The Electronic Privacy Information Center (EPIC), a non-profit privacy rights group, has filed a complaint with the Federal Trade Commission asking that the FTC halt the “unfair and deceptive data collection practices” which car-sharing company Uber plans to impose on customers starting in mid-July.
Among other things, Uber's new “User Privacy Statement” claims the right to track its users even when they're not currently using the app.
Uber's posted announcement of this update included the sentence “We value your privacy and encourage you to review the new statement” prominently backlighted in blue at the top of the page. When you scroll down to the fourth full paragraph, you find this:
Location Information: When you use the Services for transportation or delivery, we collect precise location data about the trip from the Uber app used by the Driver. If you permit the Uber app to access location services through the permission system used by your mobile operating system (“platform”), we may also collect the precise location of your device when the app is running in the foreground or background. We may also derive your approximate location from your IP address.
In other words: when the app is on, we can use it to track your location, and when it's not, we can use your IP address instead. The policy goes on to say that it can use your address-book contact information “to facilitate social interactions through our Services and for other purposes,” a polite way of saying they can spam anybody in your email contact list.
Lax Views on Privacy
Uber already has a storied history of coming under fire for its lax views on privacy. Last November was a particularly bad month for Uber's public relations department. First, BuzzFeed reported that Uber executive Emil Michael floated the idea of handling any criticism of the company by digging up dirt on any journalists who dared criticize it.
When an editor from the website PandoDaily accused Uber of “sexism and misogyny” for apparently working with a French “escort service,” Michael suggested, among other things, that Uber's dirt-diggers could expose the editor by proving a very particular, specific (and presumably unflattering) claim about her personal life.
Such an attitude arguably sounds bad expressed by any company executive, but are especially damaging coming from a tech company like Uber which, by its very nature, has access to lots of information which customers might prefer to keep private — in Uber's case, its business model ensures that it knows where its customers live, what places they visit, and when. (Indeed, with such information, you could prove lots of particular and specific claims about various people's personal lives, no?)
Also last November, it came out that an Uber executive had used a program called “God View” to track a journalist's location and movements. Not that “God View” itself was breaking news by then; the previous month, Forbes magazine reported that Uber used “God View” as a form of entertainment at company launch parties, letting staffers enjoy watching real-time “God's eye” views of Uber passengers at that moment, including their identities, current locations and trip itineraries.
Then, a couple of days before Thanksgiving, Newsweek reported Uber's tendency to advertise its services by sending “ghost texts” – spammy messages allegedly sent from Uber drivers that urged their friends to sign up as well, except the drivers never sent their friends such messages, and didn't even know about them.
A host of complaints
EPIC's complaint (available as a .pdf here) lists all of these anti-Uber complaints and several more, and also quotes the proposed new privacy policy before spelling out some of its implications:
Uber’s Revised Business Practices Will Allow the Company to Routinely Track the Location of Internet Users Even When They are not Customers of Uber
Uber’s revised privacy policy creates several risks for American consumers. Uber will now collect the precise location of the user when the app is running in the foreground through traditional GPS location services. Uber will also collect precise location information if the app is operating in the background. On phones running iOS, this means that Uber may be able collect location data even after an app has been terminated by the user. … Further, given Uber’s statement that it will collect location data from a user’s device only “[i]f you permit it to,” a user would reasonably assume that the company does not track his or her location by other means. In fact, Uber may continue to “derive your approximate location from your IP address.”
EPIC's complaint does go on to note that Uber claims “it will allow users to opt-out of these features,” but says Uber's “change in business practices places an unreasonable burden on consumers and is not easy to exercise: while iOS users can later disable the contact syncing option by changing the contacts setting on their mobile devices, the Android platform does not provide any such setting. These statements could lead users to believe that that [sic] they can choose to not share location data with the company after downloading the app, which is not true.”
The 23-page complaint also points out that “prior to the emergence of Uber and similar services, American consumers could routinely hire taxis without any disclosure of personal information or tracking of their location.” EPIC asks the Federal Trade Commission to investigate Uber's business and data-collection practices; investigate Uber's “possible violation of the Telephone Consumer Protection Act”: “Halt” Uber's collection of contact list information and user location data unless it is required for actual provision of the service; and also investigate other companies engaged in similar practices.
But representatives for Uber say neither EPIC nor the FTC have any reason for complaint. Spokeswoman Jessica Santillo said that “We care deeply about the privacy of our riders and driver-partners. These updated statements don't reflect a shift in our practices, they more clearly lay out the data we collect today and how it is used to provide or improve our services.”
The Electronic Privacy Information Center (EPIC), a non-profit privacy rights group, has filed a complaint with the Federal Trade Commission asking that th...