A new report from the Electronic Frontier Foundation (EFF) raises an unsettling possibility about “sharing economy” firms like Airbnb and TaskRabbit: They may also excel at sharing your data with the government.
Since 2011, EFF, a civil liberties non-profit based in San Francisco, has issued an annual “Who Has Your Back?” assessment of what tech firms say they’ll do if they get a request from a law-enforcement or national security agency for customer data such as the contents of an e-mail message or a person’s location history.
Here’s what EFF wants to see from the companies:
• an insistence on a warrant before turning over that information
• disclosure of those requests to customers affected
• published guidelines documenting how it responds to law-enforcement inquiries
• “transparency reports” tallying those inquiries
• membership in the Digital Due Process Coalition, which advocates limits on government surveillance.
EFF often finds that companies are doing far less. And when you contemplate all the data scooped up about you by an e-mail service or a search engine—much less a firm that must check your background before its other customers will trust you to provide an errand, a ride, or a room—that should be alarming.
Six for six: Lyft and Uber
In this year’s report, EFF saved its warmest compliments for two companies that haven’t always been the most popular examples of app-driven peer-to-peer service: the ride-hailing firms Lyft and Uber.
Both have drawn criticism from regulators and would-be passengers (Uber more than Lyft) for things like not investigating the backgrounds of drivers closely enough. On Monday, the two shut down their Austin operations after voters there approved new regulations requiring them to fingerprint drivers as taxi operators already do.
But this study grades companies not on how much data they collect, but on how they respond when governments ask for it. On this score, EFF awarded all six possible gold stars to both companies, commending them “for taking steps to facilitate transparency and user privacy” and implementing “exemplary policies.”
If your regular use of Lyft or Uber might give a rich portrait of your travels around town, you can take comfort from the EFF’s approval. But don’t take too much comfort: Your wireless carrier knows even more of your whereabouts. In last year’s “Who Has Your Back?” report, AT&T (T) earned only one of five stars, and Verizon (VZ) two of five. To my frustration, EFF didn’t cover Sprint (S) or T-Mobile (TMUS).
Middle ground: Airbnb, FlipKey, Instacart
Two shared-housing services and a grocery-delivery service came also away with decent scores in this report.
FlipKey, a vacation-rental firm, qualified for second place, earning four of six stars. The two major shortfalls in EFF’s view: not publishing a transparency report or law-enforcement guidelines.
The lodging-rental service Airbnb (which I often use for business travel) and the grocery delivery platform Instacart each got three of six stars. Both had the same three shortfalls: no posted requirement for a warrant before it provides ongoing location data about users, no notification to them about government data demands, and no transparency report.
Rainey Reitman, the EFF’s activism director, pointed to Instacart in an e-mail as an example of a company learning from this inspection: “Instacart showed some interest in adopting stronger policies.”
Instacart’s general counsel Nikhil Shanbhag didn’t have specifics to offer in a phone call Friday and would only say, “We’re glad to work with organizations like EFF on improving policies.”
Zeroes: Getaround, Postmates, TaskRabbit, Turo, VRBO
Half of the companies profiled—including the car-sharing services Getaround and Turo, the delivery platform Postmates, the errands network TaskRabbit, and vacation-rental site VRBO—earned zero stars. TaskRabbit, Turo, and VRBO did not respond to EFF’s attempts to contact them “through two or more mediums.”
Postmates did not answer a query from Yahoo Finance either. Turo spokesman Steve Webb said the company will “fully cooperate with law enforcement for any legitimate purposes.”
A TaskRabbit spokesperson, however, said the company hadn’t seen any of EFF’s inquiries and had begun revising its policies months ago.
A VRBO spokesperson pointed to cases in Colorado and North Carolina in which its parent firm HomeAway (AWAY) refused to reveal customer data to state and local governments looking to collect lodging taxes.
Getaround head of community Meg Murray said, “We are definitely looking at their recommendations as we continue to refine our policies.”
(I should note that I had a chance to quiz Getaround founder Jessica Scorpio about things like transparency reports when she spoke on a sharing-economy panel I moderated at the Collision conference two weeks ago; I did not think to do so.)
So the situation may not be quite as bad as the EFF’s grades suggest. But the real ground for optimism here may be the record of the telecom, e-mail, search and social-networking firms ranked by “Who Has Your Back?” for its first five years. By last year (with the extra motivation of Edward Snowden’s disclosures of massive government surveillance), so many of them had notched four or five stars that EFF could turn its attention to another part of the tech economy.
Email Rob at email@example.com; follow him on Twitter at @robpegoraro.