Uber Hit With EUR 825 Million GDPR Fine Over Automated Driver-Account Suspensions

AMSTERDAM. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) fined Uber EUR 825 million (about USD 1 billion) on August 21, 2026, ruling that the company let software deactivate driver accounts with no human review, a breach of the European Union’s General Data Protection Regulation (GDPR). SecurityWeek, carrying an Associated Press report, put the penalty at 825 million euros (about 964 million dollars) and dated its coverage to August 24.

It is the second-largest GDPR penalty on record, behind only the EUR 1.2 billion the Irish regulator imposed on Meta in 2023. The AP said the conduct ran from 2018 to 2022 and rested on one specific failure: Uber’s systems decided, on their own, when a driver stopped earning. Uber says it disagrees and will appeal.

What the AP Actually Found

The decision turns on Article 22 of the GDPR, which bars decisions “based solely on automated processing” when they carry legal or similarly significant effects for a person, unless a narrow exemption and safeguards apply. Cutting off someone’s income clears that significance bar without much argument.

Per the AP’s public statement, Uber’s software tracked driving behavior and rider ratings and, when it flagged suspected fraud or a rating it judged too low, deactivated the driver’s account automatically. A flag brought a temporary suspension. Persistently low ratings brought permanent removal. In neither case did a person assess the outcome before the money stopped.

“A computer should not make decisions on its own that have major consequences for you,” said Monique Verdier, deputy chair of the AP, in the authority’s statement. “These decisions should have been looked at first by a human being.” The AP added a second finding: Uber did not adequately inform drivers that automated decision-making was running, or explain how it worked. The regulator framed this as a transparency failure but, in the public summary, did not pin it to a specific article number beyond the Article 22 core.

How the Fine Compares

EUR 825 million (about USD 1 billion) is a large number even by GDPR standards. For context, national regulators across the European Economic Area issued a combined EUR 1.15 billion in GDPR fines across all of 2025, per the European Data Protection Board’s annual report, as PPC Land noted. This single decision is roughly three-quarters of that yearly total.

It is also the fourth time the AP has fined Uber, whose European headquarters sit in the Netherlands, which makes the Dutch regulator the lead supervisory authority under the GDPR one-stop-shop mechanism. The earlier penalties were EUR 600,000 in 2018, EUR 10 million in 2023, and EUR 290 million in 2024, the last of those for transferring driver data to the United States without adequate protection. The case that produced the newest fine began in France, where 171 drivers complained to a human-rights group that took it to the French regulator. The AP then investigated as lead authority and aligned its decision with other European supervisors.

One number the AP did not publish: how many drivers were actually deactivated. The 171 French complainants seeded the case, but the regulator has not released a count of affected drivers across the Netherlands or Europe, and it did not split the penalty between the automated-decision finding and the transparency finding. Treat any specific “drivers affected” figure as unconfirmed.

Will the Fine Stick?

Uber says no, or at least not at this size. “We take decisions that affect drivers’ ability to earn extremely seriously and we’re fully committed to fair treatment. This includes human reviews, robust safeguards, and the opportunity for drivers to appeal our decisions if they believe we made a mistake,” the company said in a written statement to SecurityWeek, adding that the AP had examined “historic policies that were discontinued years ago.” Uber has filed an appeal.

That matters for how much weight to give the headline number today. Announced GDPR fines and collected GDPR fines are not the same thing: a large share of the regime’s biggest penalties have been reduced, annulled, or tied up in court for years. Uber is already contesting the 2023 and 2024 Dutch fines. Whether this one survives appeal intact, is cut, or is sent back to the regulator is genuinely unsettled, so read EUR 825 million (about USD 1 billion) as the opening figure, not the final one.

What Platform and Gig-Economy Operators Should Do Now

Strip away the ride-hailing specifics and this is a governance problem that reaches any operator whose software attaches consequences to people. Account suspensions, eligibility screening, payout holds, bid throttling, and dynamic pricing can all count as automated decisions under Article 22 when the outcome materially affects someone, whether or not anyone calls the system “AI.” The line the AP is drawing sits at consequence, not at technology.

Concretely, for security, privacy, and platform-engineering teams:

• Inventory the automated decisions. Map every workflow where software alone can suspend, restrict, or financially penalize a user or worker. If you cannot name them, you cannot defend them.
• Insert meaningful human review before the consequence lands. A reviewer needs real authority and the time to overturn the machine, not a queue they rubber-stamp under volume pressure.
• Build a real appeal path. The affected person should be able to contest the outcome and reach a human who can reverse it, and that channel has to work in practice, not just on paper.
• Document the processing. Record what data feeds each decision, the logic it applies, and the notice you give people. The transparency half of this case is a documentation failure as much as anything.

For teams new to the underlying rules, our explainer on data-protection obligations and breach response covers the GDPR baseline, and our reporting on web trackers quietly shipping sensitive data to third parties shows how fast a routine data-handling assumption can turn into a regulatory problem.

My read: The dollar figure will get the headlines, but the durable signal here is narrower and more useful. Regulators are treating “a human could theoretically have looked” as insufficient. They want a human who actually did, before the consequence attached. That is a design requirement, not a policy PDF, and it is the part most automated enforcement pipelines quietly skip. Even if Uber’s EUR 825 million (about USD 1 billion) is trimmed on appeal, I would not bet on the underlying principle softening. Build the human checkpoint in now, while it is a code review and not a regulator’s finding.

Primary Documents

• Autoriteit Persoonsgegevens, “Uber fined nearly 825 million euros for automated driver blocking” (August 21, 2026)
• SecurityWeek / Associated Press, “Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts” (August 24, 2026)
• GDPR Article 22, “Automated individual decision-making, including profiling”