Scale AI Accused of Spying on European Freelancers Every Few Seconds
San Francisco data annotation giant Scale AI is facing five GDPR complaints across France, Italy, the Netherlands, and Austria after privacy advocacy group noyb alleged it's running a surveillance operation on the contractors who power its Outlier AI platform.
Outlier is essentially Scale's human-labelling engine. Contractors review AI outputs, annotate data, and perform the kind of grinding task work that keeps large language models from embarrassing their owners. Scale's client list reads like a who's who of the AI industry: OpenAI, Google, Anthropic, xAI, plus various arms of the US federal government.
The complaints centre on how Scale monitors those contractors while they work. According to noyb, Scale doesn't just verify who its workers are. It allegedly tracks their device activity, including activity that has nothing to do with Outlier tasks, and ships that data to third parties including LinkedIn, Facebook, and TikTok at intervals as frequent as every few seconds. Noyb warns this creates conditions ripe for individual profiling and targeted advertising.
"Why should LinkedIn or Facebook know which tasks you're working on?" asked noyb data protection lawyer Lisa Steinfeld Leiser. A fair question, and one Scale will now have to answer to regulators.
Identity verification is handled through a third-party provider called Persona, which has had its own share of awkward headlines. Researchers previously flagged concerns about an exposed test environment linked to Persona's attempts to win US government contracts, speculating the infrastructure could function as a people-tracking system. Persona denied this and said it held no active government contracts. It also had a falling out with Discord over age verification, with Discord publicly stating Persona failed to meet its technical requirements.
For Outlier contractors, Persona allegedly collects biometric data, IP addresses, geolocation, device information, home addresses, and credit data.
The GDPR violations noyb is pursuing fall into fairly familiar territory: no clear legal basis for installing tracking software on workers' personal devices, failure to honour data access requests from complainants, and breach of data minimisation principles, which require companies to collect only what's actually needed for a defined purpose. Monitoring someone's non-work device activity every few seconds doesn't obviously clear that bar.
Thomas Le Bonniec, a sociology researcher at French privacy group DIPLab who co-authored a recent report on Outlier's data practices, put it plainly: "This would be seen as unacceptable in any other form of employment in the European Union."
Scale, for its part, pushed back. "The report's claims are unfounded and inaccurate," a spokesperson told The Register. "Outlier's practices are disclosed to contributors and require their consent. We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment."
Consent, of course, is a complicated concept when the alternative is losing access to work on the platform entirely. Regulators in four countries will now get to weigh that nuance.
noyb is pushing for full investigations and, where warranted, financial penalties. For the EU's growing digital sovereignty crowd, this is exactly the kind of case that reinforces their argument that relying on US tech infrastructure comes with strings attached. Uncomfortable ones.