Uber revises privacy policy, asks for users' permission to track location when app is running in background and to access contacts
John Ribeiro / ITworld.com :
Context & Ripple Effects
In May 2015, Uber rewrote its privacy policy to ask riders for two new consents: location tracking while the app runs in the background and access to their phone contacts. It reads at first like boilerplate disclosure, but it set off a multi-year fight over how much ambient data a ride-hailing app may take.
The arc since then has been one of escalation and retreat: privacy group EPIC went straight to the FTC with an FTC complaint against the background-location update, EFF later demanded a rollback of Uber's five-minute post-ride location tracking, and by 2017 Apple's iOS 11 push for "when-in-use" authorization forced Uber into an "always on" opt-out and removal of the post-trip tracking feature.
First-order effects
- Users installing or updating the app now face explicit permission prompts for background location and contact access — declining them limits features but keeps Uber from harvesting that data by default.
- Uber gains a legal cover story: every data stream it collects is nominally user-consented, which matters the moment regulators or plaintiffs come knocking.
Second-order effects
- Privacy advocates shift tactics from policy criticism to regulator pressure, as EPIC's FTC complaint shows — turning Uber's own consent language into evidence in formal proceedings.
- Contact access creates a second-order data question beyond the rider themselves: pinging a friend's GPS for shared-destination features pulls non-users into Uber's data graph without their direct consent.
Third-order effects
- If the pattern holds, always-on mobile location collection becomes untenable not through legislation but through platform enforcement — Apple's "when-in-use" default effectively sets the industry's privacy floor, and apps built on ambient tracking have to retrofit opt-outs.
- Consent prompts become the battleground itself: whoever drafts the permission dialog and frames the choice controls how much data the ecosystem collects, making privacy UX a competitive discipline rather than a compliance chore.
The trend: Mobile location data practices are moving from silent background collection to explicitly negotiated, OS-enforced permissions — with regulators and platform vendors, not app makers, setting the boundary.