The Regulator Didn't Need the Word AI to Fine Uber

824,990,000 euros. That's the exact amount the Autoriteit Persoonsgegevens, the Dutch data protection regulator, fined Uber on August 21. According to Reuters, it's the second-largest fine ever issued under the GDPR, behind the 1.2 billion euros slapped on Meta in Ireland in 2023, which Meta is still fighting.

On the other side of the ledger, only one number is circulating for how many people were affected: 126. According to Uber, that's how many drivers lost their accounts in Europe in 2021 over low customer ratings. The regulator itself has published no total. The only figure on record comes from the party being fined, which is using it to argue the penalty is disproportionate.

What the Software Actually Did

Between 2018 and 2022, Uber ran software that tracked two streams of data: driving behavior and customer ratings. Suspected fraud or ratings that dropped too low, and the account got switched off. Temporarily at first. Permanently if the low ratings persisted.

"There was no human assessment here," the regulator writes. Income stopped for as long as the account stayed deactivated. No warning, no appeal desk, no one to talk to: the tap just closed.

The case didn't even start in the Netherlands. 171 French drivers turned to the Ligue des droits de l'Homme, which filed a complaint on their behalf with the CNIL, France's privacy watchdog. Because Uber's European headquarters sits in Amsterdam, it was the Dutch authority that ended up investigating, through the GDPR's one-stop-shop mechanism. A complaint filed in Paris came back years later as a Dutch invoice.

Two Violations, Not One

The AP's statement lists two, and the distinction shapes how far the ruling reaches. The first: making fully automated decisions, which the GDPR bans whenever they carry significant consequences for the person involved (that's its Article 22). The second: failing to adequately inform drivers that those decisions were being made by a machine.

Putting a human back in the loop wouldn't have been enough on its own; Uber also had to tell people. The regulation treats automation like an ingredient you must list on the label, even when the recipe checks out.

The regulator notes that Uber has since ended these practices. Monique Verdier, the AP's deputy chair, summed up the authority's position: "Uber has committed serious infringements. Drivers were deactivated without pardon. From one moment to the next, they no longer had any income through Uber. That's forbidden. A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being."

The Word That Never Appears

Here's the part that matters even to people who've never booked a ride.

The statement exists in Dutch and in English. In both versions, the phrase "artificial intelligence" doesn't appear once in the actual text. We checked: the only hits for the abbreviation sit inside a web address, in the name of a section of the site. Zero in the body copy.

The word the regulator uses is "software." The AP states that "Uber used software to track drivers' (driving) behaviour and to track customer reviews." It doesn't say what was running under the hood, and the decision itself hasn't been published. So nobody knows whether this system would have earned the AI label, and the regulator never asks the question.

That's precisely what gives this case its reach. The rule being applied doesn't care about the technology, whether the system learns, whether it's generative, or what hardware it runs on. It asks one thing only: did someone look before the consequence landed? A speed camera and a chatbot walk through the same door, and it's a narrow one.

The legal framework that decision-making systems are about to be pulled into has just been tested on ordinary software. A precedent set here doesn't stay confined to one family of technology.

Beijing Tackled the Same Problem From the Other End

Four months earlier, we covered the Zhou case in China. A quality supervisor at a tech company in Hangzhou, Zhou watched his role get absorbed by AI, and his employer offered to cut his pay from 25,000 to 15,000 yuan a month. He refused, got fired, and sued. On April 28, 2026, the Hangzhou Intermediate People's Court sided with him: rolling out AI is a choice the company makes, not something that happens to it, and that's not grounds for termination.

The two cases grab the same problem from opposite ends. The Chinese court examined the reason given for letting someone go. The Dutch regulator doesn't care about the reason and examines the process instead: it doesn't matter why the account got cut, nobody signed off on it.

One looks at the why, the other at the how. And both land in the same place: a machine doesn't get to decide someone's income on its own.

Uber Isn't Just Contesting the Law

The disagreement doesn't stop at how to read the regulation. It extends to the facts themselves.

The regulator claims that poorly rated drivers were sometimes permanently deactivated by computer. Uber denies it, saying it never automated a permanent deactivation. The company adds that fraud-related suspensions were generally brief. Its spokesperson said Uber strongly disagrees with a decision and a fine it considers disproportionate, and that the authority reviewed policies that were abandoned years ago.

There's no way to settle this from the outside, since the decision itself hasn't been made public. Two parties are describing the same engine, each having looked under the hood alone, and the public reads both accounts with no way to check either one.

That's also where the 126 figure comes from. It covers only one year, 2021, and only one cause, low ratings. It says nothing about fraud-related suspensions, which make up the other half of the case, or about the other years the investigation covers.

Handed Down Isn't the Same as Collected

Uber announced it would appeal. The wording is worth pausing on: the Dutch version of the AP's statement says Uber announced it would file an appeal, the English version states flatly that "Uber has filed an appeal against the fine," and the company itself speaks in the future tense: a spokesperson called it "a disproportionate fine, which we will appeal." Neither version indicates whether the fine is payable while the procedure runs.

That ambiguity matters given the track record. This is the fourth fine the Dutch authority has handed Uber, after 600,000 euros in 2018, 10 million in 2023, and 290 million in 2024, both still contested. PPC Land cites an analysis finding that nearly 40% of the 7.1 billion euros in announced GDPR fines have since been overturned or challenged, and notes that the 746 million euro fine against Amazon in Luxembourg was sent back to the regulator by a court.

The number that makes headlines and the number that eventually gets collected are two different figures.

Which leaves this: the regulation that just sent a bill of this size to a platform, over how its machines treated workers, took effect back in 2018. We noted back in April that France's AI Act playbook still didn't exist. Here, it wasn't missing.