Uber fined €825M by Dutch regulator over algorithm-driven driver deactivations

The Dutch data protection authority (Autoriteit Persoonsgegevens, AP) has fined Uber €825 million for using an automated algorithm to deactivate driver accounts without adequate human oversight, a direct violation of the EU's General Data Protection Regulation (GDPR). The fine, announced on August 21, 2026, is one of the largest GDPR penalties to date and signals a regulatory crackdown on opaque AI decision-making processes.

What Happened

According to the regulator, Uber's system automatically terminated driver accounts based on algorithmic assessments of driver behavior, including fraud detection or performance metrics. The AP found that Uber failed to provide sufficient transparency about how these decisions were made, and did not offer drivers an effective channel to contest the deactivations. This breaches GDPR Article 22, which grants individuals the right not to be subject to decisions based solely on automated processing that produce legal effects (such as termination of contract) without human intervention.

Key Details

• Fine amount: €825 million (approximately $960 million at current exchange rates).
• Regulator: Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
• Violation: Automated account deactivations without meaningful human review or driver safeguards.
• GDPR impact: Likely under Article 22, restricting fully automated decision-making with legal consequences.

Implications for AI Agents

This ruling is a wake-up call for any team deploying AI agents that make consequential decisions about people. If your agent is used to approve loans, rank candidates, or—in Uber's case—terminate accounts, you need to ensure:

1. Human review is built into the pipeline for adverse decisions.
2. Affected individuals get clear explanations of the AI's logic.
3. A straightforward appeals process exists.
4. Compliance with GDPR Article 22 and similar regulations is audited.

For developers, this means designing systems that log decision inputs, provide explainability, and have manual override mechanisms. The era of running an algorithm as a black box is over—regulators are watching.