Guidelines for United States Law Enforcement

Requesting Emergency Assistance

Legal Process Overview

Service of Legal Process

Uber’s User Notice Policy

Guidelines for Requesting Information from Uber

Subpoenas / Court Orders / Search Warrants / Preservation Requests / Emergency Disclosure Requests / Witness Testimony Request

Information Available From Uber

Basic Subscriber Information / Vehicle Information / Billing Information / Trip Information / Location Information / Other Profile Information / Communications Information / Customer Service Records / Other Business Records / Other Uber Services

FAQs

Uber is committed to continually improving the safety of our platform and contributing to safety in the communities where we operate. Uber has a specialized team dedicated to working with law enforcement agencies around the world. The team includes the Public Safety Response Team (“PSRT”). This team reviews and responds to each law enforcement request Uber receives. PSRT has processes in place to assist law enforcement on a 24/7 basis, including emergency requests, through our public safety portal at https://publicsafety.uber.com.

Uber is also committed to the privacy of our user’s data. Uber stores and maintains user data as described in our Privacy Notice and Terms of Use and discloses user data to U.S. law enforcement in accordance with the Electronic Communications Privacy Act. We also disclose information subject to our Terms of Use and privacy notices.

Up-to-date information about Uber’s products and services are available in our Help Center and Newsroom.

This guide, and the accompanying FAQs, are not intended to provide legal advice. It also does not create any enforceable rights, and Uber reserves the right to update or change this guide without notice to law enforcement.

Requesting Emergency Assistance

The Portal may be used to transmit emergency disclosure requests to Uber pursuant to 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4). When submitting a request, law enforcement must accept the Portal Privacy Notice and certify that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency and that law enforcement is currently unable to obtain legal process.

Uber has processes in place to respond to emergency requests on a 24/7 basis. Uber may follow up with law enforcement upon receipt of an emergency disclosure request if information is missing from the request or if further clarification is needed. Accordingly, appropriate contact information should be provided so that Uber can follow up quickly.

For more information about emergency disclosure requests, see Section on Emergency Disclosures below.

Legal Process Overview

Uber discloses information to U.S. law enforcement in accordance with applicable law, its privacy notices, and its Terms and Use.

U.S. Law Enforcement

Uber will disclose account information to U.S. law enforcement where required by legal process issued pursuant to the Electronic Communications Privacy Act (“ECPA”) and other legal authorities. The ECPA prohibits Uber from disclosing certain categories of user data without legal process, such as a subpoena, court order, or search warrant. There are also certain exceptions to ECPA’s prohibition on sharing user data. For example, Uber may proactively disclose user data in emergencies (as described in the Section on Emergency disclosure requests).

Additional Uber Resources

Law enforcement should contact PSRT through the Public Safety Portal (“Portal”) at https://publicsafety.uber.com. The Portal provides the central point of contact for law enforcement to communicate with PSRT specialists when submitting preservation requests, legal process, or emergency disclosure requests. Law enforcement may also use the Portal to obtain status updates on submitted legal process or to ask questions.

This guide also contains a list of Frequently Asked Questions (“FAQ”) at the end.

Service of Legal Process

How to Serve Legal Process

Law enforcement should submit requests to Uber through the Portal. Instructions for creating an account are available here. Only law enforcement and government personnel authorized to obtain evidence in connection with official legal proceedings may use the Portal. Portal accounts should be created using an official law enforcement or government email account.

Identifying an Uber Account

When submitting legal process to Uber, law enforcement should identify the specific account(s) implicated by the request. When possible, law enforcement should provide a unique identifier(s) associated with the account(s), such as email address, phone number, and/or license plate number. Names alone often are not unique identifiers, nor are dates of birth (to the extent collected). Uber may also be able to identify accounts that are relevant to a law enforcement investigation by searching for information related to a specific trip. For such requests, information about that trip, such as user identification information named above, and a date, time, trip ID, or pick up or drop off location, should be provided.

Uber’s User Notice Policy

Uber will notify users of law enforcement requests for their data, except where notice is prohibited by the legal process itself, a lawful non-disclosure order (e.g., a court order under 18 U.S.C. § 2705(b)), or other applicable law, or for other circumstances that indicate non-disclosure within Uber’s discretion. For example, Uber may decide in its sole discretion not to disclose the existence of a law enforcement request, such as in emergency situations or situations involving harm to a minor.

In the absence of a basis for non-disclosure, Uber will proceed to notify the user of the request. Law enforcement should therefore take care to indicate any legal restrictions on disclosure in its submission of process through the Portal. Specifically, law enforcement should:

• indicate the absence of any objection to user notice;
• provide a lawful non-disclosure order; or
• identify another legal basis prohibiting user notice, such as language in the legal process itself or statutory language that prohibits user notice.

After expiration of a nondisclosure order or other basis for nondisclosure, Uber will provide notice to users regarding law enforcement requests for their data unless, in its sole discretion, Uber will withhold notice as noted above.

The notice that Uber typically provides to its users informs them that they have received a request from a law enforcement agency about their account and provides them with the name of the requesting agency. Users are also informed that Uber is required to respond to lawfully issued process.

If Uber receives a National Security Letter (NSL) that is subject to a non-disclosure obligation of indefinite duration, it will notify the government that it is requesting review of the non-disclosure requirement in accordance with the NSL statute. If the government notifies Uber that it is no longer subject to the non-disclosure obligation, Uber will notify the relevant user in accordance with the above.

Guidelines for Requesting Information From Uber

As described above, legal process should be submitted to Uber through the Portal (publicsafety.uber.com).

To be valid, legal process submitted to Uber must generally:

• be addressed to the Public Safety Response Team of Uber Technologies, Inc. (UTI), 1725 3rd Street, San Francisco, CA 94158;
• be issued by the appropriate authority;
• be signed by the appropriate authority, such as a judge. Legal process must be signed pursuant to local court rules, including by an electronic or telephonic signature;
• be dated;
• provide a date and time to return the responsive materials, if applicable; and
• specifically identify the targeted account and the type(s) of information within the account to be disclosed. See the Section on Identifying an Uber Account for information about identifying Uber accounts and Section on Information Available for additional information about user information available from Uber.

In addition, requests that do not have a valid legal basis, are overbroad, vague, or otherwise inappropriate will be rejected.

Subpoenas

Under ECPA, a subpoena may be used to compel the disclosure of “basic subscriber information,” as defined by 18 U.S.C. § 2703(c)(2). For additional information about the basic subscriber information Uber may produce, see the Section on Basic Subscriber Information.

There are three types of subpoenas that a governmental entity can use to compel disclosure of data from Uber: (1) an administrative subpoena authorized by a federal or state statute, (2) a federal or state grand jury subpoena, or (3) a federal or state trial subpoena.

Subpoenas must comply with the criteria specified above for legal process validity, including the requirement that they be issued by an executive branch agency or court with the power to issue such subpoenas. They must also be signed by a person authorized to sign subpoenas.

Court Orders

Under ECPA, a court order issued pursuant to 18 U.S.C. § 2703(d) (a “(d) Order”) may be used to compel the disclosure of all non-content records and other information related to a user account upon a showing of “specific and articulable facts” that “there are reasonable grounds to believe” that the “records or other information sought are relevant and material to an ongoing criminal investigation.” A (d) Order may also compel the disclosure of basic subscriber information. However, the contents of communications, such as messages between Uber’s drivers and riders, may not be disclosed in response to a (d) Order.

To be valid, a (d) Order must:

• be signed by a judge;
• be issued by a court of competent jurisdiction; and
• state that it was issued pursuant to § 2703(d) or include a finding based on “specific and articulable facts” showing that there are “reasonable grounds to believe that the records sought are “relevant and material to an ongoing criminal investigation.”

Search Warrants

Under ECPA, law enforcement may use a search warrant to compel the disclosure of content and non-content information. In other words, a search warrant can be used to acquire information available with a subpoena or a (d) Order and the contents of a user’s communications. Content is defined as “any information concerning the substance, purport, or meaning of [a] communication.” Content accordingly includes the body of text messages and other types of information that convey the substance of a communication. For additional information about the content information Uber may produce, see Section on Communications Information.

To be valid, a search warrant must:

• identify the person or property to be searched (i.e., Uber Technologies Inc.);
• identify any person or property to be seized (i.e., user account and records or content);
• state the warrant was issued upon a finding of probable cause;
• designate the judge to whom the warrant must be returned;
• be signed by a judge; and
• be served on Uber within 14 days of the date on which it was issued (for federal search warrants) or within the time frame specified for execution in the state from which the warrant was issued.

Preservation Requests

Under ECPA, law enforcement may seek the preservation of account records pursuant to 18 U.S.C. § 2703(f). Upon receipt of such a request, Uber will take steps to preserve any records or other information in its possession regarding the subject of the preservation request pending the issuance of legal process. A preservation is a one-time “snapshot” of the records or content in an Uber user’s account at the time we receive the preservation request; it is not an ongoing, real-time preservation of those records. Uber does not notify customers about requests to preserve their account information.

Uber will preserve any records or content in a user’s account for 90 days. Uber will extend that preservation an additional 90 days (for a total of 180 days), if requested to do so by law enforcement.

Preservation requests should be submitted to Uber using the Portal (lert.uber.com). They must be dated and must specifically identify the targeted account or trip (approximate pick up and/or drop off, date, time, etc,) and the type of information within the account to be preserved. See Section on Information Available From Uber and the Section on Frequently Asked Questions (FAQs) for additional information about identifying Uber accounts and the user data Uber may provide.

Emergency Disclosure Requests

Uber may voluntarily disclose user data, including content information, to a U.S. governmental entity if Uber has a good-faith belief that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of information related to the emergency. Law enforcement may obtain subscriber information or other records, including content information with an emergency disclosure request. The information disclosed must be limited to the amount necessary to specifically address the ongoing emergency.

To submit an emergency disclosure request, law enforcement must:

• certify that they are authorized by law to obtain the requested records;
• certify that the request is, in fact, related to an emergency involving danger of death or serious physical injury that requires disclosure without delay of information relating to that emergency;
• certify that law enforcement is unable to obtain legal process in time to respond to the emergency; and
• accept the Terms and Conditions; and
• if required by law, follow-up with legal process.

Emergency disclosure requests should be submitted to Uber using the Portal’s emergency submissions. Because of its commitment to safety on its platform, Uber has processes in place to respond to emergency requests on a 24/7 basis.

Witness Testimony Requests

Uber includes a Certificate of Authenticity with its productions, which generally eliminates the need for live testimony to authenticate records. Uber accepts service of subpoenas seeking witness testimony through its Portal. Uber may not be able to accommodate subpoenas for witness testimony served with fewer than 14 days advance notice.

Information Available From Uber

This section describes the general categories of user data that may be available from Uber. It is meant to provide a guide regarding some of the most commonly requested data types, and is not meant to be exhaustive. For additional information about Uber products, please see The Uber Product page.

Uber collects and maintains user data in accordance with its Privacy Statements and its Terms and Conditions. The data Uber collects and maintains may vary from account to account, such as when an Uber user deletes their account information. Accordingly, the types of data Uber provides in response to valid legal process may vary.

Basic Subscriber Information

“Basic subscriber information” is defined in 18 U.S.C. § 2703(c)(2). Basic subscriber information includes information provided by users during the creation of an Uber account and information submitted or collected at a later date.

Basic subscriber information maintained by Uber for riders and drivers may include:

• user profile information (i.e., name, email, phone number);
• usage information (i.e., date of account creation, and account status); and
• “means and source of payment” (see “Billing Information” below for more details).

Basic subscriber information may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request.

Device Information

Device information may be obtained from Uber with a (d) Order, search warrant, or pursuant to an emergency disclosure request.

Vehicle Information

Vehicle Information that Uber may provide includes:

• license plate data;
• make and model;
• vehicle insurance;
• vehicle registration; and
• vehicle identification number (VIN).

Vehicle information may be obtained with a (d) Order, search warrant, or pursuant to an emergency disclosure request.

Billing Information

Billing information includes “means and source of payment,” as specified in ECPA, as well as other billing information about user payment transactions on the App.

Means and source of payment information that Uber may provide includes:

• partial credit card (first six and last four of the credit card number) or bank account numbers (drivers and deliverers only);
• credit card expiration date;
• associated credit card zip code; and
• other payment instruments.

Because “means and source of payment” is considered basic subscriber information, it may be obtained with a subpoena, (d) Order, search warrant, or pursuant to an emergency disclosure request. “Means and source of payment” does not include information about payment transactions.

Other billing information that Uber may provide includes:

• information about particular transactions, like amount, date and time the transaction was made, and the payment instrument used.

This billing information may only be obtained with a (d) Order, search warrant, or pursuant to an emergency disclosure request.

Trip Information

When a trip ends, Uber automatically sends a trip receipt to the Rider. Trip information generally includes:

• a breakdown of the amounts charged to the rider for the trip;
• the pick-up and drop-off locations (latitude and longitude); and
• information about the rider(s) and the driver, including the name, and rating. Note that drivers and riders enter their names as seen in app, so they are not necessarily their given names or could be abbreviated (e.g. “Chris” for “Christopher”).

Trip information may be obtained with a (d) Order or search warrant, except by law enforcement in jurisdictions where a search warrant is required by law, such as California and Utah. Trip information may also be obtained pursuant to an emergency disclosure request.

Location Information

Uber may collect GPS location information from the mobile devices of its drivers and riders. A driver’s location information may be captured when the Uber app is running on the driver’s mobile device on or off trip as long as the driver is logged in to receive trips. Riders have the option in their device settings to opt out of the collection of their GPS information, and if they choose to do so, the rider’s GPS will not be captured.

Available GPS location information may be obtained with a search warrant or pursuant to an emergency disclosure request only.

Other User Profile Information

Other user profile information about the user that Uber may provide include:

• rating(s) (one to five stars);
• written feedback/comments; and
• profile photograph(s).

Such user profile information may be obtained with a (d) Order, search warrant, or pursuant to an emergency disclosure request.

Driver Profile Information

Uber may retain the following information about its driver:

• date of birth;
• vehicle information (as described above); and
• driver’s license number

Such driver-partner profile information may be obtained with a (d) Order, search warrant, or pursuant to an emergency disclosure request.

Communications Information

Uber may capture certain information about communications between its users on the Uber app, such as when a driver and rider use the app to communicate with each other. This may include non-content records associated with such communications, or in the case of text messages through the app, the contents of those communications.

Records of communications may include:

• to/from information; and
• date and time of the communication.

Records of communications may be obtained with a (d) Order, search warrant, or an emergency disclosure request.

Contents of communications may include messages sent between users on the app. Contents of communications may be obtained with a search warrant or pursuant to an emergency disclosure request only.

Customer Service Records

Customer service records Uber may retain include:

• recordings of customer support calls; and
• other customer support communications.

Such customer service records are Uber’s business records, and are not covered by ECPA. Accordingly, these records may be obtained with a subpoena.

Other Business Records

Other business records Uber may retain include:

• driver’s license copies.

Such business records are Uber’s business records, and are not covered by ECPA. Accordingly, these records may be obtained with a subpoena.

Information Associated with Other Uber Services

Uber may provide other categories of information about users of its other services. Below, some of these categories of information are listed alongside the minimum legal process required to obtain such information. All information listed below may also be obtained via submission of an emergency request.

Uber Eats:

• subpoena: basic subscriber information; restaurant information;
• (d) Order: contact information for the restaurant or owner; order history; and
• search warrant: contents of communications between users and Uber Eats deliverers.

Uber Freight:

• subpoena: call logs between Uber and carrier; texts between Uber and carrier;
• (d) Order: carrier contact information; load information (e.g., origin, destination, contents of shipment); and
• search warrant: GPS location information (unlike rideshare, drivers are not required to be logged in during a delivery; therefore, GPS data may or may not be available).

Frequently Asked Questions (FAQs)

Q: How do I send legal process to Uber?

A: Legal process, preservation requests, and/or emergency requests should be served through Uber’s Public Safety Portal. The Portal helps validate that a requestor is actually authorized to make the request, since they use their department, agency, or government email address to sign up for a Portal account. The Portal helps Uber collect the information it needs to process law enforcement requests as quickly as possible and offers helpful functionalities to law enforcement, such as the ability to monitor the status of their request(s) or to communicate with the PSRT.

Q: Do you notify users of legal process?

A: Yes. For information about Uber’s user notice policy, see Section on Uber's User Notice Policy

Q: What should law enforcement do with the records it obtains from Uber once the investigation or case is over?

A: Information obtained from Uber should be destroyed once the investigation or case has been completed.

Q: I sent in legal process, but I haven’t heard back from Uber. What should I do?

A: Uber’s Portal allows law enforcement to track the status of their request(s) and send follow-up questions. Uber receives thousands of requests each year and triages the requests it receives upon receipt. Uber makes every effort to respond to requests as quickly as possible.

Q: What is Uber’s policy for deactivating accounts? Does Uber deactivate accounts upon request? Will Uber keep an account open if requested?

A: Because of its commitment to safety on its platform, when Uber is made aware of an incident Uber may take actions up to and including deactivation of the individual from the platform. Please see the Uber Community Guidelines for Uber’s deactivation policies.

Q: Does Uber request reimbursement for the costs associated with responding to legal process?

A: At this time, Uber generally does not seek reimbursement for costs associated with responding to legal process, although it reserves the right to do so.

Q: Can Uber provide the password to a user’s account?

A: No, Uber does not have access to user passwords.