Uber's €825 Million Dutch Fine Shows What Counts as a Human in the Loop

A Fully Automated Suspension Now Has a €825 Million Price Tag

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) issued its decision on August 17, and reporting made it public on August 21. The fine is €825 million, roughly $966 million. The AP’s finding is that Uber’s system for suspending and deactivating driver accounts made decisions “based solely on automated processing” in the sense GDPR Article 22 prohibits, and failed to adequately inform drivers when it did. The conduct at issue runs from 2020 to 2022. Only Meta’s €1.2 billion penalty in 2023 is larger under GDPR.

A French Complaint, Handled in the Netherlands

The case started with a complaint filed in France. Because Uber’s EU headquarters sits in the Netherlands, GDPR’s one-stop-shop mechanism routed the investigation to the Dutch AP instead. The regulator’s finding is that drivers with low customer ratings were, in some cases, permanently deactivated by computer with no human review. Uber disputes that framing directly: the company says it has never automated permanent deactivation decisions, and that only 126 drivers across Europe were deactivated for low ratings in 2021. Uber called the fine “disproportionate,” said it will appeal, and pointed to current policies that combine human review with a dispute process. The argument over scale is itself telling: the dispute isn’t really about how many drivers were affected, it’s about whether a person stood behind the decision for any of them.

California Already Drew the Same Line

This isn’t only a European story. California’s Privacy Protection Agency (CPPA) finalized rules on automated decision-making technology (ADMT) that took effect January 1, 2026, with employer compliance required by January 1, 2027. The regulation’s definition of a “significant decision” explicitly includes suspension and termination, the same category the Dutch AP is fining Uber over. A platform running matching, scoring or penalty algorithms against drivers, sellers or contractors in California is already inside a regime built around the identical question GDPR Article 22 asks: was a human actually in the loop, and can you show it.

What to Check on Your Own Suspension Logic Now

If your product uses an algorithm to score, match or penalize partners (drivers, sellers, freelancers, anyone outside your W-2 headcount), three things are worth auditing before a regulator asks. First, find every code path where a suspension or termination-equivalent action fires without a human review step, not just the ones your team remembers. Second, check that a real appeal path exists and that its outcomes are logged, since the AP’s complaint centered on the right to be informed, not the decision itself. Third, make sure the logic that drives those decisions can be explained after the fact, to a regulator or a court, not just to your own engineers. The California rule already ties that log to a compliance deadline. What should worry founders more than the fine amount is the timing: regulation arriving late still gets applied retroactively to the years before it existed.