If you use the Waze Carpooling feature, the app may access your phone's contact list and collect detailed trip information including your exact pick-up and drop-off locations and any messages exchanged between you and your driver or rider.
This analysis describes what Waze's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes access to contact lists and collection of communications content as a condition of using the Carpooling feature, extending data collection beyond navigation use to include third-party personal data (your contacts) and interpersonal communications.
Interpretive note: The policy does not specify the legal basis under GDPR for processing personal data of contacts who are not Waze users, creating ambiguity about compliance with GDPR's lawful basis requirements for third-party data.
The updated policy now explicitly discloses that Waze periodically collects all phone numbers stored on your device's contact book as part of the 'find friends' feature. According to the revised term…
The updated policy removes explicit language describing how Waze collects phone numbers from device contact books and integrates social network accounts. Previously, the policy stated that Waze would…
The updated privacy policy now explicitly discloses that Waze periodically collects all phone numbers stored in your device's contact book as part of the 'find friends' feature. According to the poli…
Users who enable Carpooling consent to Waze accessing their contacts list (which contains information about people who may not themselves be Waze users) and collecting pick-up and drop-off addresses and driver-rider communications; users who do not use Carpooling are not subject to this provision.
Cross-platform context
See how other platforms handle Carpooling Feature Contact Data Access and similar clauses.
Compare across platforms →Monitoring
Waze has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you choose to use the Carpooling feature, we may access your contacts list to help you connect with other users. We may also collect information about your trips, including pick-up and drop-off locations, travel times, and communications between drivers and riders.— Excerpt from Waze's Waze Privacy Policy
1) REGULATORY LANDSCAPE: Access to a user's contact list involves processing personal data of third parties (the contacts) who have not provided consent to Waze, which raises GDPR compliance questions regarding lawful basis for processing data of non-users. Under CCPA/CPRA, contact list data may constitute personal information requiring disclosure. Communications content collected between drivers and riders may engage stored communications privacy considerations depending on jurisdiction. 2) GOVERNANCE EXPOSURE: Medium. The contacts access provision creates exposure regarding the processing of third-party personal data without direct consent from those individuals. GDPR's requirements for a lawful basis apply to all personal data processed, including that of non-users whose information appears in a consenting user's contact list. 3) JURISDICTION FLAGS: EU/EEA jurisdictions present heightened exposure due to GDPR requirements for lawful basis when processing third-party contact data. The policy does not specify what legal basis applies to contact data of non-users. Illinois users should note that while contact list data is not biometric, the state's consumer protection framework may be relevant if contact data is used for profiling. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations whose employees use Waze Carpooling for business travel should assess whether corporate contact data may be accessed and processed by Waze, particularly where employees have business contacts stored on personal devices. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the Carpooling feature's contact access is opt-in and gated by a specific permission request, and that users can revoke contact access without losing core navigation functionality. The legal basis for processing contact data of non-users should be identified and documented in GDPR compliance records.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes access to contact lists and collection of communications content as a condition of using the Carpooling feature, extending data collection beyond navigation use to include third-party personal data (your contacts) and interpersonal communications.
Users who enable Carpooling consent to Waze accessing their contacts list (which contains information about people who may not themselves be Waze users) and collecting pick-up and drop-off addresses and driver-rider communications; users who do not use Carpooling are not subject to this provision.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Waze.