The Dutch data protection supervisory authority Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) has imposed an administrative fine of EUR 824,990,000 on Uber. According to the AP decision, Uber is alleged to have violated provisions of the Datenschutz-Grundverordnung (DSGVO, General Data Protection Regulation, GDPR) on fully automated decisions including profiling, as well as information obligations.
According to the available information, the notice is dated 17 August 2026 and was made public on 21 August 2026. Uber has filed, or announced that it will file, an appeal against the fine; according to the published status, no final court decision has yet been issued. The authority’s findings must therefore be viewed in the context of the ongoing proceedings and the legal position, which has not yet been finally clarified.
Subject Matter of the Dutch Data Protection Authority’s Decision
Fine for Automated Decisions and Information on Profiling
According to the summary of the decision, the AP bases the sanction on Art. 22 DSGVO (Article 22 GDPR) and Art. 13 DSGVO (Article 13 GDPR). Art. 22 DSGVO concerns automated individual decision-making, including profiling. Art. 13 DSGVO governs information that must be provided to data subjects when personal data is collected.
The AP reached the assessment that Uber had made fully automated decisions about drivers. According to the authority’s findings, driver accounts were automatically temporarily deactivated in cases of suspected fraud or where customer ratings were too low. According to the AP’s account, accounts are said to have been permanently deactivated where customer ratings remained low.
During a deactivation, according to the authority’s account, the affected drivers were unable to generate income via Uber. The AP also found that Uber had not sufficiently informed drivers about the automated decision-making. According to information from the decision, the challenged infringements have since ceased.
Addressees of the Sanction
According to the additionally published information, the sanction is directed against two group companies: the Dutch Uber B.V., based in Amsterdam, and the U.S. company Uber Technologies Inc., based in San Francisco. The jurisdiction of the Dutch AP as lead supervisory authority is justified on the basis that Uber’s European headquarters are located in Amsterdam.
The fine amounts to EUR 824,990,000. According to published assessments, this corresponds to approximately 1.85 percent of Uber’s worldwide revenue in 2025 of EUR 44.5 billion. At the same time, the sanction is classified as the second-highest GDPR fine after the EUR 1.2 billion fine imposed on Meta in 2023.
Starting Point of the Proceedings
Complaints by French Drivers
The proceedings were triggered by complaints from 171 French Uber drivers. These were submitted through the Ligue des droits de l’Homme (LDH) to the French data protection supervisory authority Commission Nationale de l’Informatique et des Libertés (CNIL).
According to the available information, the LDH filed a collective complaint on behalf of more than 170 drivers in 2020 and supplemented it in 2021. The complaints concerned, among other things, automated decisions, information provided to data subjects, and data transfers outside the European Union. Due to Uber’s European main establishment being in the Netherlands, the CNIL forwarded the complaints to the AP.
One-Stop-Shop Procedure Under the GDPR
The procedure was conducted under the GDPR’s so-called one-stop-shop mechanism. In the case of cross-border data processing, the supervisory authority at the place of the main establishment within the European Union is generally competent as lead authority.
According to the available information, the Dutch AP decided in cooperation with the French CNIL. The facts underlying the decision concern incidents in the years 2018 to 2022.
AP Findings on the Deactivation of Driver Accounts
Temporary and Permanent Suspensions According to the Authority’s Account
According to the AP, Uber is said to have automatically deactivated driver accounts under certain conditions. In particular, indications of fraud and customer ratings deemed too low are mentioned.
According to published information, the reasons for suspension taken into account automatically are also said to have included algorithmically detected unnecessary detours and accepted but not completed rides. According to the AP’s account, corresponding system assessments led, at least in part, to deactivations. Where customer ratings remained low, drivers were, in the authority’s view, in some cases permanently deactivated by the system.
Differing Accounts by the Authority and the Company
According to published statements, Uber considers the decision and the amount of the fine to be disproportionate. The company also states that human beings are now involved in corresponding decisions.
According to the available information, Uber disputes that permanent deactivations occurred in a fully automated manner. The company also states that suspensions were usually only brief. The AP counters this by stating that, according to its findings, drivers with low ratings were in some cases permanently deactivated by the system.
Legal Framework Under Art. 22 and Art. 13 DSGVO
Automated Individual Decision-Making
Art. 22 DSGVO contains rules on decisions that are based solely on automated processing and produce legal effects concerning a data subject or similarly significantly affect them. Profiling may form part of such processing where personal data is used to evaluate personal aspects relating to a natural person.
The AP regards the identified deactivations as unlawful fully automated decision-making. The authority bases this in particular on the significant consequences for the affected drivers, who were unable to generate income via the platform during a deactivation.
Information Obligations Towards Data Subjects
Art. 13 DSGVO obliges controllers to inform data subjects of certain circumstances of data processing when personal data is collected. In the case of automated decision-making processes, this may also include information about the logic involved, as well as the significance and intended consequences, insofar as the requirements of the GDPR are met.
According to the AP’s decision, Uber did not adequately inform drivers about the automated decision-making. Alongside the alleged unlawful automated decision-making, this allegation forms an independent component of the authority’s reasoning.
Classification of the Fine and Previous Proceedings
Amount of the Sanction
The fine of EUR 824,990,000 is among the highest sanctions known to date under the GDPR. According to published information, it is the second-highest GDPR fine after the EUR 1.2 billion fine imposed on Meta in 2023.
AP Vice-Chair Monique Verdier explained the decision, in essence, by stating that a computer must not make decisions with far-reaching consequences for data subjects on its own. This statement relates to the authority’s assessment of the automated deactivations in the specific proceedings.
Further AP Sanctions Against Uber
According to the available information, the current fine is the fourth sanction imposed by the AP against Uber. Previously mentioned sanctions were EUR 600,000 in 2018, EUR 10 million in 2023, and EUR 290 million in 2024.
- 2018: Fine of EUR 600,000
- 2023: Fine of EUR 10 million
- 2024: Fine of EUR 290 million
- 2026: Fine of EUR 824,990,000
In the proceedings concerning the EUR 10 million fine, the AP rejected Uber’s objection as unfounded on 8 May 2026. According to the available information, Uber is taking the matter to court in that respect. This illustrates the possible further course of proceedings in the new case as well, without prejudging the outcome of the current proceedings.
Reactions to the Decision
Statements by Uber and Interest Groups
According to published reports, Uber has announced an objection or appeal against the new notice. The company challenges both the decision and the amount of the fine.
The Ligue des droits de l’Homme welcomed the decision on 1 September 2026 as a success for the drivers. According to its own statements, it classified the decision as Uber’s third conviction for violations of the GDPR. This assessment comes from the LDH and does not replace the still pending final judicial clarification in the current proceedings.
Role of Supporting Organisations
According to the available information, the organisation PersonalData.io supported the drivers in compiling data on how the deactivation decisions came about. Its founder Paul-Olivier Dehaye criticised that a single poor rating could negate thousands of satisfactory rides.
This assessment concerns criticism of how rating-based systems function. For the legal assessment of the specific facts, the findings of the competent supervisory authority and the further course of the proceedings remain decisive.
Significance for Data-Driven Business Models
Automation, Profiling and Transparency
The decision shows that supervisory authorities scrutinise automated decision-making processes with significant effects on the earning opportunities of data subjects particularly closely. This applies in particular where algorithmic assessments, customer feedback, or behavioural data are used for suspensions, deactivations, or comparable measures.
What matters here is not only the question of whether a decision is made solely by automated means. Equally essential is what information data subjects receive about the data processing, the decision-making logic, and the possible consequences.
Status of Proceedings and No Final Legal Force
Because Uber is challenging the fine, according to the published status the decision has not been finally confirmed by a court. The authority’s findings should therefore be understood as the basis of the AP’s penalty notice.
A final assessment of individual points of dispute, in particular regarding the scope of the automation and the proportionality of the sanction, remains reserved for the further proceedings. Until a final clarification, the positions of the authority and the company must be distinguished from one another.
Frequently Asked Questions
Why did the Dutch AP impose EUR 824,990,000 on Uber for automated driver deactivations?
The AP accuses Uber of having fully automatically and temporarily deactivated driver accounts in cases of suspected fraud or low customer ratings, and in some cases permanently deactivated them where ratings remained low. In addition, the drivers are said not to have been sufficiently informed about the automated decision-making.
What role do Art. 22 DSGVO and Art. 13 DSGVO play in the AP’s Uber fine proceedings?
Art. 22 DSGVO concerns automated individual decision-making, including profiling, while Art. 13 DSGVO governs information obligations when personal data is collected. The AP bases the fine on violations of both regulatory areas.
What practical consequences can automated suspension decisions have for companies and data subjects following the Uber proceedings?
The proceedings make clear that automated decisions with significant consequences, for example for earning opportunities, are particularly sensitive under data protection law. For data subjects, such measures can directly impair access to income or services.
Data Protection Law Assessment by MTR Legal Rechtsanwälte
Automated decision-making processes, profiling, and transparent information for data subjects are among the demanding areas of data protection law. Companies, investors, and high-net-worth individuals who have legal questions in this regard can find internationally oriented advice on data protection law at MTR Legal. Further information is available under legal advice on data protection law.
