Dutch Regulator Fines Uber 825M Euros for Automated Deactivations
August 24, 2026
The Dutch data protection authority has issued an Uber GDPR fine of 824,990,000 euros, or roughly $966 million, over how the company shut off driver accounts.
The regulator found that software alone decided those deactivations, with no person reviewing the outcome.
Reports describe it as the second-largest penalty issued under the European Union’s General Data Protection Regulation (GDPR), behind the 1.2 billion euro fine Ireland imposed on Meta in 2023.
The Finding Was About Missing Human Review, Not Automation Itself
The Autoriteit Persoonsgegevens (AP) announced the fine on August 21, 2026.
According to the AP, Uber used software to track driver behavior and customer ratings. When the system flagged suspected fraud or ratings it judged too low, it temporarily deactivated the account automatically. Persistently low ratings led to permanent deactivation, and no employee assessed those cases.
The AP found this practice ran from 2018 to 2022, and that drivers lost their Uber income while deactivated. The regulator concluded Uber breached the GDPR ban on fully automated decision-making and also failed to inform drivers adequately about it. Deputy chair Monique Verdier said Uber “committed serious infringements.” The AP notes the company has since stopped the conduct.
European regulators calculate fines the same way, capped at 20 million euros or 4% of worldwide annual turnover, whichever is higher, and the AP put Uber’s 2025 global turnover at about 44.5 billion euros. This is the fourth AP fine against Uber, after penalties of 600,000 euros in 2018, 10 million euros in 2023, and 290 million euros in 2024.
The Three Grounds That Make a Fully Automated Decision Lawful
The AP also publishes guidance for companies on automated decision-making.
It lists three grounds on which a company may make a fully automated decision carrying legal or similarly serious consequences: the decision is necessary to enter into or perform a contract with the person, the person has given explicit consent, or a law permits it.
Safeguards are required even when an exception applies. In the contract and explicit-consent cases, the GDPR requires at least the right to obtain human intervention, express a point of view, and contest the decision. Where EU or member-state law authorizes the automated decision, that law must itself provide suitable safeguards.
Companies must also explain transparently how automated decisions are made, show full GDPR compliance, and regularly test the systems to confirm they work as intended.
The question is not simply whether a company may automate. It is whether a consequential decision is fully automated, whether one of the GDPR’s exceptions applies, and what safeguards are available.
How 171 French Drivers Turned Into a Dutch Penalty
The AP says the investigation began when 171 French drivers approached Ligue des droits de l’Homme (LDH), a French human rights organization. LDH filed a complaint with CNIL, the French regulator, on the drivers’ behalf. Because Uber’s European headquarters sit in the Netherlands, the AP took the case forward under the GDPR’s one-stop-shop mechanism, working with CNIL throughout.
For cross-border processing, a company’s main EU establishment generally determines its lead supervisory authority.
Uber has appealed. According to Reuters, a spokesperson said the company strongly disagrees with the decision and the disproportionate fine, and that its policies include human review and a route to dispute outcomes. Reuters also reported Uber’s figure that 126 accounts were permanently deactivated across Europe in 2021 because of low ratings. On permanent deactivations in particular, Uber says it never made them without human review, which conflicts with the AP’s finding.
Uber keeps widening its footprint, including a partnership with Zipline for drone delivery on Uber Eats. More lines of business across more countries mean more regulators to answer to.
What to Watch Next
The fine is not final. Uber has appealed, and reports indicate the process will take time.
Proceedings over the AP’s 2023 and 2024 fines are also still running. The question in this appeal is how far the AP’s findings on fully automated decision-making, and its application of the GDPR ban, will hold up.
Sources
Autoriteit Persoonsgegevens – Uber fined nearly 825 million euros for automated driver blocking
Autoriteit Persoonsgegevens – Automated decision
Reuters via Euronext – Dutch regulator fines Uber $966 million for automating driver suspensions
TechCrunch – Uber faces fine of nearly $1B over automated driver suspensions
