Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Uber shares user data with third-party advertising platforms for targeted advertising, receives data about users from third-party marketing partners, and combines externally sourced data with Uber-collected data to personalize marketing and advertising across platforms including social media.
This analysis describes what Uber's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a cross-context behavioral advertising framework that involves both outbound data sharing with advertising partners and inbound receipt of third-party marketing data, creating a data combination practice that is subject to CCPA opt-out rights and GDPR consent or legitimate interest documentation obligations.
Interpretive note: The policy does not name specific third-party marketing data sources, so the full scope of data combination practices cannot be assessed from the document text alone.
Under this clause, Uber may share user identifiers and behavioral data with third-party advertising platforms such as social media networks and receive data from marketing partners to enrich user profiles for targeted advertising. California residents can exercise opt-out rights under the CCPA by submitting a Do Not Sell or Share request through Uber's privacy portal.
How other platforms handle this
The right to know with whom we have shared your Personal Data, for what purposes, and what Personal Data has been shared (including whether Personal Data was disclosed to third parties for their own direct marketing purposes)
If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Uber has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Uber uses the data it collects for various purposes, including to provide, personalize, maintain, and improve our products and services, to carry out research and development, to enable communications between users, to send marketing and non-marketing communications to users, to personalize and improve our marketing communications to users and provide marketing across platforms such as social media, to provide advertising to users on third party platforms, and to analyze and improve our services. We also receive information about you from third parties, such as marketing partners and other sources, and we may combine such information with information we collect from or about you.Excerpt from Uber's Privacy Notice
1. REGULATORY LANDSCAPE: This provision implicates the CCPA and CPRA definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights regardless of monetary consideration. GDPR requires a documented lawful basis for processing personal data for marketing purposes; reliance on legitimate interests requires a balancing test, while consent-based processing requires freely given, specific, and informed consent. The FTC Act's prohibition on unfair or deceptive practices applies to the accuracy and completeness of disclosures about third-party data combination practices. 2. GOVERNANCE EXPOSURE: Medium. The combination of first-party Uber data with third-party marketing partner data creates enriched user profiles whose scope may not be fully apparent to users from the policy text alone. Under CPRA, this practice likely constitutes 'sharing' triggering opt-out infrastructure requirements. The policy's reference to third-party sources without naming them creates disclosure adequacy questions under CCPA's categories of sources requirement. 3. JURISDICTION FLAGS: California residents have the strongest statutory opt-out rights under CPRA for this provision. EU and UK residents are protected by GDPR consent or legitimate interest requirements. Colorado, Virginia, Connecticut, and other states with comprehensive privacy laws impose analogous opt-out rights for targeted advertising. 4. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising and marketing partners should be reviewed to confirm they include appropriate contractual restrictions on secondary use, data security obligations, and representations regarding the lawfulness of inbound data shared with Uber. Service provider versus third-party classification under CCPA affects whether data transfers require opt-out mechanisms. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the Global Privacy Control signal response infrastructure to confirm Uber's systems honor opt-out signals from California and other jurisdictions where required. Records of data-sharing relationships with advertising partners should be maintained to support CCPA categories of third parties disclosure obligations. Consent management platform configurations should be reviewed to ensure EU and UK advertising consent is captured prior to data combination.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes a cross-context behavioral advertising framework that involves both outbound data sharing with advertising partners and inbound receipt of third-party marketing data, creating a data combination practice that is subject to CCPA opt-out rights and GDPR consent or legitimate interest documentation obligations.
Under this clause, Uber may share user identifiers and behavioral data with third-party advertising platforms such as social media networks and receive data from marketing partners to enrich user profiles for targeted advertising. California residents can exercise opt-out rights under the CCPA by submitting a Do Not Sell or Share request through Uber's privacy portal.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Uber.