Uber Will Start Serving You Targeted Ads Based On Where You Go

Uber is rolling out a targeted ad system that will let companies serve ads to people in the Uber app based on the specific places they have been, according to a report by the Wall Street Journal. The announcement raises serious privacy concerns given the Uber app hoovers location data, knows exactly the destination people travel to using its app, and its service is often used for trips when people cannot drive themselves such as to doctors offices, abortion clinics, religious or cultural centers, and a host of other potentially sensitive places.

“Uber never misses an opportunity to push the boundaries on how extractive and exploitative a company is allowed to be,” Chris Gilliard, Just Tech Fellow at the Social Science Research Council, told Motherboard. “Using the granular details gleaned from people’s travels as fodder for advertising poses a threat to anyone who doesn’t want the intimate details of where they worship, who they date or what medical conditions they have being sold to the highest bidder. This news reaffirms that Uber is a surveillance company masquerading as a transportation company.” 

In response to Motherboard questions, an Uber spokesperson said, “The information that Uber shares with such advertisers is limited to aggregated information or data necessary to assess the effectiveness of campaigns, e.g. the percentage of users who clicked on an ad, or the number of users who visit the retail locations of advertisers using our platform.” Users can opt out of “certain disclosures” in the company’s Privacy Center. The spokesperson added the company is “fully committed to protecting user and employee privacy and obeying applicable laws.” The company says it does not permit ad targeting based on specific medical keywords and said said its advertising targeting policy “specifically prohibits targeting based on sensitive destinations or categories like medical centers, reproductive health centers, spiritual centers, and sexual orientation.”

Privacy researchers have known for more than a decade that, generally, anonymized location data can easily be de-anonymized. Specifically, Uber has a long track record of privacy concerns dating back to the company’s infamous Travis Kalanick days. In the mid-2010s, the company took apparently little effort to protect sensitive user data including geolocation information, to the extent that virtually any employee and even potentially a job interviewee could view it.  In the company’s early days, it displayed a “God View” in its offices, showing the locations of specific users in front of company guests during a launch party. It later used that same tool to track journalists and celebrities. In 2016, Uber’s chief security officer, Joe Sullivan, paid hackers $100,000 to delete the data of 57 million customers it had stolen from the company, lied to authorities about it, and has since been convicted of two federal charges relating to the incident. 

Uber has spent much time and energy attempting to differentiate the company’s bro culture that celebrated and glorified how much personal geolocation data it collected under Kalanick with current CEO Dara Khosrowshahi's attempts to paint a more responsible, corporate image. But there are still obvious signs of vulnerability inherent in the collection of geolocation data for tens of millions of daily users, such as the September “total compromise” hack, although the company later said it found “no evidence that the incident involved access to sensitive user data (like trip history).” 

In its ever-present quest to plug the gap between the price people are willing to pay for taxi rides and the cost of providing an ever-present network of taxi drivers while taking a roughly 30 percent cut of each ride, it appears Uber will finally be leaning into ads to make up the difference. (For its part, Lyft also has an advertising arm, but these ads were served on rooftop screens and in-car tablets.) From a user perspective, one interpretation of the difference between the Kalanick era and the Khosrowshahi era is that the company doesn’t want to make that geolocation data more private, but wants to sell it to advertisers instead of giving it away to hackers.

This article is part of State of Surveillance, made possible with the support of a grant from Columbia University’s Ira A. Lipman Center for Journalism and Civil and Human Rights in conjunction with Arnold Ventures. The series will explore the development, deployment, and effects of surveillance and its intersection with race and civil rights.

Sign up for Motherboard’s daily newsletter for a regular dose of our original reporting, plus behind-the-scenes content about our biggest stories.

Update: This story has been updated with additional comment from Uber.