Before an artificial intelligence system provides an answer, people may have assessed texts, compared results or corrected errors to improve the system. On Outlier, a Scale AI platform, this human work is now the subject of another debate: what information does the platform collect about the people doing it?
On 27 October 2026, the association noyb announced five complaints in four European countries, alongside several partners, including DiPLab. They concern digital tracking, biometric checks and access to personal data. Scale AI disputes the allegations. It is therefore important to distinguish between the practices described, the company’s justifications and the decision the authorities may make: a complaint is not a conviction.
Three questions behind the word ‘surveillance’
In its statement, updated on 29 October, noyb says it has filed complaints with the authorities in France, Italy, the Netherlands and Austria. The association says it identified trackers from several third-party companies on Outlier, transmitting identifiers and browsing information, among other things.
It also criticises repeated checks of users’ faces and identity documents. Finally, it accuses the company of failing to respond to requests for access. These three complaints are distinct: knowing that an account exists, monitoring its activity and allowing its holder to view the information held about them raise different questions.
The statement sets out the complainants’ position. Its characterisation of the practices as unlawful should be read as their argument, not as a finding already made by a regulator. It specifically calls for an investigation and envisages penalties.
What Outlier says in its own policy
Outlier’s privacy policy, dated 13 March 2026, offers another starting point. It provides for checks at registration and then at regular intervals, using providers such as Persona. It mentions images, recordings and facial measurements, as well as, in certain circumstances, an alternative verification method.
The document explains these checks as measures to prevent fraud and protect the service. It also mentions cookies, pixels and information collected automatically. It says verification data may be retained for up to two years after the last interaction, or in line with legal requirements.
This policy documents what the company says it does. On its own, it does not demonstrate how each tool operated on each complainant’s computer. Conversely, the inclusion of a type of data in the document is not enough to establish that every person was subject to every possible form of processing. Comparing the stated rules with actual practices will make it possible to examine the dispute.
Scale AI’s response
Questioned by franceinfo on 28 October, Scale AI rejected the allegations. The company said some projects use software to track time and on-screen activity. It says contributors are informed about it, consent to it and activate the tool themselves.
It cites efforts to combat fraud, protect the confidentiality of its clients’ information and calculate pay. It says it complies with the GDPR. These explanations address the complaints but do not resolve them: they represent the position of the company in question.
Franceinfo also reports on DiPLab’s work and workers’ concerns about the extent of the tracking. It would be misleading to treat the existence of these concerns as proof that every session is recorded in the same way.
Why the details of the systems matter
To understand this case, the label ‘monitoring tool’ is too broad. A timer, a screenshot and an identity check do not provide the same information. Readers need to be able to know which system is at issue, when it is used, what it records and who the data is intended for.
A hypothetical example illustrates the difference: recording how long a task takes does not necessarily reveal what is displayed on screen. Recording the screen could reveal much more, depending on what appears there. This example explains what is at stake; it does not describe a session observed on any of the complainants’ devices.
Another essential distinction is between information provided in a general policy and an explanation presented when software is activated: these are two separate elements to examine. The debate cannot be reduced to the mere existence of a privacy page.
What the case will — and will not — tell us about AI
The case concerns the working conditions and data processing of contributors to a platform. It measures neither the quality of their annotations nor a model’s performance. Confusing these issues would make the concrete problem disappear behind a general debate about artificial intelligence.
The documents reviewed set out complaints and responses, not a final decision. The next thing to follow, then, is the work of the competent authorities: what they are able to establish about the tools, their use and the access requests. Behind the models, the issue remains very human: understanding what a worker hands over while carrying out a task.
Illustrative photograph: hands on a laptop; no person connected to Outlier or any monitoring system is identified. Solé Gomez / Pexels, Pexels licence.
