AL FRANKEN SI.

TF
MINNESOTA S-\-^W
2JJ r:>

Bnitcd /States Senate

WASHINGTON, DC 20510-2309

December 21,2016

Mr. Travis Kalanick

Chief Executive Officer
Uber Technologies, Inc.
145 5 Market Street
San Francisco, CA 94103

Dear Mr. Kalanick:

I am writing regarding Uber's latest iPhone app update, which has reduced users' ability
to cont-ol the company s access to their sensitive location information. While the stated
justifications for this update appear well-intentioned, I strongly believe that American consumers
deserve a meaningful opportunity to decide for themselves the fate of their personal data. At the
very least, consumers have a right to clear and comprehensive information about what data are
being collected about them, how the data are being treated, and with whom the data are being
shared. To achieve this necessary transparency, I urge you to amend Uber's privacy statement to
reflect the company's public assurances and justifications related to the most recent app update.

As part of a major app update in November, Uber eliminated iPhone users ability to limit
the app to access their location only "while using the app." Users are now forced to choose
between "always" allowing Uber to access their location - even when the app is in the
background and not being used - and never" allowing Uber to access their location, leaving
both drivers and riders with imprecise pick-up and drop-off information. Since the update was
launched, Uber has made numerous assurances that it will restrict its collection of users location
data to when a user is interacting with the app, when a user is on a trip, and for up to five minutes
after a driver has ended a trip. According to Uber, this increase in location data collection will
improve pick-ups and drop-offs, enhance safety, and prevent fraud - improvements that Uber
alleges are not feasible under the "while using the app" location tracking option.

Given that the ride-sharing experience is still rapidly evolving, Uber's latest update may
provide important consumer benefits. But renewed allegations regarding Uber employees' past
abuse of customer data underscore the continued need for consumers to be able to make
informed decisions about whether and with whom they share such sensitive information, and
they must be assured that, when the information is shared, it will receive the utmost protection.
To restore users' control over their location data, I urge you to consider implementing in-app
options that are distinct from operating system-level permissions. Better controls could not only
protect users' privacy, but encourage more engagement with Uber's services. However, at a
minimum, to improve clarity, I strongly recommend that you make the following changes to
Uber's privacy statement:

1. Collection of Location Information: Under "Information We Collect Through Your Use

of Our Services," Uber's privacy statement provides that, if permitted, Uber "may also
collect the precise location of [a user's] device when the app is running in the foreground

WWW.FRANKEN SENATE.GOV
 or background. This section should be updated to explicitly state that Uber collects
precise location information only when a user is interacting with the app, when a user is
on a trip, and for up to five minutes after a driver has ended a trip.

2. Use of Location Information: Under Use of Information, Uber s privacy statement

details how the company may use the information it collects about a user. This section
should be updated to reflect that post-trip location data is used only for the stated
justifications for the app update, including to improve pick-ups and drop-offs, enhance
safety, and prevent fraud.

3. Guide to Trip Related Location Data: Uber's privacy statement should include - where
relevant ~ the information provided on the website's Trip Related Location Data page,
including detailed information on how to disable location tracking, or provide a link to
the page to ensure users have an easily accessible and comprehensive understanding of
Uber's collection, treatment, and sharing of their location data.

4. User Notification; Under "Changes to the Statement, Uber s privacy statement provides
that it will notify users when the company makes significant changes to the way it treats
users' personal information or to the statement. To ensure users provide their meaningful
consent to any such changes, including those that are recommended here, Uber should
notify users through the app and through email.

I appreciate your ongoing willingness to engage with my office on issues of privacy,

security, and consumer protection. Thank you for your prompt attention to this important matter,
and please do not hesitate to contact me, or Leslie Hylton on my staff at (202) 224-5641.

Sincerely,

Al Franken
U.S. Senator