U.S. Senator Al Franken (D-Minnesota) has penned an open letter to Uber CEO Travis Kalanick asking the executive to provide more transparency around its recent changes to user location data collection. The letter contends that consumers should have more direct control over their personal data, but, failing that, they should at least be provided a full and clear understanding of how and when their data is being used in writing.
The letter is a direct response to a product update from November that changed location services permission options from “while using the app” to a simple binary of “always” or “never,” a change Uber says was necessitated because it wants to be able to collect location info not only during their trip, but for up to five minutes after a trip is completed, in order to help it improve its pickup and drop-off location identification, as well as improve safety and fraud prevention practices.
Ideally, Franken says Uber should implement in-app user controls over when and how data is shared, as a way of skirting the limitations of Apple’s system-level location service settings in iOS, which don’t allow much in the way of gradations beyond “on,” “off” and “on while using the app.”
Failing that, the Senator would like Uber to make some changes to its privacy statement, which he articulates in full in his letter and which I reproduce below in their entirety for reference:
- Collection of Location Information: Under “Information We Collect Through Your Use of Our Services,” Uber’s privacy statement provides that, if permitted, Uber “may also collect the precise location of [a user’s] device when the app is running in the foreground or background.” This section should be updated to explicitly state that Uber collects precise location information only when a user is interacting with the app, when a user is on a trip, and for up to five minutes after a driver has ended a trip.
- Use of Location Information: Under “Use of Information,” Uber’s privacy statement details how the company may use the information it collects about a user. This section should be updated to reflect that post-trip location data is used only for the stated justifications for the app update, including to improve pick-ups and drop-offs, enhance safety, and prevent fraud.
- Guide to Trip Related Location Data: Uber’s privacy statement should include — where relevant — the information provided on the website’s Trip Related Location Data page, including detailed information on how to disable location tracking, or provide a link to the page to ensure users have an easily accessible and comprehensive understanding of Uber’s collection, treatment, and sharing of their location data.
- User Notification: Under “Changes to the Statement,” Uber’s privacy statement provides that it will notify users when the company makes significant changes to the way it treats users’ personal information or to the statement. To ensure users provide their meaningful consent to any such changes, including those that are recommended here, Uber should notify users through the app and through email.
Franken’s letter overtly states that he’s taking Uber at its word when it suggests it made the changes because it’s seeking to improve the service for end-users, and the overall customer experience. But he’s also asking nicely for assurances of that in writing in Uber’s own user-facing policy, which is a way of holding it accountable to its stated justifications for the location data changes.