Uber Fined €825M in Second-Largest GDPR Penalty

One fine is worth roughly 72% of every GDPR penalty issued across the entire European Economic Area during 2025. It turns on a single question: did a person look at the file before the account went dark?

Key Takeaways

• The Autoriteit Persoonsgegevens fined Uber €824,990,000 on 21 August 2026 for deactivating driver accounts through automated systems, without human involvement, between 2018 and 2022.
• The regulator found Uber breached the GDPR prohibition on decisions taken solely by automated means that carry significant consequences, and separately failed to tell drivers those decisions were automated at all.
• The penalty equals about 1.85% of Uber's €44.5 billion 2025 turnover and roughly 46% of the €1.78 billion statutory maximum, placing it second only to Ireland's €1.2 billion Meta decision of 2023.
• The case started with 171 French drivers who took their situation to the Ligue des droits de l'Homme, which complained to CNIL; the Dutch regulator handled it as lead authority because Uber's European headquarters sits in Amsterdam.
• This is the fourth Dutch fine against Uber, after €600,000 in 2018, €10 million in 2023 and €290 million in 2024, bringing the cumulative total past €1.12 billion.

What Exactly Did the Dutch DPA Fine Uber For?

The Autoriteit Persoonsgegevens fined Uber for running two systems that could end a driver's income without a human ever reviewing the file. Between 2018 and 2022 the company scored driving behaviour and customer ratings. Where the software flagged a suspicion of fraud, the account was temporarily deactivated. Where ratings stayed below a threshold, the deactivation became permanent.

Monique Verdier, deputy chair of the AP, put it plainly in the regulator's announcement of the decision: drivers were deactivated without pardon, and from one moment to the next they no longer had any income through Uber. A computer, the regulator said, should not make decisions on its own that have major consequences for you.

The second finding is quieter and more transferable. Uber did not adequately inform drivers that a machine was making the call, which meant nobody could contest a decision they did not know existed.

Which GDPR Provisions Were Cited?

The decision rests on Article 22 of the GDPR, which gives a person the right not to be subject to a decision based solely on automated processing that produces legal effects or otherwise significantly affects them, together with the transparency and information duties in Articles 13 and 14.

Article 22 is not an outright ban. It carves out contractual necessity, explicit consent and authorisation by member state law. What it demands in those cases are safeguards: a route to human intervention, an opportunity for the person to state their side, and the ability to contest the outcome. The AP's position is that Uber claimed the exception and skipped the safeguards.

If you are mapping your own processing against this, work from the AP's published decision text rather than a press summary, including this one. The specific sub paragraphs matter.

Why Is the Number So Large?

Because the AP treated the violation as belonging in GDPR's top tier and then took nearly half of what that tier allows. The €824,990,000 works out to roughly 1.85% of Uber's €44.5 billion 2025 turnover and about 46% of the €1.78 billion ceiling set by the 4% of global annual turnover cap. Source: Engadget's report on the decision.

Scale it against the enforcement baseline and the signal gets louder. Total GDPR fines across the EEA in 2025 came to roughly €1.15 billion. This single decision is about 72% of that entire year. For context on the trend line, cumulative GDPR enforcement passed €7.1 billion earlier in 2026, and a meaningful slice of that total now sits in one Dutch file.

How Did 171 French Drivers Reach a Dutch Regulator?

Through GDPR's one stop shop mechanism, which routes cross border complaints to the regulator where the company has its main European establishment. The 171 drivers reported their situation to the Ligue des droits de l'Homme in France, which lodged the complaint with CNIL on their behalf. Because Uber's European headquarters is in the Netherlands, the file landed with the AP as lead supervisory authority.

That same pathway produced the Dutch decisions of 2023 and 2024, including the €290 million penalty over transfers of driver data to the United States. Three decisions, one set of complainants, one regulator that already knows the file.

What Should Compliance Teams Do Now?

Assume any system that scores people and triggers a consequence is in scope, whether or not anyone in the building calls it AI. Fraud flags, trust and safety scores, credit thresholds, account suspension rules, automated content strikes and vendor risk tiers all fit the pattern the AP just priced.

• Inventory every consequential automated decision. Write down what triggers it, what happens, and who can reverse it. If the reversal owner is a queue rather than a person, you have an Article 22 problem.
• Evidence the human review, do not assert it. The finding here is not that Uber had no appeals process on paper. It is that the outcome was reached before a person was involved. Log who reviewed what, and when, relative to the action.
• Disclose the automation in the notice, not the FAQ. Articles 13 and 14 want the existence of automated decisions, the logic involved and the consequences, in the privacy information the person actually receives.
• Let the person state their case before the consequence lands. A post hoc appeal form is weaker than a pre action hold, and the AP's language about income stopping from one moment to the next is aimed at exactly that gap.
• Sunset the historic version too. Uber says these policies were discontinued and that current processes include human review. It was fined anyway, four years later, for conduct that ended in 2022.

US teams should read this alongside California's automated decision making technology rules that took effect in 2026. The obligations differ, but the direction is the same on both sides of the Atlantic: notice, access to the logic, and a human answerable for the outcome.

The Email Transparency Connection

Nothing about this case involves email, but the reasoning behind it is already being applied to inboxes. The AP's second finding was a transparency failure: Uber processed data in a way that materially affected people without telling them it was happening. That is structurally the same complaint European regulators now make about invisible tracking in marketing mail.

France's CNIL, the regulator that received the original driver complaint, gave email senders a compliance deadline over tracking pixels, and Italy's Garante followed with prior consent requirements for pixels that measure open rates. If you run a marketing programme in the EU, the Uber decision is a data point about how expensive undisclosed processing can get, not just a gig economy story.

Will Uber Actually Pay?

Possibly not, which is reason to be careful with the headline number. Uber has appealed, calling the fine disproportionate, disputing that permanent deactivations were ever fully automated, and noting that 126 driver accounts across Europe were permanently deactivated for low ratings in 2021. The company is still contesting the 2023 and 2024 Dutch decisions too; none of those procedures has concluded.

European precedent says large fines can evaporate for reasons unrelated to the conduct. Amazon's record €746 million GDPR fine was thrown out on procedural grounds earlier in 2026, and Ireland's €1.2 billion Meta decision remains under appeal. Most coverage led with the amount. The durable story is the standard the AP set, because that survives whatever happens to the euro figure: if automation ends someone's livelihood, you must be able to show a named human reached the conclusion, told the person it was coming, and could be overruled.