Credit: Shutterstock
Dutch regulator fines Uber $966 million, second-largest fine ever issued
The Dutch Data Protection Authority, known as the AP, has fined Uber €825 million, about $966 million, for violating European privacy law. The regulator found that Uber deactivated driver accounts through automated systems without giving drivers adequate information or a meaningful chance at human review.
This is the second-largest fine ever issued under the European Union’s General Data Protection Regulation (GDPR). Only one penalty is larger. Earlier, Ireland’s regulator fined Meta €1.2 billion in 2023 for transferring European Facebook users’ data to the United States. Meta is appealing that decision, and Uber says it will appeal this one too.
The Autoriteit Persoonsgegevens (AP) examined how Uber used automated systems to act on driver accounts. Some drivers were temporarily suspended after Uber’s systems flagged suspected fraud. These include drivers who allegedly took unnecessary detours to raise fares or accepted trips they did not intend to complete. Uber says these suspensions were usually short and that no driver was permanently removed without human review in these cases.
The regulator reached a different conclusion for drivers with low customer ratings. According to the AP, some of these drivers were permanently deactivated through fully automated decisions, without a person reviewing the case first.
Under GDPR, decisions based solely on automated processing are not allowed when they carry significant consequences for a person. The law also requires companies to properly inform people about how these decisions are made. The regulator said Uber broke both rules.
The investigation traces back to a complaint filed in 2021 by 171 French Uber drivers. They brought their case to Ligue des droits de l’Homme, a French human rights organization, which passed it to France’s data protection authority. Because Uber’s European headquarters are based in Amsterdam, the case moved to the Dutch AP, which acts as the lead supervisory authority for GDPR matters involving Uber. The specific incidents under review span several years, from 2018 through 2022.
Uber disputes the ruling and considers the fine too large for the number of drivers involved. A company spokesperson said, “We strongly disagree with this decision and disproportionate fine.”
Uber points out that only 126 driver accounts were permanently deactivated across Europe in 2021 because of low customer ratings. The company also said its current policies include human review and an easy way for drivers to dispute a suspension.
Uber has decided it will appeal the decision. The fine is suspended while the appeal is pending, and cases like this in the Netherlands often take a long time to resolve.
This is the fourth time the Dutch regulator has fined Uber. The earlier penalties total about €300.6 million.
- 2018: Uber was fined €600,000.
- 2023: Uber was fined €10 million over how it handled driver data access requests.
- 2024: Uber was fined €290 million for transferring European drivers’ data to the United States without adequate safeguards.
- 2026: Uber was fined €825 million, the new penalty covered in this report.
Combined with the new penalty, Uber’s total fines from the Dutch regulator now exceed €1.1 billion.
This fine adds to a growing pattern of European regulators treating automated account decisions as a serious privacy matter, not just data transfers or breaches. For Uber, the financial impact is real but limited relative to its size. The company reported second-quarter revenue of $14.2 billion this year, growing 12% from the same period last year, along with free cash flow of $2.8 billion for the quarter. Even at nearly $1 billion, this fine amounts to a fraction of that quarterly cash flow.
The appeal process will likely take time to conclude. Until then, the fine stands as one of the clearest examples yet of regulators pushing back against decisions made by algorithms with little or no human involvement.
