EPIC Files Complaint With FTC on Uber's New Privacy Policy
The Electronic Privacy Information Center filed a complaint against Uber with the FTC Monday about the company’s proposed changes to its privacy policy that are expected to take effect July 15. “In less than four weeks, Uber will claim the right to collect personal contact information and detailed location data of American consumers, even when they are not using the service,” EPIC's complaint said. “These changes ignore the FTC’s prior decisions, threaten the privacy rights and personal safety of American consumers, ignore past bad practices of the company involving the misuse of location data, pose a direct risk of consumer harm, and constitute an unfair and deceptive trade practice subject to investigation by the Federal Trade Commission."
Sign up for a free preview to unlock the rest of this article
If your job depends on informed compliance, you need International Trade Today. Delivered every business day and available any time online, only International Trade Today helps you stay current on the increasingly complex international trade regulatory environment.
“There is no basis for this complaint,” an Uber spokeswoman said in an email statement. “We care deeply about the privacy of our riders and driver-partners and have significantly streamlined our privacy statements in order to improve readability and transparency,” she said. “These updated statements don't reflect a shift in our practices, they more clearly lay out the data we collect today and how it is used to provide or improve our services.”
The FTC wouldn't say if it will pursue a complaint against Uber. “FTC investigations are non-public and we do not comment on an investigation or the existence of an investigation,” a spokesman said. “We welcome complaints from consumers and consumer groups and review them carefully." EPIC Consumer Privacy Project Director Julia Horwitz told us that the FTC has used Section 5 authority to investigate a number of data privacy and data misuse cases in the past 10-15 years, and said this complaint isn't that different from cases the FTC pursued in the past. Section 5 prohibits unfair or deceptive acts or practices.
Uber has more than 8 million users worldwide and is one of the largest transportation services in the U.S., the complaint said. Uber collects “detailed personal information, including email, password, name, mobile phone number, [ZIP] code, and credit card information; ‘usage information,’ such as browser and URL; and ‘device identifiers,’ such as IP address, GPS coordinates, and cookies,” on its customers. Uber says it may disclose sensitive personal information to third parties, the complaint said.
EPIC filed its complaint as soon as possible after Uber’s proposed privacy policy changes were announced May 28, Horwitz said. The delay between release of the proposed changes and the complaint is because EPIC researched how various apps and permissions work, but wanted to be sure to publicly respond to the changes before they take place on July 15, Horwitz said. She said the biggest concern for EPIC is that even if a user turns off the app, Uber will continue to collect information from a user’s cellular device and look through the contact list.
“Part of the problem is we don’t know what access to the contact list really means,” Horwitz said. The ambiguity of the privacy policy leaves open the possibility Uber may look through a users' contact information to garner more information about them or if Uber is trying to find new riders, she said. Either way, it’s not what consumers expect, Horwitz said.
Uber made the changes to its privacy policy per the recommendation of Hogan Lovells attorney Harriet Pearson, who focuses on cybersecurity and privacy, Uber said. Pearson had no immediate comment. The new privacy statements are about half the length they previously were, contain less legal jargon and are available in 23 languages so most users in the some 57 countries that Uber operates in can understand the changes, the company said. Uber stressed that the updated privacy policy statements don't reflect a shift in Uber practices, but lay out what kinds of data Uber currently collects and why, as well as other data Uber may collect in the future.
Uber currently accesses users’ contacts so a user can split a fare with a friend or send an estimated time of arrival to a friend or family member, the company said. Potential future uses of Uber's accessing contact information include users being able to send special offers to friends or family, the company said. Uber isn’t currently doing this, but if it decides to do so in the future, users will be in control and choose whether they want to share the data with Uber, the company said.
“Users are not truly in control of the data they disclose to Uber,” the complaint said. “Uber retains the ability to track users even if users choose not to share location data with Uber,” it said. “Android users cannot turn off contact sharing once they have used the app, and all users cannot turn off approximate location sharing after downloading the app,” it said. “There is a clear divide between Uber's representations as to their consumers' control over their personal information, and Uber’s actual business practices,” the complaint said. “Consumers are led to believe that they retain control over their personal data, when in fact they do not.”
Uber doesn't currently collect background data, but the company wants to collect that data to provide new features like faster loading time for app locations, Uber said. Background data won't be collected starting July 15, Uber said. Uber called EPIC’s allegations about IP tracking misleading, saying IP addresses are part of the traffic data all apps receive and that location information is crucial to its location-based service. Users can turn off location on their device and manually input their location, Uber said.