On August 21, 2026, the Dutch Data Protection Authority (the Dutch DPA) announced that it had fined Uber €824,990,000 for infringing the EU General Data Protection Regulation's prohibition on certain solely automated decisions with respect to drivers. The Uber GDPR automated decisions fine is a notable moment for anyone whose personal data feeds systems that make consequential choices about them without a person in the loop.

This post explains what the regulator announced, what "solely automated decisions" means in plain language, who else could be affected, and where a VPN fits in (and where it does not).

What the Dutch DPA Fined Uber For

According to the announcement, the Dutch DPA penalized Uber for breaching the GDPR's restriction on solely automated decisions as they relate to drivers. The fine totals €824,990,000. Coverage of the case describes the dispute as centered on automated systems used to suspend or deactivate driver accounts, and reports suggest the penalty ranks among the largest ever issued under the GDPR.

Uber has disputed the findings, according to reporting, saying its deactivation processes comply with the law. The company's position and any appeal are worth watching, since the details of the decision may be tested further. For a fuller account of the ruling itself, see the existing vpn.social report, Dutch DPA Fines Uber €825M Over Driver GDPR Breach.

What "Solely Automated Decisions" Means in Plain Language

The GDPR (in Article 22) gives people a right not to be subject to a decision based solely on automated processing when that decision has legal or similarly significant effects on them. Put simply: if software makes a call that seriously affects your life or livelihood, and no human meaningfully reviews it, that is a problem under EU law unless specific conditions are met.

Three ideas help make this concrete:

  • Solely automated: No real human involvement. A person who merely rubber-stamps an algorithm's output without the ability or authority to change it may not count as meaningful oversight.
  • Significant effect: The outcome matters. Losing access to an account that provides your income is a clear example of the kind of impact regulators care about.
  • Safeguards: Where automated decisions are allowed, people generally need ways to get human intervention, express their view, and contest the outcome.

The case shows regulators are willing to enforce these limits against a large platform, and to attach a very large penalty to them.

Who Is Affected Beyond Uber Drivers

The ruling concerns Uber drivers, but the principle reaches much further. Automated systems already influence decisions about:

  • Gig and platform workers, including account suspensions and pay.
  • Job applicants screened by automated tools.
  • Customers facing automated fraud flags, account closures, or credit-related outcomes.
  • Users of any service where an algorithm can restrict access to an account.

The source material does not say how the decision will be applied to other companies, so it would be a mistake to overstate its reach. Still, any organization that relies on automated decision-making in the EU now has a high-profile reason to review whether real human oversight exists, and whether affected people can challenge outcomes.

What a VPN Does and Doesn't Do Against Algorithmic Profiling

A VPN encrypts your traffic between your device and the VPN server and hides your IP address from the sites you visit. That is useful for privacy on public networks and for limiting some location-based tracking.

It does not, however, stop algorithmic profiling by a service you are logged in to. If you drive for a platform, shop with an account, or apply for a job through a portal, the company already holds the data you gave it and the data generated by your activity. An automated system using that data to make decisions about you is unaffected by whether your connection runs through a VPN.

In short, a VPN is a tool for network privacy. The protection against opaque automated decisions comes from legal rights and regulators, which is exactly what this case illustrates.

What This Means For You

If you live in the EU or deal with EU-regulated companies, your GDPR rights are a practical tool:

  • Ask questions. You can request information about the personal data a company holds on you and how it is used in decisions.
  • Request human review. If an automated decision significantly affects you, ask whether a person reviewed it and request one if not.
  • Keep records. Save notices, emails, and screenshots of suspensions or rejections.
  • Know where to complain. Data protection authorities accept complaints, which is how cases like this can begin.

Outside the EU, protections differ, but the case shows the direction regulators are taking.

Key Takeaways

The Uber GDPR automated decisions fine shows that limits on algorithmic decision-making are being enforced, not just written down. Understand your rights over automated decisions, use them when a system affects your income or access to services, and treat a VPN as one layer of network privacy rather than a fix for profiling. For the full details of the ruling, read our existing report on the Dutch DPA's Uber fine.