The Dutch Data Protection Authority has fined Uber €825 million ($966 million) for allegedly using automated systems to deactivate drivers without providing adequate information or meaningful human review, in what would be the second-largest penalty imposed under Europe’s General Data Protection Regulation.
The regulator’s decision, dated Aug. 17 and reviewed by Reuters, concerns Uber’s handling of driver accounts between 2018 and 2022. The Dutch authority confirmed the decision on Friday.
The penalty ranks behind only the €1.2 billion fine imposed on Meta by Ireland in 2023 for unlawfully transferring the personal data of European Facebook users to the United States. Meta has appealed that decision.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
Uber said it would also appeal the Dutch ruling, arguing that the penalty was disproportionate.
“We strongly disagree with this decision and disproportionate fine,” a company spokesperson said, adding that Uber takes drivers’ rights seriously and that its policies include human reviews and opportunities for drivers to challenge suspensions.
The Dutch regulator said Uber had committed “serious infringements” by deactivating driver accounts without adequate warning or human involvement.
“From one moment to the next they no longer had any income … A computer should not make decisions on its own that have (such) major consequences,” said Monique Verdier, deputy chair of the Dutch Data Protection Authority.
Under the GDPR, companies generally cannot rely solely on automated decision-making when those decisions have significant effects on individuals. People must have access to meaningful human intervention and a way to contest decisions.
The Uber case originated with a complaint filed in France and was ultimately handled by the Dutch regulator because Uber’s European headquarters are located in the Netherlands.
The investigation examined several types of automated actions against drivers suspected of violating Uber’s rules. These included temporary suspensions after Uber’s systems detected potential fraud, such as drivers allegedly taking unnecessary detours to increase fares or accepting trips without intending to complete them.
Uber said such suspensions were generally temporary and that it did not permanently deactivate drivers solely through automated systems.
The Dutch regulator reached a different conclusion in relation to some drivers with low customer ratings, saying they could be permanently deactivated through automated processes.
Uber disputed that finding and said it had never automated permanent deactivation decisions. The company also argued that the size of the penalty was disproportionate because relatively few drivers were affected. Uber said 126 drivers in Europe were deactivated because of low customer ratings in 2021.
The Dutch authority said the fine was calculated as a fraction of Uber’s 2025 annual turnover, underscoring the potentially significant financial consequences of GDPR enforcement for multinational technology companies.
The ruling adds to a growing list of major penalties imposed on U.S. technology companies by European regulators under privacy, competition and digital-market rules. Meta, Google, Apple and Amazon have all faced substantial European regulatory actions in recent years. While some headline fines have been reduced or overturned through lengthy appeals, the scale of the penalties has become a major source of tension between U.S. technology companies and European authorities.
U.S. President Donald Trump has repeatedly criticized European penalties against American technology companies. In April, a U.S. State Department official described such fines as the “biggest single source of friction” in U.S.-EU economic relations.
The Uber case also shows how privacy regulation is expanding beyond traditional concerns about the collection and transfer of personal data. Regulators are increasingly examining how companies use algorithms to make consequential decisions about workers and consumers.
For gig-economy companies such as Uber, this creates a particular compliance challenge. Automated systems are central to detecting suspected fraud, assessing performance and managing large numbers of drivers, but regulators are requiring companies to maintain safeguards when those systems can determine whether an individual is able to continue working.
The dispute was brought to regulators’ attention with assistance from Swiss digital-rights group PersonalData.io, which helped French Uber drivers obtain information about algorithmic decisions affecting their work. Paul-Olivier Dehaye, founder of PersonalData.io, said the group welcomed the decision and was preparing a class-action lawsuit seeking compensation for affected drivers.
The Dutch ruling could therefore have consequences beyond the €825 million fine. If Uber loses its appeal and drivers pursue compensation separately, the company could face additional legal exposure while also having to reassess how automated systems are used to suspend or deactivate drivers across Europe.