DiDi is a Chinese ride-hailing app operated by DiDi Global Inc., whose ADSs were forced off the NYSE in June 2022 and now trade over-the-counter as "DIDIY" following a Cyberspace Administration of China (CAC) cybersecurity review that found DiDi's apps violated PRC data-protection law; the review ended with an RMB8.026 billion (~US$1.2 billion) administrative fine, one of the largest data-related penalties on record. DiDi's own Chile passenger privacy policy discloses continuous foreground/background location collection via IP address, GPS, and other device sensors, third-party SDKs (AppsFlyer for advertising/marketing analytics, Google/Waze for mapping), and routine international transfer of personal information to service providers in the United States and China "even when they do not provide the same level of protection" as the user's home jurisdiction. Apple's App Store privacy label for the DiDi app corroborates cross-app tracking via device/user identifiers and third-party advertising analytics. Corporate ownership is traceable through DiDi Global's SEC filings, which disclose a variable-interest-entity (VIE) structure and named founder equity stakes, but the VIE structure and OTC delisting reduce the transparency a normal exchange listing would provide. No DiDi-specific data breach beyond the CAC enforcement action was found in this research pass.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
COLLECTION
DiDi's Chile passenger privacy policy states that DiDi processes the user's location data whenever the app is running in the foreground or background of the user's mobile device, obtaining location through IP address, GPS, and other sensors that provide relevant information such as nearby devices, Wi-Fi access points, and base station data.
DiDi Global Inc.'s FY2022 Form 20-F, filed with the SEC, includes a corporate-structure diagram showing the company's principal subsidiaries and the principal variable interest entity (VIE), Xiaoju Technology, with named founder/executive equity percentages disclosed for the individuals holding that VIE's equity interests.
DiDi's privacy policy states it shares user Personal Information with its service providers and 'Collaborator' business partners so they can carry out DiDi's business operations, and separately states DiDi may transfer Personal Information to service providers and partners located outside the user's home jurisdiction, including the United States and China, even when those countries do not provide the same level of protection for personal data.
DiDi Global's FY2022 Form 20-F discloses that the Cyberspace Administration of China opened a cybersecurity review in July 2021 requiring DiDi to suspend new user registration, found that 26 of DiDi's China apps violated PRC law in collecting personal information and had them removed from app stores, and that the review concluded with an administrative fine of RMB8.026 billion (US$1.2 billion) for violating the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, paid in 2022; the same filing confirms DiDi's ADSs were delisted from the NYSE on June 13, 2022 and have since traded over-the-counter as "DIDIY."
Apple's App Privacy label for the DiDi app (developer: DiDi Chuxing (Beijing) Network Platform Technology Co., Ltd.) discloses that Identifiers are used to track the user across apps and websites owned by other companies, and that data including precise/coarse location, phone number, identifiers, and product interaction is collected and linked to the user's identity for Analytics and Third-Party Advertising purposes.
The same policy discloses two named third-party SDKs embedded in the app: one that collects location information for Google- and Waze-related mapping/logging functions, and another that collects device identification information for marketing analysis and advertising statistics tied to AppsFlyer.