Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that advertising-related data processing is conducted on the basis of legitimate interests, including the interests of third-party advertising partners, with reference to unspecified safeguards applied to protect privacy.
This analysis describes what Waze's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies legitimate interests, including those of third-party advertisers, as a legal basis for processing that supports the advertising model, which is a basis that requires a documented balancing test under GDPR and may be subject to user objection rights.
Interpretive note: The enforceability of legitimate interests as a basis for advertising-related processing varies by jurisdiction and is subject to ongoing regulatory guidance, particularly in the EU.
The updated policy now applies to users of any age by removing the prior 16+ requirement, but does not explicitly state whether parental consent is required for minors. The policy defines Personal Information more broadly to include location, route information, and data reasonably linked to you by Waze. The company removed documentation of the 'find friends' feature that previously collected phone numbers from device contacts, suggesting that feature is no longer active or has been redesigned. Privacy controls remain available through in-app settings where you can adjust which Personal Information Waze collects and how it is used.
View change record →The updated policy now explicitly discloses that Waze periodically collects all phone numbers stored on your device's contact book as part of the 'find friends' feature. According to the revised terms, these phone numbers are collected in a form that is initially anonymous to Waze and are used to help create a list of other Waze users you may know. The policy clarifies that names, addresses, and other contact information are not collected from your phone book, though such information may be saved locally on your device for local searches. Additionally, the updated terms now explicitly authorize connecting your Waze account to social network accounts and sharing profile information from those networks. You can control whether to use the 'find friends' feature and whether to connect social network accounts to your Waze account.
View change record →The updated policy removes explicit language describing how Waze collects phone numbers from device contact books and integrates social network accounts. Previously, the policy stated that Waze would 'periodically collect all of the phone numbers which are stored on your device's phone contacts book' and described how this information was used for the 'find friends' feature. The revised policy no longer includes these specific disclosures. This does not necessarily mean the practices have stopped, but it means the policy provides less transparency about what data Waze collects from your device and how it uses contact information. Users who relied on these detailed descriptions to understand Waze's data practices will find the updated policy less explicit on these points.
View change record →Under this clause, Waze processes user data for advertising purposes using a legitimate interests legal basis, which under GDPR entitles users to object to that processing by contacting Waze at privacy@waze.com. The policy also provides an opt-out for personalized ads through in-app Privacy Settings.
Cross-platform context
See how other platforms handle Legitimate Interests Processing Basis for Advertising and similar clauses.
Compare across platforms →Monitoring
Waze has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We process your information for our legitimate interests and those of third parties (such as partners including advertisers, in order to report use statistics) while applying appropriate safeguards that protect your privacy. This means that we process your information for things like: ... Providing advertising, which keeps many of our services freeExcerpt from Waze's Privacy Policy
1) REGULATORY LANDSCAPE: Reliance on legitimate interests as a processing basis for advertising engages GDPR Article 6(1)(f), which requires that the interests of the controller or third party be balanced against the fundamental rights and freedoms of the data subject. EU data protection authorities, including the Belgian DPA and the Irish DPC, have scrutinized legitimate interests as a basis for advertising processing. LGPD similarly requires that legitimate interests be documented and proportionate. The FTC evaluates whether data use for advertising is consistent with consumer expectations and disclosed practices. 2) GOVERNANCE EXPOSURE: Medium. The policy asserts legitimate interests as a processing basis for advertising without disclosing the results of a legitimate interests assessment or specifying what safeguards are applied. This documentation gap may create exposure under GDPR Article 13 transparency requirements and under accountability obligations. 3) JURISDICTION FLAGS: EU and UK users have the right to object to legitimate interests processing under GDPR Article 21, including for direct marketing and advertising purposes. Brazilian users have similar rights under LGPD. The enforceability of legitimate interests for advertising processing in the EU has been the subject of regulatory guidance that may constrain the scope of this claimed basis. 4) CONTRACT AND VENDOR IMPLICATIONS: Third-party advertisers and partners relying on Waze's legitimate interests assertion for their own data processing should evaluate whether that basis is independently documented and legally sustainable in their respective jurisdictions. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that a documented legitimate interests assessment exists covering advertising-related processing, that user objection mechanisms under GDPR Article 21 are operationally implemented, and that the safeguards referenced in the policy are specifically identified and documented.
This provision identifies legitimate interests, including those of third-party advertisers, as a legal basis for processing that supports the advertising model, which is a basis that requires a documented balancing test under GDPR and may be subject to user objection rights.
Under this clause, Waze processes user data for advertising purposes using a legitimate interests legal basis, which under GDPR entitles users to object to that processing by contacting Waze at privacy@waze.com. The policy also provides an opt-out for personalized ads through in-app Privacy Settings.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Waze.