The ruling in brief
The Dutch Autoriteit Persoonsgegevens (AP) fined Uber €824,990,000 on 17 August 2026 for violating GDPR Article 22, announced publicly on 21 August. Uber’s system automatically suspended and in some cases permanently deactivated driver accounts in Europe between 2020 and 2022 based on fraud signals and low customer ratings, with no human review before the decision took effect and no clear mechanism to contest it. The fine is the second-largest GDPR penalty on record, behind only the €1.2 billion levied against Meta in 2023 for cross-Atlantic data transfers.
The case originated with 171 French drivers whose accounts were suspended. Their complaints, filed through the human-rights organisation Ligue des droits de l’Homme with France’s CNIL, were referred to the Dutch AP under the GDPR one-stop shop mechanism because Uber’s European headquarters are in Amsterdam. Uber has stated it “strongly disagrees” and plans to appeal, adding that current policies include human review and appeal channels. The AP’s ruling covers the older system, not today’s one.
For teams building GDPR-compliant software, the fine is a landmark data point: this is what Article 22 enforcement looks like at scale, and its reach extends to any company whose platform affects EU residents, regardless of where it is incorporated.
What Uber’s algorithm did
Uber’s platform flagged drivers for three categories of suspected behaviour: taking unnecessary detours that inflated fares, accepting rides and then not completing them, and accumulating low ratings from passengers. When a driver’s profile crossed a threshold on any of these signals, the system could temporarily or — in the cases that drew the most attention — permanently remove their access. The decision was made, communicated and enforced by software. No human reviewed it before it went into effect.
For the affected drivers, the consequence was not a minor inconvenience. Loss of platform access meant immediate loss of income, often without a clear explanation of which specific incident triggered the deactivation or what they needed to do to reinstate their account. The regulator concluded this was precisely the kind of “significant effect” that Article 22 is designed to guard against: an automated system making a determination with serious real-world consequences for a person’s livelihood, without the person having a meaningful way to engage with a human before or after the fact.
What Article 22 actually requires
Article 22 of the GDPR gives every individual in the EU the right not to be subject to a decision based solely on automated processing when that decision produces legal or “similarly significant” effects. A person losing access to a platform they depend on for income clearly falls within that scope. The rule is not a blanket ban on automation; it sets three conditions that must be met when automated decisions with significant effects are used:
- Inform: Tell the data subject that an automated decision is being made, and explain the logic involved in accessible terms.
- Involve: Provide a mechanism for a human to review the decision before or promptly after it takes effect — not a checkbox, but a real review pathway.
- Contest: Give the data subject the ability to challenge the outcome and have it reconsidered.
Uber’s system, as it operated between 2020 and 2022, failed on all three counts for permanent deactivations. The AP also found violations of the right to be informed about the nature of the decision — drivers were not told clearly that an algorithm, not a person, had made the call.
The connection to the EU AI Act is direct. The Act’s provisions on high-risk AI systems, which became enforceable in August 2026, also require human oversight, transparency and contestability for AI-driven decisions in employment and work management contexts. A system like Uber’s would fall squarely within that high-risk category — meaning teams now face overlapping compliance obligations from both frameworks. For companies navigating this intersection, building EU AI Act compliance alongside GDPR Article 22 requirements from the design stage is far cheaper than retrofitting them after launch.
A pattern of escalating fines
This is not the Dutch AP’s first action against Uber. The same regulator issued a €600,000 fine in 2018 for data-protection failures in a driver breach, a €10 million fine in early 2024, and a €290 million fine later in 2024 for unlawful data transfers to US servers (also under appeal). The pattern suggests that for a company processing large volumes of personal data about EU residents, repeated violations without structural change attract increasingly severe responses. The €825 million figure — approximately 4% of Uber’s reported annual global revenue — is calibrated to be a deterrent rather than a cost of doing business.
The case also illustrates how the GDPR one-stop shop can aggregate a cross-border problem into a single enforcement action. The 171 drivers who brought complaints were in France; the fine was issued by the Dutch authority; the penalty affects Uber globally. For multinational companies or platforms with users spread across EU member states, this mechanism means that a complaint pattern in one country can escalate into a pan-European enforcement action without the company being able to resolve it jurisdiction by jurisdiction.
What it means for US & EU software teams
Three signals for teams building platforms or internal tools that make automated decisions about people:
Scope is extraterritorial. GDPR applies wherever EU residents are affected, regardless of where the company is based or where the algorithm runs. A US-headquartered SaaS platform that uses automated scoring to restrict access, approve loans, price insurance or manage contractors in Europe is within scope. “We’re incorporated in Delaware and our servers are in Virginia” does not move the needle with a European regulator.
Architecture is the compliance question. The fixes Uber said it introduced — human review and appeal mechanisms — are engineering problems. Building those pathways into a platform after launch is significantly harder and more expensive than designing for them at the outset. For any product that makes automated decisions with significant consequences, the Article 22 requirements (inform, involve, contest) need to be in the initial architecture, not bolted on after a regulator writes.
The enforcement tempo is accelerating. Between the GDPR coming into force in 2018 and the end of 2023, total fines across Europe reached roughly €4 billion. The Dutch AP’s single action against Uber adds €825 million. Regulators have spent seven years building enforcement capacity and precedent; those investments are now yielding larger penalties more quickly. Waiting for a complaint before auditing your automated decision systems is no longer a safe posture.
A practical checklist for automated decision systems
These steps do not constitute legal advice, but they represent the engineering and process work that the Article 22 framework requires and that regulators will look for:
- Map your decisions. List every automated system that produces an outcome affecting a user’s access, score, price, status or employment. Label each by significance: which ones have effects that a reasonable person would consider material to their rights or livelihood?
- Add a human step before significant consequences. For any decision in the “material” bucket, require a human review before the decision is executed or at the very least immediately accessible on challenge. Document the review process, who conducts it, and how long it takes.
- Build a contestability flow. A button that says “appeal” is not sufficient. The affected person must be able to reach a human, understand the basis of the decision in accessible language, and receive a genuine reconsideration — not an automated acknowledgement.
- Disclose in plain language. Your privacy notice and any system-facing communication should state, in terms a non-specialist can understand, that automated decisions are made, what they are based on, and what rights the person has.
- Keep an audit trail. Log which model version made which decision, on what inputs, at what time, and what human review (if any) was applied. This is what you will need if a regulator asks.
- Review your EU AI Act obligations in parallel. For platforms operating in employment, credit, insurance or similar high-stakes domains, the Act’s high-risk requirements will apply alongside Article 22. Treat them as a single compliance surface, not two separate projects.
Frequently asked questions
What did Uber do that triggered the €825 million GDPR fine?
Uber used a fully automated system to flag and deactivate drivers across Europe between 2020 and 2022 based on signals like suspected detours, trip cancellations and low customer ratings. In some cases drivers were permanently removed with no opportunity for human review before the decision took effect. The Dutch DPA ruled this violated Article 22 of the GDPR, which gives individuals the right not to be subject to solely automated decisions that have significant effects on them without meaningful human involvement.
What is GDPR Article 22 and when does it apply?
Article 22 of the GDPR covers automated decision-making, including profiling, that produces legal or similarly significant effects for a person. If your system makes a decision about an individual without any human in the loop, and that decision meaningfully affects their rights or circumstances — employment, credit, platform access — Article 22 applies. The data subject must be told an automated decision is being made, must be able to request human review, and must be able to contest the outcome.
Does this ruling affect US companies serving EU users?
Yes. GDPR applies to the personal data of individuals in the EU regardless of where the company processing that data is based. A US platform that makes automated decisions about EU users or EU-based workers is within scope. The fact that Uber’s algorithm ran from US infrastructure did not insulate it from the Dutch DPA’s jurisdiction.
What practical steps reduce Article 22 risk in product development?
Four steps matter most: map every automated decision that affects a user’s access, score or status; add a genuine human-review step before decisions with significant consequences; build a real contestability flow (not an automated acknowledgement); and disclose in plain language when automated decisions are being made and what rights the person has. For high-volume platforms, this is an architecture decision, not just a legal one — it belongs in the initial design.
Sources
The Next Web — Uber fined €825 million for automated driver suspensions (August 2026)
Reuters via US News — Exclusive: Dutch regulator fines Uber $966 million for automating driver suspensions (August 2026)
NL Times — Dutch regulator fines Uber €825 million for letting algorithm deactivate drivers’ accounts (August 2026)