The Dutch Data Protection Authority has fined Uber €825 million (about $966 million) for deactivating drivers' accounts through automated systems without telling them why. The decision is dated August 17 and was reported on August 21 by Reuters, which said it had seen the document; the authority has confirmed the fine but has not published the decision. Uber is appealing.
It is the second-largest penalty ever issued under the GDPR, behind the €1.2 billion Ireland imposed on Meta in 2023 — €825 million is 69% of that. It is also 2.8 times the €290 million the same regulator imposed on Uber in 2024, which was itself a record at the time.
The points
- The violations are not about a leak. The authority cited the right not to be subject to automated decision-making with significant consequences — GDPR Article 22, which requires meaningful human involvement — and the right to be informed.
- The conduct ran 2020 to 2022. Automated systems temporarily suspended drivers suspected of inflating fares by taking unnecessary detours, or of accepting trips they did not intend to complete. Some drivers with low customer ratings were deactivated permanently.
- A French complaint produced a Dutch decision. Uber's European headquarters is in the Netherlands, so the Dutch authority leads for the whole bloc under the GDPR's one-stop-shop rule — the same route that produced the €290 million transfers fine, which began with more than 170 French drivers complaining to a French rights group.
- This is the fourth Dutch fine, not the first. €600,000 in 2018, €10 million in 2023, €290 million in 2024, €825 million now.
- Uber disputes the scope as well as the amount. Its spokesperson called the decision and the fine "disproportionate", said current policies include human review and a route to dispute a suspension, and pointed to 126 drivers permanently deactivated across Europe over low ratings in 2021.
- Nothing published says the fine is stayed. Uber has said it will appeal; neither the regulator nor the wire reports have said whether payment is suspended while it does.
Four fines, eight years, 1,375×
| Dutch decision | Amount | What it was for |
|---|---|---|
| 2018 | €600,000 | The concealed 2016 data breach |
| 2023 | €10 million | Drivers' privacy rights; under objection |
| 2024 | €290 million | Driver data transferred to the US without safeguards |
| August 2026 | €825 million | Automated deactivation without human review |
| Total | €1,125.6 million | 73% of it in this week's decision |
The escalation from the first to the fourth is 1,375-fold. Three of the four concern the same population — European drivers — and the same company's handling of their data. Only the newest one is about what the software decided.
What €825 million is against Uber
We reported Uber's second quarter on August 5: revenue of $14.2 billion and trailing free cash flow crossing $10 billion for the first time. Against that set, using the $966 million figure the wires converted:
| $966 million against | Share | |
|---|---|---|
| Trailing revenue, $55.2B (+16.7%) | 1.75% | |
| Trailing free cash flow, $10.1B | 9.6% | |
| The June quarter's revenue, $14.2B | 6.8% | |
| Trailing diluted EPS of $4.55 | 10.2% |
Per diluted share the fine is about 47 cents. Measured against the rate Uber is currently generating cash, it is 35 days of free cash flow. That is a real number and a survivable one, which is why the financial reading of this story finishes in a paragraph and the company is appealing regardless.
The ceiling it was measured against
GDPR penalties are capped at 4% of a company's worldwide annual turnover, and the Dutch authority has previously shown its working: when it fined Uber €290 million in 2024 it cited a 2023 worldwide turnover of about €34.5 billion, which puts that fine at roughly 21% of the statutory maximum.
Do the same arithmetic on this one and it sits much closer to the ceiling. Uber's 2025 calendar-year revenue was $52.0 billion; at the 1.1709 dollars-per-euro rate implied by the wires' own €825 million/$966 million conversion, that is about €44.4 billion, and 4% of it is about €1.78 billion. €825 million is roughly 46% of that.
That figure is ours, not the regulator's, and it rests on two things the authority has not published: which turnover year it used, and at what rate. Treat it as an order of magnitude rather than a decimal. The order of magnitude is the point — the 2024 fine was a fifth of the maximum available and this one is nearly half.
What nobody has published is how many drivers it covers
The obvious denominator here is the number of drivers the automated suspensions touched. It has not been disclosed. Uber's 126 permanent low-rating deactivations in 2021 is the company's own figure, offered in its defence, and it covers one year and one of the two mechanisms — the temporary fraud-suspicion suspensions, which are the larger category and the ones the decision leads on, have no published count at all.
This is where most analysis quietly divides €825 million by 126 and prints a number. We are not going to. What can be said is that the regulator priced the conduct at 46% of everything it was allowed to charge, which is a statement about how it graded the violation and not about how many people it happened to.
The ruling is about the mechanism, not the incident
Read the two violations again: automated decision-making with significant consequences, and the failure to inform. Neither is a data-security finding. The regulator did not say Uber lost driver data or moved it somewhere it should not go — it said Uber let software make a consequential decision about a worker, and did not put a human in front of it or explain it afterwards.
That is a ruling about a design pattern, and Uber's stated direction is more of the pattern rather than less: algorithmic dispatch, algorithmic pricing, algorithmic fraud detection, and at the end of it autonomous vehicles. The nearest-term version of that is already permitted: the Nevada order we covered on August 21 granted Uber up to 1,000 autonomous vehicles through its Motional and Zoox partnerships in Clark County, alongside Tesla's 5,000.
There is a tempting sentence available here, and it is worth saying why we are not making it the argument. The tempting version is that a company being fined for automating decisions about drivers is a company whose whole strategy is removing the driver. It is neat, and it is mostly wrong in the direction that matters: this ruling protects a person subject to a decision, and a robotaxi with no driver has nobody to notify. The specific liability the AP just priced does not transfer to the driverless business.
What does carry is the timing. The conduct ran 2020 to 2022 and the decision landed in August 2026 — four to six years later, against a company that had, on its own account, already changed the process. Whatever Uber's systems are doing in 2026 gets adjudicated somewhere around 2030, under whatever rules exist then, at a company that will have far more automated decisions in production and a smaller share of them made about employees. The exposure is not the €825 million. It is that the clock on this kind of finding runs half a decade behind the product.
What to watch
- Whether the appeal suspends payment, and whether Uber takes a charge. A €966 million penalty for conduct that ended in 2022 either was provisioned or was not, and the next quarterly filing's legal proceedings note settles it.
- Whether the authority publishes the decision. The GDPR articles cited, the remediation ordered and the turnover figure used are all currently second-hand from a document Reuters says it saw.
- Whether the €10 million and €290 million objections resolve, and at what number. Two of the four fines are still contested; the €1.13 billion total is a headline figure, not a settled bill.
- Whether other regulators follow on the same conduct. One French complaint produced one Dutch decision covering EU-wide behaviour. Whether that closes the matter or opens it is the difference between a one-off and a category.
- Whether any regulator applies Article 22 to a fully driverless deployment. The person subject to the decision changes from the driver to the rider, and nobody has priced that.
Sources and provenance: the fine amount (€825 million, about $966 million), the August 17 decision date, the two rights cited, the 2020–2022 conduct period, the fraud-suspicion and low-rating mechanisms, the French-complaint origin and the second-largest-ever ranking are as reported on August 21 by Reuters, which said it had seen the decision, and confirmed by the Dutch Data Protection Authority; the decision itself is unpublished. Uber's quotes, its account of current human review and dispute rights, and the 126 permanent low-rating deactivations in 2021 are the company's, offered in its own defence. The 2018 (€600,000), 2023 (€10 million) and 2024 (€290 million) fines and the €34.5 billion 2023 turnover figure are the Dutch authority's own, from its August 2024 announcement; that €1,125.6 million total and the 1,375× escalation are our arithmetic on them. Uber's trailing revenue ($55.2B, +16.7%), trailing free cash flow ($10.1B), June-quarter revenue ($14.2B), trailing diluted EPS ($4.55) and 2025 calendar-year revenue ($52.0B) are the figures Uber reported; the shares of each, the 47 cents per diluted share on 2,071 million diluted shares, and the 35 days of free cash flow are ours. The €1.78 billion statutory maximum and the 46% share of it are ours, derived at the 1.1709 dollars-per-euro rate implied by the €825 million/$966 million conversion in the wire reports and assuming the authority used 2025 turnover — it has published neither. No figure in this piece is divided by a driver count, because none has been published.
