Hackers stole 57 million Uber users' data -- names, emails, phone numbers, and 600,000 driver license numbers. Uber's Chief Security Officer Joe Sullivan paid the hackers $100,000 to delete the data and keep quiet. He disguised the ransom as a bug bounty reward. He made the hackers sign NDAs. He hid the breach from the FTC, which was already investigating Uber for a previous breach. In October 2022, Sullivan became the first C-suite executive in American history criminally convicted for covering up a data breach. Obstruction of justice. Misprision of felony. The security officer's job was to protect user data. Instead, he protected Uber's stock price. Uber built a tool called "God View." It showed every rider's real-time location on a map. Employees used it to stalk ex-partners. They used it to track celebrities. They used it to watch journalists. When BuzzFeed reporter Johana Bhuiyan visited Uber's office, an executive tracked her arrival using God View -- then told her about it. Another executive, Emil Michael, suggested spending $1 million to investigate journalists who criticized the company. At launch parties, Uber showed God View to guests as entertainment -- real people, tracked live, without consent, for fun. The FTC ordered 20 years of privacy audits. Uber had turned its riders into a surveillance screensaver.
What they claim: Uber's privacy policy states that user location data is accessed only for "legitimate business purposes" with "strict access controls."
What we found: Uber built an internal tool called "God View" that displayed the real-time location of every Uber rider on a map. Employees used it recreationally -- tracking ex-partners, monitoring celebrities, and watching journalists. BuzzFeed reporter Johana Bhuiyan was tracked arriving at Uber's office using God View by an Uber executive who then bragged about it. Executive Emil Michael suggested spending $1 million to hire opposition researchers to dig up dirt on journalists investigating the company. God View was demonstrated at Uber launch parties as entertainment -- showing attendees the live movements of real riders without their knowledge. The FTC settlement required Uber to submit to 20 years of privacy audits.
What they claim: Uber Eats states it collects location data "to connect you with nearby restaurants" and "facilitate deliveries."
What we found: The Uber Eats app shares Uber's ride-hailing location infrastructure, collecting precise GPS data continuously. Uber previously tracked rider location for five minutes after trip completion until backlash forced a change. The Uber driver app tracks driver location continuously during active hours. Uber settled with the FTC over deceptive location tracking practices. Location data flows across Uber's entire platform ecosystem -- rides, eats, freight -- creating a comprehensive movement profile. Uber's privacy policy permits using location data for "personalization, marketing, analytics, and fraud detection" beyond the stated delivery purpose.
What they claim: Uber Eats states it collects data "necessary to provide you with the Uber Eats service."
What we found: The Uber Eats app requests: precise location, camera, microphone, contacts, phone state, and storage access. Data collected through Uber Eats is shared across Uber's entire platform -- rides, freight, and advertising. Uber launched an advertising division that monetizes rider and eater behavior data, selling targeted ads to restaurants and retailers. The combined Uber ecosystem creates a profile covering: where you live, where you work, where you eat, what you eat, when you travel, how much you spend, and your daily movement patterns. This is the same platform where employees used "God View" to stalk people, the CSO was convicted of covering up a data breach, and 124,000 leaked documents showed the CEO called users of the platform "expendable."
What they claim: Uber Eats promotes the driver experience as "flexible work" where drivers "choose when, where, and how long" they work.
What we found: Uber Eats drivers are subject to algorithmic management that controls virtually every aspect of the delivery process. Surge pricing algorithms manipulate earnings in real-time. Declining orders reduces a driver's priority in the dispatch algorithm. Uber's "upfront pricing" system obscures how fares are calculated, reducing driver transparency about their own earnings. Drivers report sudden "deactivation" -- permanent account suspension -- with no warning, no explanation, and no meaningful appeal process. The Uber Files revealed CEO Travis Kalanick considered drivers "expendable." Uber spent over $200 million on California's Prop 22 (with DoorDash and Lyft) to ensure these "independent" workers couldn't access employment benefits.
What they claim: Uber states it is "committed to protecting the data of our users" and maintains "industry-leading security practices" with transparent incident disclosure.
What we found: In 2016, attackers stole personal data of 57 million Uber riders and drivers, including 600,000 driver license numbers. Chief Security Officer Joe Sullivan paid the hackers $100,000 through Uber's bug bounty program, disguising the ransom payment as a legitimate security reward. Sullivan directed the hackers to sign NDAs and delete the stolen data. He concealed the breach from the FTC, which was already investigating Uber for a previous breach. Sullivan was convicted of obstruction of justice and misprision of felony in October 2022 -- the first C-suite executive in history criminally convicted for covering up a data breach. He was sentenced to three years' probation. Uber paid $148 million to settle with all 50 US states.
What they claim: Uber positions itself as a technology platform that empowers drivers and riders while working constructively with regulators.
What we found: In July 2022, the International Consortium of Investigative Journalists published the "Uber Files" -- 124,000 leaked internal documents from 2013-2017. The documents revealed: Uber directly lobbied heads of state including Emmanuel Macron, Joe Biden, and Olaf Scholz to weaken taxi regulations. An internal "kill switch" allowed Uber to remotely cut off access to its systems during police raids on Uber offices, preventing law enforcement from accessing evidence. CEO Travis Kalanick texted that "violence guarantee[s] success" regarding driver protests against taxi regulation. Kalanick wrote that drivers were "expendable." Mark MacGann, Uber's former chief lobbyist for Europe, was the whistleblower. He told the BBC: "We sold people a lie."
What they claim: Uber frames its mandatory ID photo scan on every alcohol delivery as required by Australian law, and states that consumer law rights are preserved under its terms of use.
What we found: Australian Responsible Service of Alcohol law requires age verification only if the recipient appears under 25 — the same standard used in pubs and bottle shops. The Retail Drinks Code of Conduct (v4, February 2026) confirms this. Uber exceeds the legal standard in every dimension: the driver app photographs the customer's full government-issued licence on every delivery regardless of age, transmits the image to a US-based contractor who extracts name, date of birth, ID type, and expiry date, then stores the extracted data encrypted in the United States with no defined retention period — just "as long as needed." The name on the ID must match the order, so a partner or housemate cannot accept the delivery — a restriction absent from RSA law. There is no option for the driver to perform a visual check instead of a photo scan. Uber states: "If you are unable to present an approved evidence of age document, you should not order alcohol via the Uber Eats App." The law requires a glance at an ID. Uber requires a photograph, overseas data transfer, and indefinite storage — and frames it as compliance.
What they claim: Uber states it fosters a "diverse and inclusive workplace" and takes employee complaints seriously through established HR processes.
What we found: In February 2017, engineer Susan Fowler published a blog post describing systematic sexual harassment at Uber. Her manager propositioned her on her first day. When she reported it to HR, she was told the harasser was a "high performer" and it was "his first offense" -- but other women told Fowler they had reported the same person. HR's response: transfer Fowler or accept that her performance review would suffer. Fowler's blog triggered an investigation led by former US Attorney General Eric Holder. The investigation found 215 complaints including 47 for sexual harassment. Twenty employees were fired. CEO Travis Kalanick was forced to resign in June 2017. Board member Arianna Huffington told a press conference that "one woman" complaining didn't prove a pattern -- while sitting on a report documenting 215 complaints.