Waze collects your GPS location, the routes you drive, and your speed while you use the app, subject to the permissions you grant on your device.
This analysis describes what Waze's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision defines the scope of data collection the service is authorized to perform operationally. It establishes that location and behavioral data collection occurs only upon affirmative user permission, making consent a prerequisite to this data practice.
Users' real-time location, speed, and driving routes are collected during app use; this data can reveal sensitive personal information about users' daily lives and movements.
How other platforms handle this
Uber collects precise or approximate location data from riders' and order recipients' mobile devices when the Uber app is running in the foreground (app open and on-screen) or background (app open but not on-screen) of their device. Uber collects this data from the time a ride or order is requested ...
We collect information about your precise or approximate location as determined through data such as your IP address, GPS, and other inputs from your device, with your permission where required. We may use this information to provide, personalize, and improve our services, and for safety purposes.
Device and Connection Information. Consistent with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as your device type, operating system information, browser info...
Monitoring
Waze has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When you use our Service, we collect information about your use of the Service, such as your location information (if you permit us to do so), information about the routes you take, your speed, and other information about how you use the Service.— Excerpt from Waze's Waze Terms of Use
1) REGULATORY LANDSCAPE: Precise geolocation data is classified as sensitive personal information under CCPA and CPRA, requiring opt-in consent for collection in California. Under GDPR, processing of location data requires a valid lawful basis, typically consent or legitimate interests with a balancing test. The ePrivacy Directive governs location data accessed via mobile networks. Relevant enforcement authorities include the California Privacy Protection Agency, EU data protection authorities, and the FTC. 2) GOVERNANCE EXPOSURE: High. Continuous collection of precise GPS coordinates and driving behavior creates significant data subject rights exposure, including access, deletion, and portability requests. The volume and sensitivity of location data also creates security breach risk under notification laws in all US states and GDPR Article 33. 3) JURISDICTION FLAGS: California deployments face heightened exposure under CPRA's sensitive personal information framework, which may require a dedicated opt-in mechanism for precise geolocation. EU and EEA deployments must confirm the lawful basis for location processing and whether it meets GDPR adequacy standards. Illinois users should note that driving behavior data, if combined with biometric identifiers, could engage BIPA, though this is a more remote risk. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise fleet deployments using Waze should assess whether employee location data collected via the app is subject to workplace privacy laws in applicable jurisdictions. Vendor agreements should address data retention periods and deletion obligations for location data. 5) COMPLIANCE CONSIDERATIONS: A consent mechanism audit should confirm that device-level location permissions are paired with adequate in-app disclosure of how location data is used, retained, and shared. Data mapping should categorize driving behavior and route history as sensitive personal information for CPRA compliance purposes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The provision defines the scope of data collection the service is authorized to perform operationally. It establishes that location and behavioral data collection occurs only upon affirmative user permission, making consent a prerequisite to this data practice.
Users' real-time location, speed, and driving routes are collected during app use; this data can reveal sensitive personal information about users' daily lives and movements.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Waze.