Third-Party Advertising Data Sharing

What it is

Uber shares your name, contact information, account activity, and device identifiers with advertising partners including platforms like Google, Facebook, TikTok, and Snapchat, to deliver targeted advertising.

Why it matters (compliance & governance perspective)

This provision authorizes the sharing of identifiable user data including name, email, phone number, and behavioral data with a wide range of advertising technology companies, enabling cross-platform tracking and targeted advertising linked to your Uber account activity.

Consumer impact (what this means for users)

The notice authorizes Uber to share your name, email address, phone number, and account activity data with advertising and analytics partners for marketing purposes. This means your Uber usage patterns may be linked to your identity on third-party advertising platforms.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages the CCPA and CPRA definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights for California residents even if no monetary exchange occurs. Under GDPR, sharing personal data with advertising partners requires a valid legal basis, typically consent under ePrivacy Directive requirements for cookie-based tracking. The FTC Act's prohibition on unfair or deceptive practices is also relevant where the scope of advertising data sharing may not be adequately disclosed at point of collection. 2. GOVERNANCE EXPOSURE: High. The breadth of named advertising partners (including Google, Facebook, TikTok, Snapchat, and others identified in the CSP headers) combined with identifiable data categories including name, phone number, and email creates significant exposure under CCPA opt-out requirements and GDPR consent obligations for advertising purposes. 3. JURISDICTION FLAGS: California residents have a statutory right to opt out of the sharing of personal information for cross-context behavioral advertising under CPRA. EU/EEA users are entitled to withdraw consent for advertising-related processing. Brazil's LGPD requires a valid legal basis for sharing data with third-party advertisers. Jurisdictions with comprehensive state privacy laws including Virginia, Colorado, and Connecticut also provide opt-out rights for targeted advertising. 4. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with each named advertising partner should be assessed to confirm compliance with applicable data transfer mechanisms, particularly for EU-to-US data transfers following Schrems II and under the EU-US Data Privacy Framework. Procurement teams should evaluate whether advertising partner contracts include adequate data protection clauses. 5. COMPLIANCE CONSIDERATIONS: The opt-out mechanism for advertising data sharing should be audited for accessibility and effectiveness. Consent management platforms and cookie consent tools used by Uber should accurately reflect the full scope of advertising partner integrations. Data mapping should document all advertising SDK integrations and verify that each is captured in the notice.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Precise Location Data Collection medium
• Law Enforcement and Government Disclosure medium
• Biometric Data Collection high
• Employer Access via Uber for Business medium
• Regional Privacy Rights (GDPR and CCPA) medium
• Data Retention Policy low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.