Uber Left Code on Users' Phones Even After They Deleted the App

Uber has not had a great 2017 so far. In a year that’s seen numerous hits against the ride-sharing company, Sunday brought another massive blow to Uber’s credibility and trustworthiness: In a profile of CEO Travis Kalanick in The New York Times, Mike Isaac reports that Uber left “fingerprints” without users’ knowledge — an identifying code that remained even after they’d deleted the app or wiped their phone. In a previously unreported 2015 meeting with Kalanick, Apple CEO Tim Cook threatened to pull Uber from the App Store if it didn’t stop violating Apple’s privacy guidelines with the code. This would have essentially killed Uber’s earning potential, so Kalanick agreed.

This revelation is just one more link in a seemingly endless chain of bad PR for the ride-sharing company.

In January, Uber paid $20 million to settle a driver exploitation lawsuit. Less than two weeks later, users pushed each other to #DeleteUber in response to what many saw as Uber undermining protests against President Donald Trump’s Muslim travel ban. February brought a video of Kalanick arguing with an Uber driver over the company’s rising standards and dropping prices. In March the company admitted to using “Greyball” software to avoid cops, including in cities where the company was not allowed to be operating.

To say that this most recent revelation couldn’t come at a worse time for Uber would suggest that there could have ever been a good time. In Isaac’s profile of Kalanick in The Times, the reader gets the distinct impression that these smudges on Uber’s public images are features, not bugs:

In a quest to build Uber into the world’s dominant ride-hailing entity, Mr. Kalanick has openly disregarded many rules and norms, backing down only when caught or cornered. He has flouted transportation and safety regulations, bucked against entrenched competitors and capitalized on legal loopholes and gray areas to gain a business advantage. In the process, Mr. Kalanick has helped create a new transportation industry, with Uber spreading to more than 70 countries and gaining a valuation of nearly $70 billion.

In interviews with Kalanick’s associates, as well as Uber employees and investors, Isaac revealed a pattern: While Kalanick’s arrogance has made Uber the behemoth of a company that it is, it also threatens to destroy the very thing he’s built.

“Travis’s biggest strength is that he will run through a wall to accomplish his goals,” Mark Cuban tells The Times. “Travis’s biggest weakness is that he will run through a wall to accomplish his goals.”

In response to this article, an Uber spokesperson offered Inverse this response:

We absolutely do not track individual users or their location if they’ve deleted the app. As the New York Times story notes towards the very end, this is a typical way to prevent fraudsters from loading Uber onto a stolen phone, putting in a stolen credit card, taking an expensive ride and then wiping the phone—over and over again. Similar techniques are also used for detecting and blocking suspicious logins to protect our users’ accounts. Being able to recognize known bad actors when they try to get back onto our network is an important security measure for both Uber and our users.

So while this does indeed seem to be a common way to prevent fraud, and Uber’s intent behind the tracking code may truly have been to protect users from fraud, the fact remains that it violates Apple’s privacy agreement. Isaac reports that Uber intentionally hid the fingerprint code from Apple with what’s known as a “geofence,” which kept anyone at Apple headquarters from being able to see the code in question.

Kalanick admitted that he needed help after the incident with the Uber driver, so we’ll see what fallout comes from these latest revelations about the Uber CEO.

Correction 4/23/17: In the original version of this article, it was stated that Uber tracked users even after the app was deleted. The article has been edited to reflect the fact that, even though Uber did leave code that remained when users deleted the app, the company did not track users’ whereabouts. The article has also been updated to contain a response from Uber.