Sen. Al Franken (D-Minn.) has asked ride-hailing giant Uber to upgrade its privacy policy to make sure that sensitive location data is sufficiently protected.
Franken pointed to a recent app update in which users are no longer able to allow location info only when the app is being used and must now either choose between always allowing the app to track that info or never allowing it.
In a letter to Uber CEO Travis Kalanick, a copy of which was supplied by Franken's office, the senator said the update may provide consumer benefit, but should not come at the expense of privacy protections. "
Related: Sen. Franken Takes Aim at ‘Pokémon Go’
“While the stated justifications for this update appear well-intentioned, I strongly believe that American consumers deserve a meaningful opportunity to decide for themselves the fate of their personal data,” Franken wrote. “At the very least, consumers have a right to clear and comprehensive information about what data are being collected about them, how the data are being treated, and with whom the data are being shared. To achieve this necessary transparency, I urge you to amend Uber’s privacy statement to reflect the company’s public assurances and justifications related to the most recent app update.”
Franken suggests Uber needs to update its privacy statement as well per the following:
1. "Collection of Location Information: Under 'Information We Collect Through Your Use of Our Services,' Uber’s privacy statement provides that, if permitted, Uber 'may also collect the precise location of [a user’s] device when the app is running in the foreground or background.' This section should be updated to explicitly state that Uber collects precise location information only when a user is interacting with the app, when a user is on a trip, and for up to five minutes after a driver has ended a trip."
2. "Use of Location Information: Under 'Use of Information,' Uber’s privacy statement details how the company may use the information it collects about a user. This section should be updated to reflect that post-trip location data is used only for the stated justifications for the app update, including to improve pick-ups and drop-offs, enhance safety, and prevent fraud."
3. "Guide to Trip Related Location Data: Uber’s privacy statement should include – where relevant – the information provided on the website’s Trip Related Location Data page, including detailed information on how to disable location tracking, or provide a link to the page to ensure users have an easily accessible and comprehensive understanding of Uber’s collection, treatment, and sharing of their location data."
4. "User Notification: Under 'Changes to the Statement,' Uber’s privacy statement provides that it will notify users when the company makes significant changes to the way it treats users’ personal information or to the statement. To ensure users provide their meaningful consent to any such changes, including those that are recommended here, Uber should notify users through the app and through email."
Franken, ranking member on the Judiciary Committee's privacy subcommittee, has made protecting online user information, particularly location information, a key policy goal, including pushing Uber and competitor Lyft to protect location privacy and introducing legislation giving consumers more control.
