Uber Technologies, Inc. is a publicly traded (NYSE: UBER), Delaware-incorporated ride-hailing and delivery platform whose own privacy notices disclose extensive collection of location, device, usage, and payment data and sharing of that data with advertising, analytics, and business partners for personalized advertising. The company's regulatory record includes a 2017/2018 FTC settlement over a concealed 2016 breach affecting 57 million people and a 2024 Dutch DPA fine of €290 million for unsafeguarded EU-to-US data transfers, alongside two smaller prior Dutch DPA fines, indicating a recurring pattern of enforcement actions tied to data security and cross-border transfer practices.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2024-08-27]
On August 26, 2024, the Dutch Data Protection Authority announced a €290 million (about $324 million) fine against Uber for GDPR violations related to international data transfers, marking the third fine imposed on Uber by that regulator after prior fines of €600,000 in 2018 and €10 million in 2023.
In 2018, the FTC announced an expanded settlement with Uber after learning the company had failed to disclose a 2016 breach — discovered during the FTC's investigation of the 2014 incident — that exposed more than 25 million names and email addresses, 22 million names and phone numbers, and 600,000 driver's license numbers of U.S. drivers and riders.
Uber's privacy notice for drivers and delivery people states it collects and retains multiple categories of personal data collected during use of Uber's apps, with a retention table specifying how long each category is kept.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
The Dutch Data Protection Authority's investigation found that Uber collected sensitive categories of driver data from Europe including account details, taxi licenses, location data, photos, payment details, identity documents, and in some cases criminal and medical records.
As assessed by the privacy policy review site terms.law (Privacy Watchdog) in a review scoring Uber 28/100, the primary flagged concern was continuous location tracking even between rides.
Uber's 2019 privacy notice discloses that Uber Technologies, Inc. is the data controller in the United States while Uber B.V., based in Amsterdam, the Netherlands, serves as the data controller for users in the European Union, indicating a multi-entity corporate structure for data processing.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is the policy's history made available? — Yes, with revisions or a changelog.
Uber Technologies, Inc. discloses in SEC filings that it was incorporated as Ubercab, Inc. in Delaware in July 2010, renamed Uber Technologies, Inc. in February 2011, and is headquartered in San Francisco, California, with its common stock trading publicly on the NYSE.
Uber's privacy notice for drivers and delivery people discloses that Uber shares data — including advertising or device identifiers, hashed email address, approximate location, and ad interaction data — with advertising and marketing intermediaries such as Google and The Trade Desk.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
In 2018, the FTC announced an expanded settlement with Uber after learning the company had failed to disclose a 2016 breach — discovered during the FTC's investigation of the 2014 incident — that exposed more than 25 million names and email addresses, 22 million names and phone numbers, and 600,000 driver's license numbers of U.S. drivers and riders.
On August 26, 2024, the Dutch Data Protection Authority announced a €290 million (about $324 million) fine against Uber for GDPR violations related to international data transfers, marking the third fine imposed on Uber by that regulator after prior fines of €600,000 in 2018 and €10 million in 2023.
Uber's Apple App Store privacy label discloses that Purchases, Contact Info, Search History, Identifiers, Usage Data, and Other Data collected by the app may be used to track users across apps and websites owned by other companies.