For the freelancers helping train AI systems, access to paid work can come with identity checks and screen monitoring. Five European privacy complaints against Scale AI’s Outlier platform challenge how much information the company collects about those workers, and whether it has lawful grounds to collect it.
On October 27, 2026, privacy group noyb filed five GDPR complaints in France, Italy, the Netherlands, and Austria. Scale AI rejected the allegations on October 28, saying its practices are disclosed and contributors agree to them. Regulators have not established wrongdoing.
However, the dispute raises a practical question for anyone earning money through an AI training platform: how much information does a company need to verify freelance work, and how much choice remains when refusing a check can mean losing access to paid tasks?
What the complaints say Outlier collects
Outlier contributors write prompts, evaluate model responses, and perform other tasks used to develop AI systems. Noyb says the platform has more than 900,000 freelance contributors. That figure describes the platform’s reported scale. It does not establish how many workers were allegedly monitored or represented in the five complaints.
The complaints raise three separate concerns. First, noyb alleges that third-party trackers associated with services including TikTok, LinkedIn, Facebook, Sprig, and Datadog send information such as IP addresses, identifiers, and page details while contributors use Outlier.
Researchers identified as many as 19 trackers and described activity records that could be reconstructed into a replay of a work session, Reuters reported. Those are researchers’ findings and allegations, rather than an independently established account of every contributor’s experience.
Second, workers allegedly face repeated identity verification through Persona, including government-ID images and facial video. Third, noyb says four contributors sought access to their personal data and received no answer. Scale disputes the complaints as a whole.
These allegations concern different methods of collecting data. Advertising and analytics trackers operate differently from an application deliberately recording a work screen. A facial identity check raises further questions about biometric information. Treating all three as a single monitoring system would obscure what each collects and which legal justification applies.
What Outlier’s published policies acknowledge
Outlier’s March 2026 privacy policy states that Scale may collect identification documents, selfies, facial measurements, activity records, device identifiers, and information obtained through cookies and pixel tags. It names Persona as an identity-verification provider and says verification data can be retained for up to two years after a contributor’s last interaction, subject to legal requirements. The policy also describes sharing personal information with social-media and advertising networks for marketing purposes.
A separate screen-monitoring notice dated August 19, 2026 says monitored projects can take screen images approximately once per minute and, in some circumstances, record video. Captures can include other tabs, notifications, personal content, or information about third parties. Scale says ordinary screen captures are deleted after seven days unless selected for an investigation, while screen video can be retained for 90 days, subject to stated exceptions.
Scale says this monitoring tool cannot capture webcam footage, microphone audio, or keystrokes outside what is visible on the screen. The notice also says automated detections can lead to account suspension or withheld payment, potentially on a single capture in severe cases.
The screen-monitoring notice governs that particular tool. Its stated limits do not establish what the disputed third-party web trackers collect, or whether those trackers operate under the same restrictions. Likewise, the tool’s exclusion of webcam footage does not describe Persona’s separate facial verification process.
In its response reported by Reuters, Scale said verification and monitoring protect against fraud, preserve client confidentiality, and ensure accurate payments. It said contributors manually activate the screen-recording tool on applicable projects. Scale also said it neither sells contributors’ personal data nor uses that information to train customers’ AI models.
Can consent be meaningful when payment depends on it?
Scale’s own documentation complicates the consent argument. Although its public response emphasizes workers agreeing to its practices, the screen-monitoring notice explicitly says Scale does not rely on GDPR consent for screen monitoring. Instead, it invokes legitimate interests under Article 6(1)(f). The browser’s screen-sharing prompt provides technical permission to capture the selected screen or window. Scale does not treat that prompt as legal consent to process the data.
The same notice says contributors can refuse monitoring, but then cannot start or continue paid sessions on projects that require it. Scale says refusing does not remove them from Outlier or prevent work on unmonitored projects. A contributor can therefore decline the monitoring while losing access to the paid session that requires it.
The European Commission’s GDPR guidance says consent must be freely given, while legitimate interests require weighing business needs against individuals’ rights. Fraud prevention may justify some checks. It does not automatically justify every tracker, repeated face scan, or data transfer. Biometric processing used for unique identification can face additional requirements under GDPR Article 9.
Telling workers about surveillance does not, by itself, establish that the collection is necessary or lawful. Regulators will have to assess the specific processing operations and the legal grounds claimed for each, rather than accept or reject every form of tracking together.
What Outlier workers can do now
For contributors on monitored projects, the immediate privacy step is to separate work from personal activity. Close personal tabs and notifications before sharing a window or screen. Doing so reduces incidental exposure, but it cannot resolve the legality of background trackers or identity checks. The precautions address what can appear in a screen capture.
European contributors can request access to the data Outlier holds about them, including verification information, monitoring records, recipients, retention periods, and information about automated decisions. Outlier lists privacy@scale.com for monitoring requests and privacy@outlier.ai in its general privacy policy.
Workers can also object to processing based on legitimate interests and complain to their national data-protection authority. Access requests should ordinarily receive a response within one month, according to EU guidance. None of these rights guarantees an immediate outcome in a disputed case.
Scale AI’s privacy case turns on necessity
A platform can have legitimate reasons to prevent fraud and protect sensitive client material while still collecting more worker information than necessary. The five complaints ask regulators to decide where that line falls for Outlier’s tracking and identity checks.
Until those questions are resolved, neither Scale’s denial nor noyb’s allegations amount to a verdict. For workers, the immediate steps are concrete: reduce what can appear in screen captures, request the records held about them, and use the available objection and complaint channels to challenge disputed processing.
Explore more from Popular AI:
Start here | Local AI | Builds & gear | Autonomy & policy | Fixes & guides | Popular AI podcast