data. Scale rejects the allegations.

Outlier contributors evaluate AI responses and create training material. The complaints address collection of those workers’ personal information. DiPLab, a research partner, published its underlying study on October 15. Its introduction describes comparing worker interviews, network logs and platform guidelines. The October 27 complaints are the new legal step arising from that investigation.

The Dutch complaint describes a contractor recording browser-server traffic on May 22. According to noyb’s analysis, the capture contained LinkedIn advertising trackers and requests from a session-replay service. A survey tool allegedly collected contact details, pay-related information and the page visited even though the contractor was not answering a survey. These are allegations about a particular recorded session.

The French filing says Facebook-related requests contained worker and project identifiers, task-allocation status and a reason for having no work: none matched the contributor’s expertise. Noyb challenges this combination of work information and advertising tracking. These are noyb’s allegations in the complaint.

Outlier’s privacy policy, effective March 13, permits collecting ID images, selfies, video or audio and generating facial measurements at registration and afterward. Providers such as Persona verify identity and qualifications to protect service integrity and reduce fraud.

It specifies retention for up to two years after the last interaction, or as required by law, with alternative verification available in certain circumstances. Noyb alleges repeated compulsory ID and facial-video submissions and excessive collection.

Outlier’s cookies policy, displaying a May 15, 2023 effective date, describes interest profiling, advertising measurement and relevant ads on other sites. It lists necessary, functional, advertising and analytics categories. The company says preferences can be changed through a consent tool; necessary cookies cannot be disabled, and refusing functional cookies can affect features. The policy also says cookie information can become personal data when combined with other information. It does not support browser Do Not Track signals or guarantee that advertising partners honor every opt-out.

In a response to The Register, Scale called the report’s claims unfounded and inaccurate. It said practices are disclosed to contributors and require consent, and that standard tools support identity checks, fraud prevention, project confidentiality and accurate payment. The publication added that response to its October 27 article.

The French complainant requested records about automated decisions from Outlier on February 2, then personal data from Persona on May 12. Noyb says Outlier did not answer and Persona only acknowledged receipt. Those earlier requests are documented in the filing.

The reviewed record contains complaints and Scale’s response, with no final sanction or announced Outlier shutdown timetable. The Dutch complainant requests an order granting data access, investigation including automated decision-making, and an administrative fine.