What Will Uber and Lyft Do When Cops Request a Free Ride?

Uber is in the midst of controversy following reports that a company executive suggested that Uber should dig up dirt on journalists and that a top executive and others improperly accessed user data, including location information. Millions of customers rely on services like Uber and Lyft to go to work, out for the evening, or even to the doctors’ office. As we already know, this data can easily be mined for inferences about your lifestyle and even when you’re getting lucky. That’s why, as journalists and users scrutinize Uber’s internal data practices, it is worth asking: How will Uber and Lyft react when law enforcement entities demand information about customers, including where they’ve been? We looked at each company’s privacy policy and their reassurances, well, aren’t very reassuring.

Apps like Uber and Lyft have access to a wide array of data on our smartphones, chief of which is the precise GPS location that each company uses to connect drivers and passengers. According to a recent Pew Internet poll, Americans consider location data to be among the most sensitive types of personal data. So it’s no surprise that law enforcement agencies sometimes want access to the data – in fact, we know from the largest cell carriers’ transparency reports that demands for location data are substantial and on the rise. So what are Uber and Lyft’s policies for location data?

The privacy policies for Uber and Lyft generally describe what the companies collect and what they share (by the way, we couldn’t find any privacy policy text on Lyft’s website – have they heard of California’s privacy policy law?). Both policies allow for the sharing of user information, including location, in response to legal demands. Nothing surprising there. Are the companies standing up for user location privacy by requiring a warrant before disclosing GPS data? Neither company says. Will Lyft or Uber tell you if they disclose your data to law enforcement? Uber says they might not, and Lyft doesn’t say. On top of that, neither company has released a transparency report explaining the quantity and type of government requests received. If you don’t feel comfortable with these ambiguities, deleting the apps may not bring the peace of mind you seek – Uber says they may hold onto your data.

Lyft and Uber are hardly the only way that location information and other sensitive data are collected from users today. That being said, with many users putting their lives in these services’ hands, there is a responsibility to clearly explain data practices, both internal and external, and to live up to them. As we've illustrated in our business primer, doing so isn't just good for privacy, it's good for business. That’s why as services like Uber and Lyft take steps to reassure consumers about internal data practices, they should clarify and explain the steps they take to ensure user data is secured from government access, too.

Matt Cagle is a Policy Fellow with the ACLU of Northern California’s Technology & Civil Liberties project.