noyb vs Outlier: Face-Video ID Checks Challenged [2026]

On October 27, 2026, the privacy group noyb said it had filed five complaints against Scale AI, the US company behind the Outlier AI training platform. According to noyb's announcement, the complaints were filed with partners Intérêt à Agir, DIPLab and Reversing.Works in France, Italy, the Netherlands and Austria. They allege that workers must repeatedly go through biometric verification with video recordings of their face and an uploaded ID, and that advertising and analytics trackers monitor them while they work.

The story sits in the middle of a larger shift: selfie-and-ID checks have become a routine condition of gig work, banking, social media and age gates. This post explains what noyb alleges, what Outlier's own privacy policy says, how the GDPR's data minimisation principle applies, and what you can do to protect your face and ID images, including how to blur them in footage you publish.

What Are the noyb Complaints Against Scale AI and Outlier?

Five complaints, filed on October 27, 2026, accuse Scale AI of unlawful surveillance of European platform workers. noyb says Outlier employs "more than 900,000" freelance workers and that its customers include Meta, OpenAI, xAI, Google, Anthropic and the US government. The groups ask data protection authorities to open a full investigation and impose an administrative fine. No amount is stated.

The complaints raise four points, as described by noyb:

• Biometric checks. Workers repeatedly go through biometric verification, run by Persona, that involves video recordings of their face and an ID upload. noyb says this goes beyond what is necessary.
• Trackers. Trackers from TikTok, LinkedIn, Facebook, Sprig and Datadog sit on workers' devices while they use the platform and, noyb says, send IP addresses, contact details, unique identifiers and visited-page information to third parties every few seconds.
• No legal basis for trackers. noyb argues there is no valid legal basis, such as consent, for placing them.
• Access requests. Scale AI did not answer the complainants' access requests, noyb says.

Scale AI says the verification prevents identity fraud and verifies workers' skills, which noyb disputes. We have not seen a regulator's decision, and every allegation here is the complainants' until an authority rules.

Who is behind the complaints?

noyb is the Vienna-based privacy group founded by Max Schrems. The partners named in the announcement are Intérêt à Agir, DIPLab and Reversing.Works. Quotes in the announcement include Thomas Le Bonniec of DIPLab: "This system only thrives because of its deliberate lack of transparency." Lisa Steinfeld Leiser of noyb asks: "Why should LinkedIn or Facebook know which tasks you're working on?" And Baptiste Delmas of Intérêt à Agir says: "Data protection authorities must now take these issues seriously and impose strict enforcement measures."

What Does Outlier's Own Privacy Policy Say About Face Data?

Outlier's policy confirms the basic mechanism and flags the legal sensitivity. According to Outlier's privacy policy, it uses its service provider Persona to verify identities and skills "to help protect the integrity of the Services and reduce fraud," at sign-up and again at intervals. It says it may collect and analyze images, video or audio.

The policy states that Outlier may collect "selfies and images of your government-issued ID" and use them to check skills or "generate information and measurements about your face." It adds that this data "may be considered 'biometric' data or 'sensitive' data under the laws of some jurisdictions." It also says: "We do not sell, lease, trade, or profit from Verification Data," and that Verification Data is retained for up to two years after your last interaction "or as required by law". For deletion of images, recordings or Verification Data, it names [email protected].

Two readings are possible. Scale AI can say it discloses the processing and limits retention. noyb can say disclosure is not the same as necessity: the GDPR asks whether collecting a face video again and again is needed at all.

How Does Persona's Face Verification Work?

Persona's selfie check confirms that a live person is present and compares their face with the portrait on a government ID. Its help documentation says the selfie is compared to the ID portrait using a "three point composite," with the selfie captured looking center, left and right by default, and that "biometric liveness checks" confirm the person is physically present. The documentation describes images; noyb describes video recordings, and we could not reconcile the two from public documentation.

This matters because liveness and face matching both create biometric measurements. Under the GDPR, biometric data processed to uniquely identify a person is a special category, which normally requires an explicit legal condition.

Does the GDPR Allow Repeated Biometric Checks of Workers?

Not automatically. The GDPR requires that personal data be adequate, relevant and limited to what is necessary, which is the data minimisation principle noyb invokes. Biometric data used to identify someone gets extra protection, and an employer-style relationship makes consent harder to rely on because of the imbalance of power. noyb's announcement does not cite specific article numbers, so the exact legal framing will come from the filings.

The questions an authority is likely to weigh are practical:

1. Is one check enough? Verifying identity once at onboarding is different from repeating video checks over months.
2. Is there a less intrusive alternative? Outlier's policy says that under certain circumstances you may have a choice of an alternative way to verify your identity.
3. How long is the data kept, and who sees it? The policy says up to two years after last interaction.
4. Can workers actually refuse? If refusing means losing access to paid work, consent is hard to call free.

For a wider look at how European authorities treat face data, see our guide to GDPR video compliance for faces and license plates and the EU AI Act's facial recognition scraping ban.

What Happened to the 70,000 ID Photos Stored With Persona?

noyb says hackers exposed about 70,000 government ID photos stored with Persona in October 2025, and that Persona claims the right to collect IP addresses, device information, geolocation, addresses and consumer credit data. These are noyb's statements, and we have not verified them against Persona's own disclosures. If accurate, they illustrate the central argument against collecting face and ID images at scale: the more you store, the more there is to leak, and a leaked face or passport scan cannot be reset like a password.

That risk is not hypothetical elsewhere. Our report on the NEFOS PuffPal passport data breach covers a case where ID documents were exposed, and the lessons about minimising what you hand over apply here too.

Why Is This Part of a Bigger Biometric Story?

Face data is becoming a default requirement. We have also covered a BIPA class action over Walmart voiceprints and the Clearview AI appeal in British Columbia. In each, the question is the same: who is allowed to turn a face or a voice into a template, on what basis, and for how long. The Outlier complaints add a labour angle: when a face scan is the price of earning income, "voluntary" becomes a hard word to defend.

Our wider explainer on digital ID laws and online anonymity shows the same drift in age verification and government schemes.

What People Are Saying

We did not find a Hacker News discussion linked to this announcement, so we are not quoting community reaction. The reactions we can cite are the three quotes from the complainants above.

What Should You Do If You Are Asked for a Face Video and ID?

Treat a selfie-and-ID request as a data transfer you can question. A practical routine:

1. Read the privacy notice before you start. Look for the words biometric, selfie, liveness, retention and the vendor's name.
2. Ask whether there is an alternative. Some platforms, as Outlier's policy says, offer another way to verify. Ask in writing.
3. Submit only what is required. Do not send extra documents or a higher-resolution ID than requested.
4. Send an access request. Under the GDPR you can ask what the company and its vendor hold about you, and you should normally get a reply within one month.
5. Ask for deletion when you leave. Request erasure of images, recordings and verification data, and keep the reply. Outlier's policy lists [email protected] for this.
6. Check for trackers. Use your browser's privacy settings or a tracker blocker where the platform allows it, and decline non-essential cookies.
7. Complain to your data protection authority if the answers are poor. noyb's filings were made in four countries, which shows workers can go to their national authority.
8. Never reuse the same ID photo everywhere. If a copy leaks, you want the damage contained.

How Can You Blur Faces and IDs in Videos You Share?

For videos you publish, such as work tutorials, screen recordings or reviews of verification flows, blur faces and document details first. Do not blur images you submit to a verification flow, since the check needs the real face and ID.

With BGBlur, which runs in the browser:

1. Upload the clip (MP4, MOV or M4V).
2. Choose face blur for people, and a text-prompted object blur for items such as an ID card or a document on a desk.
3. Review the entire timeline. Check moments where a card is lifted to the camera or a face turns away.
4. Export in MP4, MOV or WebM and watch the result at full speed.

Caveats: automatic detection can miss an unusual angle or a small ID number, so scrub the result. And blur is only as good as its strength; see our explanation of why weak blur fails. For general steps, our guide to blurring faces in photos and videos covers the basics, and the AI face anonymizer comparison explains when to replace rather than blur.

Update — October 28, 2026: Face scans for verification are also reaching phones: see Apple's iOS 27.2 selfie age check.

What Happens Next?

The next steps belong to the authorities in France, Italy, the Netherlands and Austria. They may investigate, coordinate under the GDPR's cross-border mechanism, or decline. noyb's announcement gives no timeline, and enforcement of this kind can take months or years. Meanwhile, watch for responses from Scale AI and Persona, and for whether other gig and AI-data platforms change their verification flows.

Conclusion: Your Face Should Not Be a Condition of Work by Default

The noyb complaints against Scale AI frame a question that will not go away: when is it necessary to scan a person's face on video, and how often? Outlier says verification prevents fraud and checks skills. noyb says it is excessive, repeated and surrounded by trackers that send worker data to advertising companies. Regulators will decide, and nothing is proven yet.

What you can do now is smaller but real. Read the notice, ask about alternatives, request your data and its deletion, and keep your own published footage free of faces and documents that do not need to be there. If you create content that features ID cards, screens or other people, try BGBlur's face and object blur in your browser, check the full clip, and share only what you intend to.