The Dutch Data Protection Authority (AP) confirmed on the 21st its decision to impose a fine of 825 million euros (approximately $960 million) on Uber, citing the company's failure to adequately inform drivers about its automated systems used to deactivate accounts between 2020 and 2022. The decision, dated August 17th, found that Uber violated drivers' rights to not be subjected to automated decisions with legal or similarly significant effects, as well as their right to be informed about such automated decision-making processes. This penalty ranks as the second-largest publicly announced fine under the GDPR framework, trailing only the 1.2 billion euro penalty issued by Irish regulators against Meta in 2023. Uber has called the fine "disproportionate" and plans to appeal, noting that the policies in question were discontinued several years ago. The company's shares edged slightly higher on the day of the announcement.

Case origins and legal basis

The investigation originated from complaints filed in France, with the Dutch authority taking the lead due to Uber's European headquarters being located in Amsterdam. The contested practices included systems that flagged drivers for suspected fraud—such as taking circuitous routes to inflate fares or accepting rides without intending to complete them—resulting in temporary placement on waiting lists, as well as account deactivations based on passenger ratings. Uber stated that the fraud-related waiting list policy was halted in 2021, and the rating-based deactivation policy ended in 2022, emphasizing that permanent deactivations were never fully automated. The company also noted that approximately 126 European drivers were deactivated due to low ratings in 2021. Article 22 of the GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects on individuals, and requires explanation of the logic and consequences involved. The AP determined that account deactivation directly impacts drivers' income, constituting a significant effect, and that Uber's disclosures were insufficient. Uber, conversely, stressed that its current processes include human review and appeal channels. Both parties continue to dispute whether the decisions were "solely automated" and whether the information provided was adequate. The Amsterdam Court of Appeal had previously, in a case concerning drivers' information rights, required Uber to provide meaningful explanations regarding automated deactivations. This administrative penalty elevates the issue from civil information disclosure to a monetary enforcement level.

Fine scale and company response

The 825 million euro fine is the largest ever imposed by the AP and stands as the second-highest publicly disclosed penalty under the GDPR. Uber argues that the regulatory review targets historical policies that have since been retired, asserting that the fine amount is disproportionate to the number of affected individuals and the nature of the conduct. Meta's 1.2 billion euro fine also remains under appeal, illustrating that such decisions often take years to reach final payment. For Uber's finances, booking the fine as a one-time charge carries notable weight: the company reported approximately $14.2 billion in revenue and about $2.1 billion in non-GAAP operating income for its most recent quarter, with a market capitalization around $161 billion. If paid in full, the fine would represent close to 40% of one quarter's profits, though it does not pose a solvency risk. Market reaction was subdued on the day, and analyst consensus remains tilted toward a buy rating, reflecting investor views that treat the outcome as an appealable contingent liability rather than a disruption to operations.