EU privacy advocates accuse US data annotation firm of snooping on contractors

Privacy campaigners have leveled accusations against the US data annotation firm Scale AI, alleging it spies on its contractors.

Noyb has submitted five complaints across four EU member states regarding the alleged surveillance of workers utilizing Scale AI's Outlier platform.

Outlier contractors perform tasks like labeling data and evaluating AI-generated responses to refine AI models, much like workers on Amazon's Mechanical Turk platform previously. Scale AI services major clients such as Google, OpenAI, Anthropic, and xAI, alongside the US government.

These allegations mirror concerns Noyb has raised against other US tech entities since the GDPR became effective in 2018, specifically pointing to potential breaches of the regulation. Because the work is conducted remotely and digitally, Scale employs extensive data collection methods to verify worker identities and track activity.

Thomas Le Bonniec, a sociology researcher at the French privacy research group DIPLab, who co-authored a recent report on Outlier's data collection, stated, "Platform work seems to be fertile ground for a whole new type of workplace surveillance." He added that "This would be seen as unacceptable in any other form of employment in the European Union."

Noyb contends that Persona, which handles identity verification, collects biometric data from Outlier contractors, alongside IP addresses, geolocation data, device information, addresses, and credit data. Furthermore, Noyb claims Scale tracks workers by collecting system and device activity—even outside of Outlier work—and transmits this to third parties like TikTok, Facebook, and LinkedIn every few seconds.

Lisa Steinfeld Leiser, Noyb's data protection lawyer, warned that this information could be used for profiling and targeted advertising, stating, "Such constant and extensive tracking while working really goes against all reasonable expectations." She questioned, "Why should LinkedIn or Facebook know which tasks you're working on?"

The complaints filed in France, Italy, the Netherlands, and Austria argue that Scale lacks a legal basis for installing tracking software on contractor devices and that it violated GDPR data minimization rules. The complaints also cite violations of GDPR data access rights after Scale allegedly ignored requests for stored data records.

In response to the claims, Scale stated, "The report’s claims are unfounded and inaccurate." They asserted, "Outlier’s practices are disclosed to contributors and require their consent. We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment."