The freelance workers who label data and write examples for AI models are usually invisible to the people using chatbots. A new set of privacy complaints in Europe is putting them, and the way they are watched while they work, in the spotlight.
Vienna-based privacy group noyb filed five complaints on 27 October against Scale AI, the San Francisco data-labelling company, over its Outlier platform. Outlier hires freelancers around the world to produce training data for AI systems, and reportedly has more than 900,000 contributors. The complaints were lodged with data protection authorities in France, Italy, the Netherlands and Austria on behalf of five workers, with support from the research programme DiPLab and two other groups.
What the complaints allege
The filings argue that Outlier collects far more information about its workers than the job requires, in breach of the EU’s General Data Protection Regulation (GDPR). According to the complaints, the platform carries advertising and analytics trackers from several social media companies that send workers’ IP addresses, identifiers and browsing activity to third parties. They also say a session-recording tool captures mouse movements, clicks and keystrokes, giving managers a near real-time view of what contributors are doing.
Identity checks are another focus. Workers say they were repeatedly asked to verify themselves through biometric face checks, sometimes each time they worked from a different country, which the complaints argue goes beyond what fraud prevention needs. Several workers also say their requests to see the personal data Scale AI held on them, including how automated systems assign tasks, went unanswered.
noyb is asking regulators to declare that the law was broken, order Scale AI to answer the workers’ requests, investigate its use of automated decision-making and impose fines. Under the GDPR, penalties can reach €20 million or 4% of a company’s worldwide annual turnover, whichever is higher. None of the allegations has been tested by a regulator yet.
Scale AI has rejected the accusations, calling them “unfounded and inaccurate”. The company said its practices are disclosed to contributors and require their consent, that it uses standard tools to verify identities, prevent fraud and make sure people are paid correctly, and that a separate screen-activity tracker is used only on certain projects where workers switch it on themselves. It added that it does not sell workers’ personal data or use it to train customers’ AI models.
The case also touches Meta, which bought a 49% stake in Scale AI in 2025 in a multibillion-dollar deal. The researchers behind the complaints argue that this ownership link makes the presence of social media trackers on a work platform more troubling.
What it means here
Bangladesh has one of the world’s largest online freelance workforces, and AI data work is a growing part of it. Many Bangladeshi freelancers already take on labelling, transcription and evaluation tasks for global platforms, often under the same kind of monitoring described in these complaints.
The European route is not open to them: the GDPR protects people in the EU, and workers elsewhere have far fewer ways to challenge how a foreign platform handles their data. That makes the outcome of these cases worth watching. If regulators decide that keystroke logging, third-party trackers or repeated biometric checks go too far, platforms may change their practices globally rather than run separate systems for Europe.
In the meantime, freelancers can protect themselves by reading what a platform says it collects before signing up, using a separate browser profile for work, keeping their own records of tasks and payments, and asking in writing for a copy of their data when something looks wrong. As AI companies rely more on human trainers, how those workers are treated is becoming a policy question, not just a contract detail.
