Does Uber's updated privacy policy mislead consumers? The Electronic Privacy Information Center thinks so. And the privacy rights group has asked the Federal Trade Commission to investigate.
In a complaint to be filed on Monday with the government's consumer watchdog, EPIC alleges that Uber's updated privacy rules — scheduled to go into effect in July — deceive consumers by granting the company the right to track users' precise location even when they are not actively using its service. EPIC argues that Uber has a history of abusing user location data, does not adequately protect its database of sensitive consumer information, and has not addressed concerns about its data practices raised by several members of Congress.
"There is a clear divide between Uber's representations as to their consumers' control over their personal information, and Uber's actual business practices," the complaint reads. "Consumers are led to believe that they retain control over their personal data, when in fact they do not."
EPIC alleges that Uber's revised privacy policy "will allow the company to routinely track the location of internet users even when they are not customers of Uber." Specifically, EPIC says Uber can monitor location data even when its app is running in the background, and that the company can approximate the location of users who've disabled GPS location services on their phones.
According to Uber's official privacy policy, if a user permits the Uber app to access location services, then the company may also collect location data when the app is on, or in the background. The policy states that IP addresses may also be used to approximate a user's location.
EPIC argues that these data practices run contrary to a user's privacy expectations. While Uber maintains that its privacy rules are based on individuals granting permission, EPIC believes the opt-out features place "an unreasonable burden on consumers." In addition, with Android platform users, EPIC asserts that users have no setting to disable syncing their phone's contacts with the Uber app. Referring to Uber's privacy policy, "These statements could lead users to believe that that they can choose to not share location data with the company after downloading the app, which is not true," states the complaint.
EPIC has asked the FTC to investigate under its authority to challenge unfair and deceptive practices.
A spokesperson for the FTC told BuzzFeed News, "FTC investigations are non-public and we do not confirm or deny the existence of any investigations. We welcome complaints from consumers and consumer groups and review them carefully."
Reached for comment, Uber dismissed EPIC's allegations with a terse statement: "There is no basis for this complaint. We care deeply about the privacy of our riders and driver-partners and have significantly streamlined our privacy statements in order to improve readability and transparency. These updated statements don't reflect a shift in our practices, they more clearly lay out the data we collect today and how it is used to provide or improve our services."
Uber's privacy policy update followed a company investigation into one of its executives who had tracked a BuzzFeed News reporter's ride without her permission. A BuzzFeed News report from November of last year also revealed that another Uber executive suggested that the company might smear journalists who wrote critically of Uber.