Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy designates TaskRabbit, Inc., a US entity, as the sole data controller for all EEA, Swiss, and UK users' personal information, notwithstanding the existence of TaskRabbit Limited, TaskRabbit GmbH, and TaskRabbit Poland Sp. z o.o. as separate legal entities.
This analysis describes what TaskRabbit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that a US-domiciled entity is the data controller for EU and UK data subjects, which requires legally adequate transfer mechanisms for personal data flowing from the EEA or UK to the United States, and may require evaluation of local representative obligations under GDPR Article 27.
Interpretive note: The policy does not specify the transfer mechanism used for EEA and UK to US data flows, and it is unclear whether TaskRabbit's local European entities act as processors or joint controllers, creating interpretive uncertainty about the full scope of controller responsibilities.
The agreement designates TaskRabbit, Inc. in the United States as the data controller responsible for EEA, Swiss, and UK users' personal information, meaning data subject rights requests and regulatory accountability flow through the US entity. The adequacy of transfer mechanisms for personal data sent from the EU or UK to the US is not addressed in the policy text provided.
How other platforms handle this
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
TaskRabbit has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Controller. TaskRabbit, Inc. is the data controller for your Personal Information.Excerpt from TaskRabbit's Privacy Policy
(1) REGULATORY LANDSCAPE: Designation of a US entity as data controller for EEA users engages GDPR Chapter V transfer restrictions and the EU-US Data Privacy Framework adequacy decision. UK users are subject to UK GDPR transfer provisions and the UK-US Data Bridge. Enforcement authority rests with relevant EU member state supervisory authorities and the UK Information Commissioner's Office. GDPR Article 27 requires non-EU controllers processing EU data subjects' data to designate an EU representative in certain circumstances. (2) GOVERNANCE EXPOSURE: High. The policy does not identify the transfer mechanism used for personal data transferred from the EEA or UK to TaskRabbit, Inc. in the US, nor does it reference EU representative designation. This gap may constitute a compliance deficiency under GDPR Article 13 transparency requirements and GDPR Chapter V. (3) JURISDICTION FLAGS: All EEA member state residents and UK residents are directly affected. Swiss residents are subject to the Swiss Federal Act on Data Protection and the Swiss-US data transfer framework. The existence of TaskRabbit GmbH (Germany) and TaskRabbit Poland Sp. z o.o. as separate legal entities may create questions about whether those entities function as data processors, joint controllers, or separate controllers under local law. (4) VENDOR AND CONTRACT IMPLICATIONS: Organizations conducting vendor due diligence on TaskRabbit should request documentation of applicable Standard Contractual Clauses, EU-US Data Privacy Framework certification status, and UK IDTA documentation. The absence of this information in the public-facing policy creates a documentation gap. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether TaskRabbit, Inc. holds EU-US Data Privacy Framework certification and UK Data Bridge status, and whether an EU representative under GDPR Article 27 has been designated. Internal records should document the legal basis for cross-border transfers for each EEA and UK data subject category.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that a US-domiciled entity is the data controller for EU and UK data subjects, which requires legally adequate transfer mechanisms for personal data flowing from the EEA or UK to the United States, and may require evaluation of local representative obligations under GDPR Article 27.
The agreement designates TaskRabbit, Inc. in the United States as the data controller responsible for EEA, Swiss, and UK users' personal information, meaning data subject rights requests and regulatory accountability flow through the US entity. The adequacy of transfer mechanisms for personal data sent from the EU or UK to the US is not addressed in the policy text provided.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by TaskRabbit.