The Dutch Data Protection Authority handed Uber a €825 million fine on August 17, 2026, roughly $966 million at current exchange rates, for violating GDPR rules around automated decision-making. The ruling makes this the second-largest penalty ever issued under the regulation, sitting behind only the €1.2 billion fine levied against Meta in 2023.
The core problem, in the regulator’s view, is straightforward: Uber’s algorithms were suspending and deactivating driver accounts, often on suspicion of fraud, without giving drivers adequate notice or a real path to challenge the decision. GDPR specifically requires that automated systems with significant consequences for individuals include a meaningful human review component. Uber’s did not.
What Uber’s system actually did
The complaints that triggered this investigation originated with French drivers, and the incidents in question span 2020 to 2022. Uber’s automated systems were flagging accounts and locking drivers out of their livelihoods, sometimes permanently, based on algorithmic assessments they couldn’t see, dispute, or appeal through any substantive process.
Uber pushed back on the scale of impact. The company said 126 drivers in Europe were affected in 2021 specifically due to low ratings, framing that figure as evidence the problem was contained. Regulators clearly disagreed with that framing, given the nine-figure penalty.
Uber has said it intends to appeal, calling the fine disproportionate and contesting elements of the ruling related to permanent deactivations.
This is not Uber’s first GDPR rodeo
The €825 million figure lands on top of an already substantial tab with the Dutch authority. The AP fined Uber €290 million in 2024 over separate data protection failures, followed by an additional €10 million fine the same year. A €600,000 fine came even earlier, in 2018, shortly after GDPR took effect.
Add it up and Uber’s running total with the AP alone exceeds €1.1 billion, across multiple enforcement actions spanning nearly a decade of the regulation’s existence.
The regulation allows fines up to 4% of a company’s global annual revenue for the most serious breaches.
Why automated deactivation is a regulatory pressure point
GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce significant effects on them. Losing access to your primary income source qualifies as significant.
Uber’s European headquarters is located in Amsterdam, which designates the Dutch Data Protection Authority as the leading supervisory body for GDPR compliance across the EU. The broader regulatory environment in Europe is also moving in the same direction as this enforcement action. The EU’s Platform Work Directive, which has been working through the legislative process, aims to establish clearer rights for gig workers around algorithmic management, including transparency requirements and the right to human review of automated decisions.