No Human Signed Off. Uber's Fine Is $966 Million.

The Dutch data protection authority just fined Uber €825 million — about $966 million — for one specific failure: letting software deactivate drivers with nobody signing off on it.

This isn't a story about Uber being reckless with data. It's a story about what happens when an automated decision has real consequences and nobody built in a human checkpoint. Between 2018 and 2022, Uber's systems flagged drivers for suspected fraud or low customer ratings and cut their accounts off — sometimes for good — without a person ever looking at the case.[1] The regulator's math values that gap at nine figures. If you build or run any automation that can end someone's income, access, or account, the gap is the same shape at any scale. You're just not being billed for it yet.

What the ruling actually says

Source: Autoriteit Persoonsgegevens — Uber fined nearly 825 million euros for automated driver blocking

The Autoriteit Persoonsgegevens (AP) found that Uber used software to track driver behavior and customer reviews. When that software detected a fraud suspicion or ratings that stayed too low, it deactivated the account — temporarily at first, permanently if the pattern persisted. No human assessed the decision before it happened. Drivers also weren't adequately told the calls were fully automated.[1] The AP's own framing is blunt: this is a company that let a computer end someone's income with nobody accountable for the individual case.

The case started with 171 French drivers who reported the problem to Ligue des droits de l'Homme, a French human-rights group. That organization filed a complaint with France's regulator, the CNIL, which routed it to the AP because Uber's European headquarters sit in the Netherlands — the GDPR's "one-stop shop" rule in action.[1] Uber disputes part of the finding, arguing most suspensions are brief and that no permanent deactivation happens without human review, and says it will appeal.[2]

The violation isn't "used an algorithm." It's "nobody signed off."

That distinction is the whole post. Uber didn't get fined €825 million for building fraud-detection software. Fraud detection is table stakes for a platform that size. It got fined for skipping the one step that turns a fraud signal into a fraud decision: a person who looks at the specific case before the account goes dark.

A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being.

That's AP deputy chair Monique Verdier, and it's the sentence to actually remember here — not the euro figure.[1] GDPR bans fully automated decisions with significant effects on a person unless a human meaningfully reviews them. "Meaningfully" is doing the work in that sentence. A rubber-stamp approval isn't review. Neither is a review step that exists on a flowchart but never runs in production.

This is the fourth fine, not the first

Uber has been down this road with the AP before, and the pattern is the actual story:

Three of the last four fines are still contested.[1] That's not a company that got caught once and fixed it — it's a company treating regulatory fines as a cost of doing business faster than it treats human review as a design requirement. The AP says Uber has now stopped the specific violation. It took a fine bigger than most companies' annual revenue to get there.

Here's the gate that was missing, next to the one GDPR actually requires:

flowchart LR
  subgraph Shipped["What Uber shipped (2018–2022)"]
    A1[Fraud signal or<br/>low rating detected] --> A2[Account auto-deactivated]
    A2 --> A3[Driver loses income<br/>no review, no explanation]
  end
  subgraph Required["What GDPR requires"]
    B1[Fraud signal or<br/>low rating detected] --> B2[Flagged for human review]
    B2 --> B3{Human confirms?}
    B3 -->|Yes| B4[Account actioned<br/>driver informed + can appeal]
    B3 -->|No| B5[Flag dismissed<br/>no action taken]
  end

The difference between those two diagrams is one box. That box is what €825 million buys when you skip it.

What this means if you're the one building the automation

You're probably not running a rideshare platform with 44.5 billion euros of global turnover, so the fine math — GDPR caps penalties at 4% of worldwide annual revenue[1] — doesn't scale down to your business directly. The principle does. Any automated system that can suspend an account, deny a refund, freeze a payout, flag a contractor as fraud, or reject an application is making the same category of decision Uber got fined for. The regulatory exposure is EU-specific. The operational risk — a wrongly-ended relationship with no human who can explain why, or fix it — isn't.

This is exactly the design rule I build to on client work. On a financial data migration, every AI validation checkpoint produced a flag or a pass, never a silent commit — the rule was that an agent escalates by default, it doesn't ship by default. I ran a version of the same principle on a support-reply agent: it drafted and flagged, it didn't send. I wrote about why that specific call mattered — an agent that ships without a human check is a liability wearing an efficiency costume, whether it's declining a chargeback or deactivating a driver.

The accountability gap Uber got fined for isn't unique to gig platforms, either. A separate assessment released the same week graded the five frontier AI labs — OpenAI, Anthropic, Google, Meta, xAI — on whether they'd published a real plan for containing one of their own models if it went off-script. None had a formal one. OpenAI scored highest, and still only hit 3 out of 5.[3] If the labs building the models haven't nailed down their own human-in-the-loop plan, don't assume the tool you're wiring into a client's ops has one either. Check what happens when it's wrong before you find out from the person on the other end of the decision.

If part of what you automate can end someone's income or access, that's not a place to save an API call. I help SMBs design agentic automation with the review gate built in from day one, not bolted on after the first complaint.

Sources

[1] Autoriteit Persoonsgegevens — Uber fined nearly 825 million euros for automated driver blocking — autoriteitpersoonsgegevens.nl

[2] TechCrunch — Uber faces fine of nearly $1B over automated driver suspensions — techcrunch.com

[3] TechCrunch — Frontier AI labs still won't say how they'd contain a rogue model — techcrunch.com

The fine isn't really about Uber. It's a nine-figure demonstration of what regulators now consider table stakes: if your system can end someone's income or access, a human has to be the one who actually decides, not the one who reads the log afterward. Build that gate before a regulator — or a client, or a court — makes you build it under worse terms.

The short version

• The Dutch DPA fined Uber €825 million ($966 million) for letting software deactivate driver accounts with no human review, 2018–2022 — the second-largest GDPR fine ever issued.
• The violation wasn't "used an algorithm." It was skipping the human who should have looked at the specific case before the account went dark.
• It's the AP's fourth fine against Uber since 2018. Three of the four are still under dispute or appeal.
• GDPR caps fines at 4% of global revenue, but the operational lesson — escalate by default, don't ship by default — applies at any company size, EU or not.
• Even frontier AI labs haven't published a real containment plan for their own models. The human-checkpoint gap is industry-wide, not a gig-economy problem.