Illustration: Sarah Grillo/Axios
Uber is waging a battle against Los Angeles' transportation department over the city's new data-sharing requirements for scooter and bike rentals.
Why it matters: Uber is an unlikely champion of consumer privacy rights given its own missteps, but privacy experts say L.A.'s new standard could have a significant impact on urban transportation services, their users and what data cities can access.
Flashback: Last year, L.A.'s Department of Transportation introduced the "mobility data specification," or MDS, a data-sharing format it created that can be used by a city to collect and share information with companies operating services on its streets.
- For example, MDS lets a city collect vehicle data from scooter and bike companies, while also sending them information like off-limit areas or street closures. The data can also help cities monitor traffic patterns and assess street needs.
- A number of other cities, like Austin and D.C., have since adopted the open-sourced standard.
What they're saying: "In terms of the data required to fulfill [LADOT's] vision, it seems like a lot of data… and we don't quite understand what the city wants to accomplish," Uttara Sivaram, Uber's head of global privacy and security policy, tells Axios.
- Uber also argues that L.A.'s standard violates California's Electronic Communications Privacy Act (CalECPA) by making location data sharing a requirement for an operating permit.
- The California Legislative Counsel agreed with that argument in a non-binding opinion. LADOT disagrees, arguing that the law is aimed at law enforcement agencies, not regulators.
Uber has ramped up its pushback, specifically taking issue with the requirement to share real-time scooter trip data.
- In August, Uber and Lyft (which also operates a fleet of scooters in L.A.) and sent a letter to California's attorney general, asking that his office take action to enforce CalECPA, but the companies have yet to hear back. The AG's office did not respond to a request for comment from Axios.
- Uber general counsel Tony West also met with LADOT's general manager Seleta Reynolds in March, which resulted in the agency agreeing to a 24-hour delay in trip data being shared. However, Uber still has to send over location data for a trip's starting and ending point within five seconds, which it says is just as sensitive.
Between the lines: "Just looking at scooter data is too short sighted — this is a model for getting access to data for other transportation," Electronic Frontier Foundation staff attorney Jamie Williams told Axios earlier this year.
- Scooters tend to be confined to certain areas in a city and riders usually walk a few feet to a few blocks to pick up the nearest one. And some experts say the GPS trackers aren't all that accurate, so it doesn't provide a very full picture of users' travel behavior.
- But ride-hailing is a much more intimate transportation mode — passengers take it from their homes to work, to medical facilities, and so on. (Cities currently do not have legal authority to monitor ride-hailing trips.)
- "With only a couple of points, you can learn a lot about people," said Kelsey Finch, senior policy counsel at Future of Privacy Forum.
Yes, but: Uber faces an uphill battle to prove the merits of its concerns given its bumpy history with customer privacy, which includes settlements last year with the FTC and all 50 states over not disclosing a 2016 data breach.
- In 2014, it was revealed that the company had a tool named "God view" that allowed employees to look up any passenger's rides in real-time. Uber ultimately settled with New York's attorney general and agreed to change its practices.
- Last month, London declined to renew Uber's permit because gaps in its system had allowed a number of drivers to upload photos to others’ accounts or create new accounts after being suspended.
- Between 2016 and 2017, Uber rolled out an option to track passengers' locations for up to five minutes after their rides, a controversial practice it ended after heavy criticism. The company says it never actually collected data this way.
Uber also has a long history of not playing nice with cities seeking to regulate its services, like eschewing taxi rules in its earliest days and getting California's utilities regulator in 2013 to enshrine its services at the state level, curtailing cities' power to regulate them.
- In 2016, it fought back when Austin when passed new rules requiring fingerprinting for drivers. Uber and Lyft suspended operations there for a year in protest.
- That prior year, it very publicly pushed back against New York City's attempt to cap the number of vehicles on the roads, even enlisting celebrities like Ashton Kutcher, and Uber investor, to express support.
Where things stand: In October, LADOT revoked Uber’s operating permit after the company said it would not comply with the real-time trip data sharing requirement.
- Uber had threatened to file for a temporary restraining order and is currently appealing the agency's decision.
- Uber is also among the companies that have joined a new consortium led by SAE International, an engineering standards organization, focused on figuring out how best collect and manage bike and scooter data.
- Meanwhile, all other scooter and bike rental companies have complied with LA's requirements.
The big picture: Uber has ambitions to become the go-to transportation tool, even beginning to add public transit and other options into its app. so it's not surprising that it's pushing back on government moves that could throttle or compete with it.
Clarification: This story has been updated to reflect that Uber did not actually collect passengers' location data after their rides, despite rolling out an option in the app to do so.