Summary

  • The Autoriteit Persoonsgegevens says Uber automatically suspended drivers over suspected fraud or low customer ratings, and permanently deactivated accounts after persistently low ratings.
  • The regulator imposed a €824.99 million fine and said the violations had stopped. Its 21 August 2026 announcement says Uber planned to appeal.

An app can turn a working day into a grey screen before breakfast. The Dutch Autoriteit Persoonsgegevens says Uber’s driver software did that between 2018 and 2022: suspected fraud or low customer ratings could trigger automatic account deactivation, and persistently low ratings could make it permanent. There was no human assessment before the switch. When the account went dark, income through Uber went with it.

The AP’s bill is €824,990,000. That number has the tidy certainty of a spreadsheet cell; the event it describes is a person losing access to the channel through which they earned. A rating is a signal. A fraud flag is a suspicion. The account switch turns either into an employment-sized consequence.

The case began with 171 French drivers who contacted the Ligue des droits de l’Homme. The group filed a complaint with France’s CNIL, which passed it to the AP because Uber’s European headquarters are in the Netherlands. The AP says it worked closely with CNIL and coordinated the fine with other European supervisory authorities. A cross-border platform produced a cross-border complaint, then met the regulator located where its European headquarters sit.

The AP says the conduct violated GDPR Article 22’s restriction on decisions based solely on automated processing when they produce legal or similarly significant effects. It also says Uber did not adequately inform drivers about the automated decisions. Those are related failures with different control points: one concerns who or what makes the decision; the other concerns whether the person can see the system acting on them.

The fine was calculated against a company with €44.5 billion in worldwide revenue in 2025, according to the AP. The GDPR allows administrative fines up to 4% of worldwide annual turnover for the relevant category of infringement. A fine at this scale is designed to reach the decision-making centre, not to resemble a refund to each driver. The authority’s public notice says the violations have stopped. On 21 August, it also said Uber intended to appeal.

The notice does not publish the underlying enforcement decision or anonymised driver-level records. Those records would show how the authority assessed each trigger, the information drivers received, and any route to a meaningful human review. That is the specific evidence that would sharpen the case beyond the regulator’s public account.

The practical lesson for platforms is less exotic than the fine: if software can close the account, the system needs a named decision owner, a record of the inputs and rule version, a notice the driver can understand, and a review path that can actually reopen access. A support queue that can only repeat the system’s verdict is a printer with a headset.

For operators and investors, the issue is the distance between the button and the balance sheet. Automated enforcement can reduce fraud and protect service quality. It can also move the cost of a mistaken signal onto the person least able to wait for the next review cycle. A platform that measures false positives only as support tickets will miss the lost shifts, lost income and damaged trust that the switch produces.

Sources