← Travel
C

Waze

Notable issues
Google · 🇺🇸 United States
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
App: com.waze
Manufacturer: Google

⚠️ The bottom line

You chose Waze instead of Google Maps. Maybe you wanted something different. Maybe you didn't trust Google with your location. Waze is Google. Has been since 2013, when Google paid $1.1 billion for it. Your Waze location data feeds Google's advertising system. Your commute, your route, your destination -- it all goes to the same company that built the Sensorvault database and handed location data to police 11,554 times in 2020. In 2023, Google merged Waze's engineering team into Google Maps. The app in your pocket still says Waze. The data goes to Google. Waze shows you as a cartoon avatar on the map. Cute. Researchers at UC Santa Barbara watched those avatars and tracked individual users. They figured out where people lived -- the avatar stops at the same place every night. They mapped daily commutes, work locations, shopping habits. All from watching cartoon icons on a public map. You can set yourself to "invisible." That hides you from other users. Waze and Google still track you. The cartoon disappears. The surveillance doesn't.

Legal jurisdiction
🇺🇸 United States (headquarters)
CLOUD Act read more →
US govt can demand your data from this company even if stored overseas
FISA §702 / PRISM read more →
NSA collects stored emails, photos, messages without individual warrants
Geofence warrants read more →
Police can demand location data for everyone near a crime scene
Spying
4/4 EXTREME
Is someone spying on me?
Data Sharing
3/4 HIGH
Who gets my data?
Security
2/4 MODERATE
Is it actually secure?
Honesty
1/4 LOW
Can I trust what they say?
REPLACE Extreme risk. Look for alternatives or lock down hard.
6Contradictions
1Critical
3High
2Medium
6Sources
Findings by concern
Spying 4/4 EXTREME 4 findings
⚠️ criticalmarketing claims vs network analysis
You chose Waze instead of Google Maps. Maybe you wanted something different. Maybe you didn't trust Google with your location. Waze is Google. Has been since 2013, when Google paid $1.1 billion for it. Your Waze location data feeds Google's advertising system. Your commute, your route, your destination -- it all goes to the same company that built the Sensorvault database and handed location data to police 11,554 times in 2020. In 2023, Google merged Waze's engineering team into Google Maps. The app in your pocket still says Waze. The data goes to Google.

What they claim: Waze markets itself as a "community-based" navigation app, distinct from Google Maps, with its own identity and user experience.

What we found: Waze was acquired by Google in 2013 for $1.1 billion. Waze user location data feeds into Google's broader advertising and data ecosystem. Waze's privacy policy permits sharing data with "affiliates" -- which means Alphabet/Google. In 2023, Google merged Waze's engineering team into Google Maps and laid off 65+ Waze employees, further dissolving the separation. Users who specifically chose Waze to avoid Google Maps were feeding the same corporate data pipeline. The real-time location data of 150 million Waze users -- their commutes, their routes, their destinations, their driving patterns -- flows to the same company that built Sensorvault and received 11,554 geofence warrants in a single year. Waze's independence is a brand identity, not a data architecture.

⚡ highpolicy claims vs third party research
Waze shows you as a cartoon avatar on the map. Cute. Researchers at UC Santa Barbara watched those avatars and tracked individual users. They figured out where people lived -- the avatar stops at the same place every night. They mapped daily commutes, work locations, shopping habits. All from watching cartoon icons on a public map. You can set yourself to "invisible." That hides you from other users. Waze and Google still track you. The cartoon disappears. The surveillance doesn't.

What they claim: Waze states its social features are designed to "build community" and help drivers share road information while maintaining user privacy.

What we found: University of California Santa Barbara researchers demonstrated they could track individual Waze users and determine their real identities through the app's social features. By monitoring the position of Waze avatars on the map over time, researchers reconstructed users' commute patterns, identified their home locations (where the avatar appeared each night), and mapped their daily routines. The research showed that Waze's social layer -- designed to show nearby drivers as cartoon avatars -- created a surveillance surface that could be exploited by anyone with patience. Even when users set their status to "invisible," the app continued collecting and transmitting location data to Waze/Google servers. The invisible mode hid you from other users but not from the company.

⚡ highmarketing claims vs third party research
Waze lets you report police locations. The NYPD demanded the feature be removed, calling it a threat to officer safety. But the feature works both ways: researchers showed that police reporting data could identify which users are monitoring police activity. The app that helps you avoid speed traps also reveals that you're avoiding speed traps. Meanwhile, Waze shares traffic data with city governments through its Connected Citizens Program. Waze is a surveillance tool that works in every direction -- users watching police, police watching users, cities watching everyone.

What they claim: Waze promotes its police-spotting feature as a community safety tool that helps drivers "stay informed about what's ahead on the road."

What we found: Waze's police-reporting feature created a two-way surveillance problem. In 2015, the NYPD and police unions demanded Waze remove the feature, calling it a threat to officer safety. NYPD Police Commissioner Bill Bratton called it "irresponsible." But the same feature also worked in reverse: researchers and law enforcement noted that Waze's data could be used to track which users reported police presence -- potentially identifying individuals who monitor police activity. The app that lets you spot police also lets police spot you. Meanwhile, Waze shares anonymized traffic data with municipalities through its Connected Citizens Program, giving city governments real-time information about driver movements. The app sits at the intersection of citizen surveillance and state surveillance, serving both while claiming to serve neither.

⚡ highmarketing claims vs app permissions
You type your destination into Waze. A fast-food chain buys an ad targeting drivers heading to your exit. A gas station buys an ad for drivers who've been driving long enough to need fuel. You stop at a red light and a full-screen ad takes over your phone. Waze calls these "zero-speed takeover ads." They know where you are, where you're going, and how long you've been driving. The app that gives you free directions sells your destination to the highest bidder. You're not the customer. You're the route.

What they claim: Waze describes itself as a free navigation tool that helps drivers "get the best route, every day, with real-time help from other drivers."

What we found: Waze runs location-based advertising including "zero-speed takeover ads" -- full-screen advertisements displayed when a driver is stopped in traffic or at a red light. Advertisers can target users based on their current location, their route, and their destination. A fast-food chain can buy ads shown to drivers approaching their exit. A gas station can target drivers whose fuel level (inferred from driving patterns) suggests they need to stop. Waze knows where you're going before you get there -- and sells that knowledge to advertisers who want to intercept you along the way. The navigation app that "helps you get there" also tells advertisers exactly where "there" is.

Data Sharing 3/4 HIGH 1 finding
⚫ mediumpolicy claims vs app permissions
Waze records every time you brake hard, accelerate fast, or drive above the speed limit. It logs what time you drive, how long you drive, and whether you deviate from suggested routes. Insurance companies want this data -- they've explored partnerships with driving data providers. Waze's terms allow sharing with "partners." Your free navigation app is building a driving profile that could one day determine your insurance premium. Every trip is an assessment. Every hard brake is a data point. The app that helps you avoid traffic may help insurers avoid you.

What they claim: Waze states it collects data "to provide and improve navigation services" and "enhance road safety."

What we found: Waze collects detailed driving behavior data: speed at every point in a journey, hard braking events, rapid acceleration, route deviations, time of day driving patterns, and overall driving style. The app's terms permit using this data for "improving services" and sharing with "partners." Insurance companies have explored partnerships with driving data providers to adjust premiums based on driving behavior. Waze's driving profile -- assembled from every trip -- could characterize a driver as aggressive, cautious, or risky. The data exists. The terms allow sharing. The insurance industry wants it. A navigation app that records every time you brake hard, speed up fast, or drive at 2 AM is building an insurance risk profile whether it calls it that or not.

Honesty 1/4 LOW 1 finding
⚫ mediummarketing claims vs third party research
In 2023, Google merged Waze's engineering team into Google Maps and laid off 65 employees. The people who build Waze now build Google Maps. Same team. Same codebase. Same data infrastructure. But Waze still has its own app icon, its own branding, and its own community of 150 million users who think they're using something different. The merger was announced. The brand wasn't retired. The illusion of choice survived the engineering reorganization.

What they claim: Waze continues to market itself as an independent, community-driven app with a distinct identity from Google Maps, emphasizing its unique social features and user-driven reporting.

What we found: In 2023, Google formally merged Waze's engineering team into Google Maps and laid off 65+ Waze employees. The merger dissolved the technical separation between the two products. Waze's data infrastructure is now managed by the same engineering organization that runs Google Maps. Despite this, Waze continues to operate as a separate app and brand, maintaining the appearance of independence while sharing engineering, data infrastructure, and corporate governance with Google Maps. Users who chose Waze specifically because it wasn't Google Maps now use an app whose engineering team literally is Google Maps. The brand survives. The independence doesn't.

What happened to real people
Documented incidents involving Google products and user data.
Jorge Molina jailed 6 days for murder via geofence warrant based on Google Sensorvault location data. Lost job, car, reputation. Charges never filed. [source]
PRISM participant since 2009. NSA collects stored communications. FBI conducts warrantless 'backdoor searches' of American data using names and email addresses. [source]
Google received 180 geofence warrants per week by 2019. Each warrant searches tens of millions of accounts. Supreme Court hearing constitutionality (Chatrie v. United States). [source]
What your data is worth to governments
Google complied with 235,000 government data requests in H1 2024. That's +530% over 10 years. Google has been a confirmed PRISM participant since 2009. Under this programme, the NSA collects stored communications. The company is legally prohibited from telling you. Jurisdiction: US (CLOUD Act, FISA Section 702, Patriot Act).
Documented: Jorge Molina jailed 6 days for murder via geofence warrant based on Google Sensorvault location data. Lost job, car, reputation. Charges never filed.
Documented: PRISM participant since 2009. NSA collects stored communications. FBI conducts warrantless 'backdoor searches' of American data using names and email addresses.
What is PRISM? · What is the CLOUD Act? · Transparency report
Sources