Dutch Regulator Fines Uber €825 Million Over Automated Decision-Making and Profiling Transparency
The Development
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Uber EUR 824,990,000, announced via the European Data Protection Board on October 8, 2026. The regulator found Uber violated the General Data Protection Regulation on two grounds: unlawful automated decision-making and insufficient information provided to individuals about profiling. The penalty is among the largest ever levied under GDPR. The source notice carries the headline findings only; the full decision text, the affected-user population, and any remediation orders were not included in the announcement. Uber's response and any appeal intentions were not stated. The case turns on how automated systems make consequential decisions about individuals and how clearly companies tell people those systems exist.
Our Take
The market has priced GDPR risk around consent banners and cross-border transfers. This fine moves the exposure to a different layer: what your models decide and whether you told people. That is exactly where marketing is heading. Agentic systems that score, segment, suppress, price, and personalise at scale all produce automated decisions about individuals, and most programmes have thin documentation of what those decisions are, let alone plain-language disclosure. The Dutch DPA chose a mobility platform, but the legal logic transfers directly to lead scoring, dynamic offers, credit-adjacent targeting, and churn-driven treatment. Expect this to be cited in every EU regulator's next inquiry into AI-driven personalisation. Treat it as precedent, not an outlier.
What Changed
Regulators now have a proven enforcement path against algorithmic decisioning itself. GDPR's automated decision-making and transparency provisions, long treated as secondary to data-transfer and consent cases, carry nine-figure penalties, turning profiling disclosure and human-review design into board-level financial exposure.
Marketing Impact
CRM, personalisation, and marketing operations teams carry the most direct exposure. Any workflow where a model scores, segments, prices, or excludes individuals without human review needs a documented legal basis and clear profiling disclosure. Privacy notices written for cookies will not satisfy an automated-decisioning inquiry.
Competitive Implication
Brands with audited decision inventories and human-in-the-loop controls gain a defensible position and faster agent deployment approvals. Vulnerable are teams running opaque scoring and agentic optimisation across EU audiences, and vendors whose black-box models cannot supply the explanation their clients now owe regulators and customers.
Strategic Outlook
Other EU data protection authorities will open profiling and automated-decision inquiries through 2027, with AI-driven personalisation a natural target. Expect enterprise procurement to demand decision-logic documentation from martech vendors by Q1 2027, and a visible slowdown in EU rollouts of fully autonomous targeting without review layers.
The Exploit
Action Item
Have your privacy counsel and CRM lead build a register this quarter of every model-driven decision about individuals in EU markets, flagging which lack human review or plain-language profiling disclosure, and remediate the highest-impact ones before Q1 2027 planning.