Scale AI Accused of Replaying Workers' Keystrokes as Video
Imagine finishing a shift and discovering that your working day could be played back like a film — every keystroke, every drift of the mouse, every pause, stitched together into a video you never agreed to star in. That is, in essence, what European privacy campaigners say Scale AI has been doing to the freelance workers who train its customers' AI models. And on Tuesday 27 October 2026, they took the claim to four countries' regulators at once.
The group behind the complaints is noyb, the European Centre for Digital Rights, best known for a decade of GDPR cases against US tech giants. This time its target is not a social network or a search engine. It is the hidden workforce underneath the AI boom: the people who write prompts, rank answers and correct chatbot output so that the finished models sound clever. Scale AI, the San Francisco company behind the Outlier platform, says none of it is true. The regulators in France, Italy, the Netherlands and Austria now get to decide who is right.
That contest matters far beyond one company. If noyb's version of events holds up, it would mean one of the AI industry's most important suppliers built its business on surveillance its workers never meaningfully consented to — and that the firms buying that labour, including Meta, OpenAI and Google, have been looking the other way. If Scale AI's version holds up, it would mean Europe's most aggressive privacy group has mistaken ordinary fraud prevention for spying. Either way, the answer will shape how AI gets trained from here on.
Five complaints, four countries, one platform
Noyb filed five complaints in total: two in Austria, and one each in France, Italy and the Netherlands, according to its own statement, as reported by AFP. The complaints, which Reuters has seen, target Outlier, the platform Scale AI operates for AI training work. More than 900,000 freelancers use it, noyb says, evaluating and correcting AI systems for customers that include Meta, OpenAI, Google, xAI, Anthropic and the US government. Meta owns 49% of Scale AI, Reuters reports.
The complaints were put together as part of an interdisciplinary initiative on working conditions across AI value chains, led by the French organisation Intérêt à Agir in partnership with DiPLab and supported by the European AI & Society Fund and the Digital Freedom Fund, noyb says. That coalition matters, because this is not a case built on legal theory alone. It rests on technical analysis and on two years of field research by Thomas Le Bonniec, a sociology researcher at the Paris-based research collective DiPLab, who co-authored a report on Outlier's data collection practices earlier in October.
Noyb is asking the regulators to investigate fully and, if the allegations are upheld, to fine Scale AI — and, as Reuters puts it, to examine how the platform assigns tasks. That second ask is easy to miss and arguably the most interesting part of the case. Noyb is not only complaining about what data was collected. It is asking regulators to look at the machinery that decides who gets work at all.
The video made from your working day
The most arresting allegation in the complaints concerns tracking. According to noyb's technical analysis, while workers are logged in to Outlier, trackers from companies such as TikTok, LinkedIn, Facebook, the survey platform Sprig and the data analysis company Datadog are placed on their devices. Every few seconds, noyb alleges, those trackers send workers' personal data to third parties — IP addresses, contact details, unique identifiers and information about the page being visited. That data, noyb warns, can then be used for targeted advertising and profiling.
Reuters, which has seen the complaints, reports that up to 19 trackers follow workers while they work, including recording keystrokes and mouse movements every few seconds. DiPLab's investigation found that the resulting file could be rebuilt into a video replaying a work session from start to finish. Read that sentence again slowly. Not a log. Not a summary. A replay.
It is worth pausing on what that would feel like from the worker's side of the screen. A working day is full of unguarded moments: the hesitation before answering a question you are not sure about, the tab you switch to when you are stuck, the long pause that means you are thinking, or tired, or simply human. A replay collapses all of that into footage. Whether any manager ever watched such a replay is not the point noyb is making. The point is that the material to build one allegedly existed at all, collected by third-party trackers whose business is advertising, not employment.
Noyb's data protection lawyer, Lisa Steinfeld Leiser, put the objection in the plainest possible terms: "Such constant and extensive tracking while working really goes against all reasonable expectations. Why should LinkedIn or Facebook know which tasks you're working on?" It is a good question, and it is one Scale AI will have to answer with something better than a shrug. The complaints argue, in noyb's words, that the company lacks a valid legal basis to place trackers on workers' devices without consent, and that the collection breaches the GDPR's principle of data minimisation — collect only what is strictly necessary, and no more.
Show us your face — again, and again
The second strand of the complaints concerns identity checks. Scale AI, noyb alleges, forces workers to repeatedly go through a biometric verification process run by a company called Persona. Workers must record a video of their face and upload their identity document. The checks, the complaints say, were invasive, repeated without explanation, and broke EU rules on biometric data.
Scale AI says the checks exist to prevent identity fraud and to verify workers' skills. Noyb's answer is that the process goes far beyond what would be necessary for either purpose — and that the vendor's own record should worry anyone being asked to hand over their face. In October 2025, noyb says, approximately 70,000 photos of government-issued IDs stored with Persona were exposed by hackers. Persona also grants itself the right to collect large amounts of personal data, noyb alleges, including IP addresses, device information, geolocation data, addresses and consumer credit data.
Here the case touches something larger than one vendor. Biometric data gets special protection under European law precisely because you cannot change your face the way you change a password. A leaked ID photo is bad. A system that repeatedly demands fresh face videos from people who need the money is, in noyb's telling, something else again: a toll booth on the road to being paid, operated by a third party whose data practices the worker never chose.
We checked the three TechPulse USA posts linked in this article before writing it, and each one was still live at the time of writing. The pattern they trace — workers, agents and platforms colliding with rules written for an older internet — is the same pattern running through this case.
The bonus clock: 200 tasks, 24 hours, $100
The complaints also take aim at how Outlier motivates its workforce. Outlier uses game-like mechanisms, DiPLab found, and bonuses are a key part of its incentive system. Le Bonniec, citing interviews with workers during his investigation, told Reuters that Outlier offered bonuses of $100 to $200 for completing 200 tasks in 24 hours.
Do the arithmetic on that and the picture sharpens. Two hundred tasks in a day is not a target; it is a treadmill. It rewards speed over care, stamina over judgment — which is a strange thing to incentivise in people whose entire job is to make AI systems more careful and more truthful. Le Bonniec noted that Italy's data protection authority fined delivery platform Glovo in 2021 over similar gamification, a precedent noyb plainly hopes will travel from food delivery to AI training.
Le Bonniec's own summary of the power imbalance is the line that will travel furthest from this story. "You don't work when you want," he told Reuters. "You work when the platform wants you to and there are tasks available." Freelance status, in that telling, is a fiction with a schedule attached: all of the insecurity of self-employment, none of the freedom. It is a sentence worth sitting with, because it punctures the founding myth of platform work — that flexibility flows in both directions.
"We asked for our data. Nobody answered."
The fourth strand of the complaints is, in some ways, the simplest — and the hardest for Scale AI to explain away. Four workers asked Outlier for copies of their data between December 2025 and May 2026, the complaints say. None received an answer.
Under the GDPR, that right of access is not a courtesy. It is the mechanism by which every other right becomes real: you cannot challenge what is held about you if you cannot find out what is held. Noyb argues that by failing to respond at all, Scale AI violated that right outright. No legal basis, no minimisation argument, no fraud-prevention rationale can rescue a silence. Either the requests were answered and the complaints are wrong, or they were not and the company ignored four people asking a straightforward question about their own information.
This is also where the case stops being abstract. Behind every tracker count and every legal principle is a worker who did the one thing the law invites you to do — asked — and heard nothing back for months. Regulators notice that kind of detail. It turns a technical dispute about trackers into a story about a company that, on noyb's account, did not think its workers were owed a reply.
Scale AI answers back
To be fair to Scale AI, it has not stayed silent. It did not immediately respond to Reuters' request for comment when the complaints were filed. But after The Register published its account of the case, Scale AI gave the outlet a statement that deserves to be quoted in full, because it is the company's whole defence in miniature: "The report's claims are unfounded and inaccurate. Outlier's practices are disclosed to contributors and require their consent. We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment."
Every clause of that statement is doing work. "Disclosed" and "consent" are aimed squarely at noyb's legal-basis argument: if workers were told and agreed, the tracking has a basis. "Standard tools" is aimed at the outrage: everybody does this, it is plumbing, not surveillance. "Prevent fraud", "protect confidential project information" and "ensure accurate payment" are the legitimate purposes that, if accepted, could justify collecting a great deal.
The trouble for Scale AI is that each of those claims is now testable against the complaints' specifics. Disclosure in a long terms document is not the same as consent to third-party advertising trackers firing every few seconds. Fraud prevention does not obviously require recording mouse movements, or sharing data with TikTok and Facebook. And accurate payment does not obviously require repeated face videos from people already verified. The regulators' job, over the coming months, will be to hold each justification up against each specific practice — not to rule on "surveillance" in the abstract, but on whether this tracker, for this purpose, with this data, was lawful.
It is also worth noting what Scale AI's statement does not do. It does not address the four unanswered access requests. It does not explain the 19 trackers, or the video replay, or the bonus treadmill. A blanket denial is a legitimate opening move, but it is not a rebuttal. The company will need a better one, in front of regulators rather than reporters, if this case proceeds.
Why this case could travel further than Europe
On paper, this is a European case about European workers under European law. In practice, its audience is global, for three reasons.
First, the supply chain is global. The models trained on Outlier labour are sold everywhere, including in the United States, and the customers named in the complaints — Meta, OpenAI, Google, xAI, Anthropic — are American companies whose products American readers use daily. A finding that the labour behind those products was unlawfully surveilled would not stay a Brussels story for long. It would land in every debate about AI ethics that currently treats training data as if it fell from the sky.
Second, the workforce is not small. Noyb notes that more than 40 million people across Europe already have their work organised by platforms, from couriers to coders. AI training is the newest and fastest-growing corner of that economy, and it is also the one where the workers are most invisible — precisely because the product of their labour is presented as machine intelligence. A ruling here would set a marker for every platform that treats freelance status as a licence to monitor without limits.
Third, the politics have shifted. The Register notes that the complaints could add fuel to the EU's digital-sovereignty movement, which has begun questioning whether the bloc should depend so heavily on US tech companies. That framing can cut both ways: it could stiffen regulators' spines, or it could let Scale AI portray the case as politics dressed up as privacy law. Either way, a case that started with keystrokes is now entangled with the biggest question in transatlantic tech — who sets the rules for the infrastructure everybody else builds on.
Here is where this publication takes its stance, plainly. If even half of what noyb alleges survives scrutiny — the tracker count, the replayable sessions, the repeated face checks, the unanswered requests — then this is not a paperwork breach or a consent-form technicality. It is a botched bargain at the heart of the AI boom: an industry that asks the public to trust its models has been asking its most precarious workers to surrender the privacy it would never demand from its own engineers. The AI industry loves to talk about alignment — about making systems behave in line with human values. There is no alignment worthy of the name that begins by treating the humans who train the system as data to be harvested. Scale AI may yet prove the complaints wrong in detail. But the burden of proof, morally if not legally, now sits with the company that built the tracking, not with the workers who lived under it.
There is a counter-argument worth stating honestly. Fraud in data-labelling platforms is real, and it is not trivial: fake accounts, bot-completed tasks and stolen credentials would poison the very training data customers pay for. Some verification and some activity monitoring may be genuinely necessary, and a ruling that banned it outright would hurt workers too, by flooding platforms with fraudsters. The question is proportionality, not purity — and proportionality is exactly what data minimisation law is designed to test. The complaints do not demand the end of verification. They demand that verification stop where necessity stops. That is a reasonable demand, and it is one Scale AI has yet to meet on the specifics.
What happens next
For now, nothing is decided. The complaints are allegations, not findings, and the regulators in France, Italy, the Netherlands and Austria have not ruled on any of them. What follows is the slow machinery of European enforcement: admissibility checks, correspondence with the company, possibly coordinated investigation across the four authorities, and eventually — months from now, at the earliest — a decision on whether to fine Scale AI or order changes to its practices.
Three things are worth watching while that machinery turns. The first is whether Scale AI publishes a detailed rebuttal, tracker by tracker, rather than a blanket denial; the specificity of its answer will tell you how confident it is. The second is whether any regulator moves quickly on the access-request strand, which is the simplest allegation to verify and the hardest to spin. The third is whether other workers come forward — because five complaints in four countries have a way of becoming fifty once the first ones are public.
There is also a question for the companies buying this labour. Meta owns nearly half of Scale AI. OpenAI, Google, xAI and Anthropic all use its platform, on noyb's account. None of them is a respondent in these complaints, but all of them will be asked, sooner or later, what diligence they did on the conditions under which their training data was produced. "We didn't know" is a weaker answer every time a case like this is filed. After this week, it is barely an answer at all.
The AI industry has spent two years telling the world that its systems are trained on human expertise. This case asks a simpler question: what did it do to the humans? The answer, whatever the regulators eventually decide, will say more about the industry than any benchmark ever could.
Related reading on TechPulse USA: the security guards walking out at Anthropic, OpenAI, Google and Amazon over pay and conditions; OpenAI's rogue agents casing the internet for vulnerabilities; and how Google quietly let Gmail and Photos feed its ads — three earlier stories about who bears the cost when AI companies move fast.
Sources: Reuters (27 October 2026), reporting on complaints seen by the agency; noyb's press release and statement, as reported by AFP via ET Telecom; The Register (27 October 2026), including Scale AI's later statement; DiPLab's Outlier investigation, as cited by noyb and Reuters. Allegations in the complaints are attributed to noyb throughout; they have not been upheld by any regulator.
By Daniel Rao, AI correspondent
Daniel Rao covers AI policy, platform security, and the geopolitics of technology for TechPulse USA.
Comments
Post a Comment