Uber now says its ad partners may combine your data with other sources

The change

Uber's Cookie Notice (Global) explains how Uber and its partners use cookies, pixels, and similar tracking on Uber's websites, apps, emails, and ads. On September 26, 2026, Uber published a new version, replacing the one dated September 5, 2025. Venpo flagged the update the same day, and the redline is on the public change page.

The update goes in two directions at once. It says more about how ad data can be used and adds partners who may receive it, and it also gives users clearer controls and firmer promises.

What changed for ad data

• Combining data. The notice already said Uber may share "your pseudonymized email address, browser and cookie data and other data relating to your use of our Services" with ad partners. A new sentence follows it: "Our ad partners may combine this information with data they hold about you from other sources."

• More ad partners. Nine companies were added to the advertising list: Awin, Adgile, Atwave (formerly Blissmedia), CHANNEL99, Viant, OGURY, StackAdapt, InMarket, and ZipRecruiter. Three were removed: Hotjar, MNTN, and Mutiny. Twitter now appears as X.

• What the sharing may count as. Uber now says that "in some jurisdictions, this sharing may be considered a 'sale' or 'sharing' of personal data, or 'targeted advertising,' under applicable law," and points to the section with opt-out choices.

• Strictly necessary tracking. The tracking that "cannot be disabled" is now also used to "detect and prevent fraud and security threats." Uber and Tealium were already listed as the providers in this category.

• Independent controllers. The notice now says some third parties "act as independent controllers of the data they collect, and some may transfer unique user or device data outside the EEA and the UK."

• Social logins. If you are logged in to a social media account when you visit Uber's sites, "the social media service may be able to link your visit to your account with them."

What got better

Several changes favor users, and they are real improvements rather than wording:

• Consent first. "Where consent is required, non-essential Tracking Technologies are not placed unless and until you accept them." In the EEA, the UK, and Switzerland, personalized ads now expressly rely on consent rather than an opt-out.

• In-app choices. Depending on location, the Uber apps now offer their own tracking choices under Settings, Privacy, separate from the phone's own settings.

• Email tracking disclosed. Uber now says it uses pixels in marketing emails to see whether they are opened and which links are clicked, and that unsubscribing stops it.

• Notice of changes. Instead of asking users to check the page "from time to time," Uber now says that for material changes it "will notify you and, where required, ask for your consent again."

• A complete list. The old notice said its list of partners "may not be exhaustive." That phrase is gone, and Uber now calls the table "a current list" that it will update when partners change.

• Cookie lifetimes. Uber's own cookies "typically expire 12 months after they are set."

What stays the same

The analytics providers are unchanged: Google, Qualtrics, Fullstory, and Drift were all listed before. In the United States, you can still opt out of the "sale" or "sharing" of your data for personalized ads through Uber's opt-out page or with Global Privacy Control in your browser, and the privacy center setting for personalized ads is still there.

Why this matters

A cookie notice is where a company lists who else receives data about you, and the list of partners is the part that changes most. Here, the list grew by nine names, and the notice now says plainly that those partners can match what they get from Uber with what they already know about you. For most people that means ads that follow them further, built on a profile that did not start with Uber.

The same update also makes the controls easier to find and to trust, which is why reading only the headline change would miss half the story. Changes like this are easy to overlook because the page looks almost the same, as with Apple's new exception to its AI training promise or Klaviyo's DPA update, and keeping track of them is what monitoring vendor terms and policies is for.

Potential impact

For anyone who uses Uber, and for teams that use Uber for Business, the update raises four practical questions:

• Is personalized ad sharing turned on in your Uber privacy settings, and do you want it to be?

• Have you checked the new in-app choices under Settings, Privacy, which are separate from your phone's tracking settings?

• Does your browser send Global Privacy Control, so your opt-out applies automatically on Uber's sites?

• If your company pays for rides or meals through Uber, does your travel or privacy policy say anything about ad tracking on those accounts?

Partner lists that grow a few names at a time are among the vendor legal changes that are hardest to spot by eye.

How Venpo detected it

Venpo monitors Uber's legal pages as part of continuous vendor risk monitoring. On September 26, it flagged the new cookie notice and marked the new sentence on ad partners, the added and removed partners, and the new controls. The redline is on the Uber change page, and every monitored Uber document is listed on the Uber vendor profile.

Business outcome

Anyone tracking Uber knew on the day of the update which ad partners were added, what the new sentence on combining data says, and where the new controls are. That leaves time to review privacy settings and, for companies, to decide whether their policies cover it. The alternative is noticing only when the ads start to follow you further.

Key takeaway

Uber's new cookie notice adds nine ad partners and says they may combine your data with data from elsewhere, while also adding consent-first tracking, in-app controls, and a promise to notify you of material changes. When one update moves in both directions, automated monitoring is how you see both sides instead of only the headline.