A platform that hires highly educated Europeans to train chatbots collected personal and biometric data on them, including facial scans, and sent their details to third parties through 16 trackers, according to a new report.
Outlier is operated by Scale AI, the data-labelling company in which Meta paid $14.3 billion for a 49 per cent non-voting stake in June 2025. The report puts Outlier's pool of workers at up to 900,000 worldwide and names Meta, Alphabet, OpenAI and xAI as its main clients.
Surveillance at Scale: How AI Training Platforms Gather Personal Data from European Workers was published on 15 October by the academic group DiPLab and the NGO Reversing.Works. Fieldwork ran from September 2024 to February 2026. The researchers interviewed 35 Outlier workers in 13 European countries, 12 EU members and Norway. Eleven workers shared browser logs from which the trackers were identified. The team also analysed 94 internal project guidelines.
The trackers include tools that, the report says, capture clicks, keystrokes, mouse movements and screen activity, among them FullStory. Others come from Facebook, LinkedIn, Snapchat, TikTok, Twitter and Quora. The Facebook tracker attaches a unique ID to each worker and collects details of the tasks they are doing, including hourly rate and project, according to the report. Meta owns Facebook.
The report describes FullStory as a lightweight screen recorder that lets developers reconstruct users' actions as video. Simone Robutti of Reversing. Works told La Nación that it can recreate activity in detail comparable to a screen recording. He said it cannot follow workers beyond Outlier's own domain and that the researchers cannot show it links their activity across sites.
Workers must verify their identity through an app called Persona, by scanning an ID document and recording a video of their face, the report says. They are asked to repeat the check, for example, when located in another country. Outlier acknowledges processing biometric data for this purpose and argues it has a legitimate interest, the report adds. Persona's 2021 $150 million funding round was led by Founders Fund, the venture firm co-founded by Peter Thiel.
Pay is precarious, the researchers say. Workers' income in the previous month averaged €1,214, and the median was €1,000. Ten of the 35 earned nothing. Pay is halved once a task passes 20 minutes. In identical projects, hourly rates ranged from $10 for Portuguese speakers to $50 for Swiss German speakers. One 46-year-old worker in Greece described the wait for work: "There is no task – you're prepared to work the whole day."
The report also sketches ties between the platform's backers and the US defence establishment. Scale launched Defence Llama, built on Meta's Llama 3, for national-security users in November 2024. The report says Scale, Palantir and Anduril belong to a consortium bidding for military contracts. It describes these as links of investment, contracting and personnel, and says the use of some of the data it traced remains unclear.
The authors set out potential breaches of the GDPR:
• biometric processing that may breach data minimisation;
• consent that cannot be assumed to be freely given when workers depend on the platform;
• privacy policies published only in English;
• undisclosed transfers to US companies, including Sprig, PostHog, FullStory, LinkedIn and Facebook.
They also point to the exposure of worker data in public Google documents, which Business Insider reported in June 2025. They say it affected at least several hundred people in the EU and should have been notified. Scale told Business Insider at the time that it took data security seriously and was looking into the matter.
The researchers urge European authorities to investigate Outlier. They warn that the Commission's Digital Omnibus could let companies claim that using EU data for AI training is a "legitimate interest". The data-protection strand of the package is still under negotiation.
The findings come as Meta's AI products face scrutiny over personal data protection. In February, two Swedish newspapers reported that contractors in Nairobi had reviewed footage from Ray-Ban Meta glasses. Meta says it uses contractors to review some content shared with Meta AI and filters data to protect privacy. On 3 October, Wired reported that instructions extracted from Meta's Muse agent describe an hourly process that can build pages about people in a user's life. Meta says Muse draws on public information and what users choose to share.An LLM was used to process this report.
