User:Louis/SpotHero privacy policy changes after Uber purchase

Parking app SpotHero's privacy policy, dated November 9, 2026, adds Uber Technologies, Inc., which bought SpotHero for $617 million in cash in April 2026, to the affiliates SpotHero shares users' personal information with. Users pay SpotHero fees to reserve off-street parking, SpotHero shares their personal information with Uber under the new policy, & Canadian residents may ask SpotHero "to opt out of the use or sharing of your Personal Information".

The new text also says SpotHero may receive some of the license plate information that certain Licensors, the owners, lessors, managers or operators of parking spots, may collect, & that the use of certain cookies "may constitute a 'sale'" under applicable privacy laws. Both versions give people with "country or state-specific rights to opt-out" of processing for the advertising the policy describes a "Do Not Sell or Share My Personal Information" button in the site footer.

Policy dates and Wayback Machine copies

SpotHero's privacy policy, titled "Privacy Policy - United States and Canada", opens with the line "Last Updated: November 9, 2026". Its closing section, headed "Effective Date", says: "This Privacy Policy was last modified as of the effective date printed above."

As of October 25, 2026, the Wayback Machine, a web archive, showed the earlier version of the page, which opens "Last Updated: June 16, 2025". As of November 11, 2026, its copy shows the version dated November 9, 2026.

The section of the November 9, 2026 version headed "Modifications to this Privacy Policy" reads in full:

We may modify this Privacy Policy from time to time in our sole discretion without prior notice to you. The most current version of the Privacy Policy will govern our collection, use, and disclosure of information about you. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically reviewing this Privacy Policy for changes. We will indicate at the top of the Privacy Policy when it was most recently updated. Accordingly, please refer to this Privacy Policy frequently as it may change. If we make material changes to the Privacy Policy which lessen your rights, we will notify you by email and/or by posting a notice through the Site and/or Apps prior to or on the effective date of the changes. By continuing to access or use the Site or Marketing Services after those changes become effective you agree to the terms of the revised Privacy Policy.

Changes from the June 2025 policy

SpotHero's policy calls the people & companies that own or run the parking it lists "Licensors", defined as "owners, lessors, managers or operators of Parking Spots". The November 9, 2026 version names Uber Technologies, Inc. as SpotHero's parent in its opening definition of "SpotHero" and again in the clause on sharing with affiliates, which links to a privacy notice on Uber's website for "your privacy choices associated with their use of your personal information". Both versions say SpotHero requires its affiliates "to honor this Privacy Policy as well".

Clause	June 16, 2025 version	November 9, 2026 version
Date lines	"Last Updated: June 16, 2025" & "Last Reviewed: June 16, 2025".	"Last Updated: November 9, 2026", with no "Last Reviewed" line.
Opening definition	"SpotHero, Inc., its subsidiaries, related companies, and/or affiliates".	The same words, followed by "(including our parent company, Uber Technologies, Inc.)".
Sharing with affiliates	Headed "With our Affiliates." and covering "our affiliates, subsidiaries, and other companies under common control".	Headed "With our Parent Company and Affiliates." and covering "our affiliates (including our parent company, Uber Technologies, Inc.)", "subsidiaries, and other companies under common control".
Vehicle information	Account information includes "license plate information and make/model/year of a vehicle".	Adds that "Certain Licensors may also collect license plate information", including through "automated license plate recognition (ALPR) technology", and that SpotHero "may receive some of this information from Licensors".
Sharing with Licensors	"we share your Personal Information with Licensors" for uses that include "marketing to you".	"we may share" with Licensors, and their marketing to users is listed as a use "in limited circumstances, and subject to applicable notice, consent, and other legal and contractual requirements".
Sale statement for California residents	"We have not sold consumers’ Personal Information in the preceding twelve (12) months."	The same statement, with an exception to the extent that "the use of certain cookies and similar tracking technologies may constitute a 'sale'" under applicable privacy laws.
Precise geolocation	The location section already allows collecting "the precise geolocation of your device" when location permission is given.	The location section is unchanged; the part for California residents adds "SpotHero may use precise geolocation information with your consent to provide location-based services."
California's "Shine the Light" law	Describes the law as letting California residents request information about SpotHero's disclosure of personal information to third parties for their direct marketing purposes, then says SpotHero doesn't disclose personal information to third parties "for the purpose of directly marketing their goods or services to you" unless the user asks.	That sentence is gone; the description of the law adds "or, where a business offers a qualifying opt-out mechanism, to opt out of such disclosures".
States covered by state-specific rights	Applies to residents of states including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah & Virginia.	Indiana, Kentucky, Rhode Island & Tennessee are added.
Opt-out pointer for state rights	Says to "visit our Cookie Preference Center in the footer of our website".	Points to "the 'Do Not Sell or Share my Personal Information' link" in the website footer.
Change clause	Prints "positing a notice".	Same text, with "posting a notice".
Business transfers	Same text as 2026.	Same text as 2025.

If SpotHero is involved in a sale of "all or substantially all of our assets", such as a merger or acquisition, or "if we are transferred to another company", the business-transfers clause says it "may disclose and/or transfer" users' personal information as part of the transaction. If the surviving entity isn't SpotHero, that company "may use your Personal Information pursuant to its own privacy policies", which "may be different from this Privacy Policy".

Opt-outs listed in the November 2026 policy

Under "Your Rights and Choices", the policy dated November 9, 2026 lets users stop promotional emails by "clicking unsubscribe in those messages or by emailing us at [email protected]", though SpotHero keeps the right to send informational emails about administrative notices or important information about the user's account. Texts stop when the user texts "STOP" from the mobile device receiving them, & push notifications can be turned off "through your device settings". The same section lets users block location sharing in the device's system settings and, where available, turn on a universal opt-out tool that automatically sends their opt-out preferences, such as the Global Privacy Control signal, "which we intend to respect". A user account can be deleted in the SpotHero iOS app under Account, Privacy, Delete My Account, but "in some cases we may retain certain information about you" as required by law or for legitimate business purposes to the extent the law permits.

Besides the footer button, Section 3 lets users with state or country rights to opt out of the processing of their personal information for "personalized ads, promotions, and targeted content" use the Verifiable Consumer Request method described in Section 17, which lists SpotHero's US Resident Webform, email to [email protected] & calls to (844) 707-7682. In its part for Canadian residents, the policy lists, depending on how a person uses SpotHero's website, apps and services, a "Cookie Preference Center" tool in the site footer for updating cookie settings & the option to contact SpotHero "to opt out of the use or sharing of your Personal Information", including for marketing or advertising purposes. The June 16, 2025 version prints the same choices in the same words, without the pointer to Uber's privacy notice.

SpotHero and the Uber purchase

SpotHero's terms say a user's payment of fees to SpotHero "constitutes payment to the Licensor solely for purposes of making a Reservation". The terms call SpotHero's own services the "Marketing Services" and, unless they say otherwise, limit them to telling users where parking spots are and whether they may be available, and to handling reservations by listing the spots, processing the bookings and collecting fees on behalf of Licensors. The user agrees that SpotHero may charge the user's credit card, debit card or other payment method, one the user selects & SpotHero approves, for all amounts due in connection with the user's use of those services, in line with the pricing & payment terms shown to the user for them.

Uber announced on February 23, 2026 that it had reached an agreement to buy SpotHero, & said it planned "a native, in-app parking reservation experience, powered by SpotHero". The release's paragraph about SpotHero credited it with "over $2 billion in parking reservations sold" and said millions of drivers use its apps & website to find, book & access off-street parking in more than 13,000 locations in over 400 cities in the U.S. & Canada. Uber's quarterly report for the period ended September 30, 2026 says that on April 16, 2026 it acquired 100% of the outstanding equity of SpotHero, Inc. for a total purchase price of $617 million in cash. SpotHero's About page, which says the company is based in Chicago, carries the name "SpotHero by Uber".

Quartz, a business news site, reported in a story updated November 9, 2026 that Uber had rolled out a tool that lets people book a place to park through the Uber app, according to financial news service Bloomberg. A booking in the Uber app takes the car's details & is paid with the method the user already has saved in the Uber wallet. On arrival, users can get in by scanning a QR code or "by having the lot read their license plate automatically". An Uber spokesperson said the company intends to leave SpotHero running as its own standalone app.

Regulators and courts on changed privacy policies

Federal Trade Commission actions

In a July 7, 2004 press release, the Federal Trade Commission (FTC), a United States government agency, alleged that, after collecting consumers' information, Gateway Learning changed its privacy policy to allow it to share the information with third parties "without notifying consumers or getting their consent". The proposed settlement barred Gateway from applying material changes in its privacy policy retroactively without consumers' consent.

In June 2023 the FTC charged that genetic testing firm 1Health.io changed its privacy policy retroactively without adequately notifying consumers whose data it had already collected or obtaining their consent. Samuel Levine, Director of the FTC's Bureau of Consumer Protection, said in that release:

The FTC Act prohibits companies from unilaterally applying material privacy policy changes to previously collected data.

The FTC's November 29, 2011 proposed settlement with Facebook requires that the company "get consumers' approval before it changes the way it shares their data". A February 13, 2024 post by FTC staff said it "may be unfair or deceptive" for a company to start sharing consumers' data with third parties & inform them only "through a surreptitious, retroactive amendment to its terms of service or privacy policy".

The FTC's March 2012 privacy report says companies should obtain "affirmative express consent" before making material retroactive changes to privacy representations, which companies may seek by presenting a clear & prominent disclosure "followed by the ability to opt in to the practice being described". Requiring a consumer to scroll through a 10-page disclosure & click an "I accept" button would not count, the report says.

California law and regulations

California Business and Professions Code 22575 requires a commercial website that collects personally identifiable information about California residents to post a privacy policy that describes "the process by which the operator notifies consumers" of material changes & identifies "its effective date".

The California Attorney General's office explained its regulations under the California Consumer Privacy Act of 2018 in a Final Statement of Reasons. Explaining subsection (a)(5) of § 999.305, it wrote that when businesses "change practices midstream", consumers should be able to decide whether they agree to the new purpose. It added that "simply putting up a new notice on a website" after a consumer has already provided personal information, when that consumer "may be unlikely to revisit the website", "is not meaningful consumer notice". That passage explained a subsection that was later withdrawn: the office's July 29, 2020 addendum says "Subsection (a)(5) has been withdrawn". On page 15, the Final Statement of Reasons uses the same "simply putting up a new notice on a website" sentence to explain subsection (e) of § 999.306, which it says bars a business from selling personal information it collected while "it did not have a notice of right to opt-out posted", unless it obtains the consumer's affirmative authorization for the sale. The addendum's entry for § 999.306 withdraws subsection (b)(2) and, for subsection (e), says that "the extraneous word 'notice' has been deleted". SpotHero's policy lets it give notice of rights-lessening changes "by posting a notice through the Site and/or Apps".

Ninth Circuit ruling on posted contract changes

Douglas v. United States District Court, 495 F.3d 1062, is a July 18, 2007 decision of the federal Court of Appeals for the Ninth Circuit about a changed telephone service contract. Talk America acquired a long distance telephone business from America Online, added an arbitration clause & three other provisions to the service contract, & posted the revised contract on its website; according to customer Joe Douglas, it never notified him that the contract had changed. After a federal district court granted Talk America's motion to compel arbitration under the revised contract, the appeals court vacated that order, writing at page 1066:

Parties to a contract have no obligation to check the terms on a periodic basis to learn whether they have been changed by the other side.

Even if continued use could be considered assent, it added, "such assent can only be inferred after he received proper notice of the proposed changes". SpotHero's policy says it "is incorporated as part of the SpotHero Terms and Conditions" & makes users "responsible ... for periodically reviewing this Privacy Policy for changes", which SpotHero may modify "in our sole discretion without prior notice to you". Under Douglas, a user's continued use could show agreement to a revised SpotHero policy only after proper notice, & the policy promises email or posted notice only for material changes that lessen users' rights.

See also

• Post-purchase EULA modification
• Terms of service