The European Centre for Digital Rights, known as Noyb, is filing five complaints against US-based artificial intelligence startup Scale AI over alleged violations of workers’ data protection rights on its Outlier platform.

The complaints, announced on Tuesday, October 27, concern the platform’s tracking of freelancers and the safeguards available to workers employed under its freelance contract model. Noyb said it was submitting two complaints in Austria and one each in France, the Netherlands and Italy.

Scale AI, headquartered in San Francisco, operates Outlier, a platform that recruits freelancers and subject-matter experts to help train, assess and improve artificial intelligence models. The service uses a platform-based employment model similar to those used by ride-hailing and food delivery companies.

According to Noyb, Outlier has more than 900,000 freelancers who evaluate and correct AI-generated responses. Its customers include Meta, OpenAI, Google and the US government, meaning workers contribute their expertise to systems developed and used by major technology companies.

The organisation alleges that Outlier collects extensive personal information and requires workers to undergo invasive biometric checks before they can earn money. It argues that the platform’s monitoring practices conflict with European data protection standards and workers’ expectations of privacy.

Noyb also claims that trackers operated by companies including TikTok, LinkedIn and Facebook are placed on workers’ devices while they use the platform. These trackers allegedly give the companies access to personal information, including IP addresses, contact details and data that could be used for targeted advertising and profiling.

“Such constant and extensive tracking while working really goes against all reasonable expectations. Why should LinkedIn or Facebook know which tasks you’re working on?” said Lisa Steinfeld Leiser, a data protection lawyer at Noyb.

The group said the alleged monitoring raised concerns about the handling of personal data in the workplace and the ability of freelancers to protect their information while carrying out assignments.

Noyb further alleges that workers must repeatedly complete biometric verification procedures administered by Persona, a separate company. The process reportedly requires workers to record videos of their faces and upload identification documents.

The complaints come as European authorities increase scrutiny of the artificial intelligence sector. The EU’s AI Office opened investigations into OpenAI and Anthropic earlier this month, reflecting broader concerns about the development and deployment of AI systems.

Regulatory approaches are also diverging internationally. In the United States, President Donald Trump signed an agreement with six major American AI companies allowing them to oversee aspects of their own development practices.

The dispute highlights a growing challenge for the industry: balancing the demand for large-scale human input to train AI systems with the privacy rights of the people providing that work. The allegations against Scale AI have yet to be established through the complaints process.

Japanese internet infrastructure company GMO Internet will compensate customers for financial losses linked to unauthorised trading following a cyberattack on its cloud service. The company will also pay ¥5,000 (€28) to every customer currently using the affected service, regardless of whether they suffered losses.

The attack targeted Onamae.com Desktop Cloud, a virtual private server service that allows customers to access remote desktop environments. GMO said customer information had been stolen and some users had reported transactions in their securities and foreign-exchange accounts that they had not authorised.

According to founder and chief executive Masatoshi Kumagai, the incident potentially affected 26,739 servers and involved unauthorised activity on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas.

GMO shares fell almost 16% on Monday, reaching a four-month low. The company had a market value of approximately $2.6 billion at Friday’s close.

GMO began investigating the incident on 19 October after receiving an inquiry from a customer. The company confirmed the installation of malicious software in some customer server environments the following day. It then suspended new applications and access to the service’s control panel before beginning to shut down all servers on 21 October to limit further damage.

In a blog post published on Sunday, Kumagai apologised for the company’s handling of the incident. He acknowledged that security specialists had identified concerns before the attack but said the company’s response had been insufficient.

GMO also disclosed that it had received a ransom demand from a party believed to be responsible for the attack. In an update to his blog on Monday, Kumagai said the attackers had demanded $50 million in cryptocurrency and threatened to release company and customer information.

The company has refused to pay the ransom and is cooperating with police and other authorities.

Customers who wish to continue using a Windows desktop environment will be offered an alternative service operating on independent cloud infrastructure, free of charge for six months. GMO also plans to redesign its security architecture and investigate the breach with external experts.

Kumagai has called on the Japanese government to strengthen its active cyberdefence capabilities, arguing that private companies cannot tackle sophisticated cross-border attacks alone. GMO has asked authorities to consider applying the framework to the incident and offered to share evidence and technical information with investigators.

The breach comes amid wider concerns about digital security, following the disclosure of two critical vulnerabilities in PHP, a programming language widely used to build websites and applications. Security authorities warned that the flaws could allow malicious code to run on vulnerable servers, although GMO has not confirmed any connection between those vulnerabilities and the attack.

A separate Google Cloud outage in the United Kingdom last week disrupted online services, including those operated by financial technology company Revolut, highlighting the wider consequences of disruptions to digital infrastructure.

The European Commission has accepted an action plan from Chinese-owned online retailer Temu to address violations of the European Union’s Digital Services Act (DSA), following a €200 million fine imposed on the company in May.

The Commission said on Monday that Temu had committed to strengthening its safeguards against the sale of illegal products and improving its monitoring procedures. The company has also agreed to conduct a risk analysis and take additional measures where necessary to address potential problems on its platform.

Temu will review how its product recommendation systems may contribute to the spread of illegal goods, the Commission said. The measures are intended to strengthen consumer protection and ensure the platform meets its obligations under EU digital regulations.

The fine was imposed in May after regulators found that Temu had failed to adequately identify and address risks associated with illegal and unsafe products sold to European consumers. Examples included dangerous baby toys and faulty chargers.

The penalty followed a formal investigation launched in October 2024 into whether Temu was complying with the requirements imposed on designated Very Large Online Platforms under the DSA. These platforms are subject to stricter rules because of their reach and potential impact on users.

Temu welcomed the Commission’s approval of its action plan, describing the regulatory engagement as constructive.

“We appreciate the Commission’s constructive engagement with us throughout the process,” the company said in a statement.

The plan, Temu added, demonstrated its commitment to investing in compliance systems and creating a safe and trustworthy shopping environment for customers across the EU.

The retailer has around 130 million users across the bloc’s 27 member states, representing nearly one-third of the EU population. Its extensive customer base has made it a major player in Europe’s online retail market, while also bringing increased scrutiny from regulators concerned about product safety and compliance.

Temu is also adapting to changes in the EU’s treatment of low-value imports. Since July, a €3 fee has applied to low-value packages entering the bloc, affecting retailers that ship large volumes of inexpensive goods directly to consumers. Previously, parcels worth less than €150 could enter the EU without customs duties.

The new charges have contributed to a decline in small-parcel imports, particularly from China. Reports indicate that such imports have fallen by between 30% and 40% since the measures took effect.

The acceptance of Temu’s action plan marks another step in the EU’s efforts to tighten oversight of major online marketplaces, although the company’s implementation of the promised measures will remain important to its compliance with the bloc’s rules.