Wheely sues New York City to end surveillance practices that harm passengers and drivers

Wheely has filed a brief asking the U.S. Court of Appeals for the Second Circuit to strike down a New York City rule that forces every licensed car service to hand the government a complete ledger of every ride taken by passengers: where and when each ride begins and ends to within 3 feet, and the vehicle and driver details. The data is not aggregated and is not a sample. Holding it serves no clear regulatory purpose and it could be used to identify people travelling privately. Taking on the largest and most powerful municipal government in the United States is not a decision we make lightly. But Wheely has long championed the privacy and security of how passengers and drivers move through their city.  We fundamentally believe that riders and drivers have a right to travel freely without their movements being tracked by the government. We do not believe a person should have to think twice before taking a private call in the car, or worry that the doctor, place of worship, or home they were driven to is being logged into a permanent city record.

As more and more New Yorkers experienced our service around the world, they called for our expansion to New York. It became apparent to us that New York’s policy was in conflict with our core values to serve those who travel with us. We are modeled on the world’s greatest hospitality companies. When someone travels with Wheely they have a chauffeur trained in discretion and etiquette at our Chauffeur Academy. Our drivers have NDAs. We do not have CCTV in our vehicles. When you request a ride on the app, we come, even if you have not yet told us the destination.  The timing also reflects how much the law has changed. The TLC’s rule was first written in 2014, before the Supreme Court reshaped privacy law in Patel (2015), Carpenter (2018), and now Chatrie (2026). Privacy and civil liberties groups objected when the rule was adopted in 2014 and again when it was expanded in 2017. The one black car base that refused to comply had its license suspended, with the TLC acting as judge, jury, and executioner.  Wheely is not alone in making this case: the U.S. Chamber of Commerce, the Cato Institute, the New Civil Liberties Alliance, the Surveillance Technology Oversight Project (S.T.O.P.), and the Legal Aid Society have all filed as amici in support of the challenge.

New York City claims the data is anonymous because it is not directly linked to a name, phone number, email or credit card. It is not. Researchers have shown four points in time and place are enough to identify 95% of people — and the city’s own 2022 privacy policy already calls pickup and drop-off locations sensitive personal information. For the city’s thousands of black car and limo drivers, whose license number rides on every trip, the TLC holds something worse: a named, continuous record of everywhere they have driven for a living.

The Fourth Amendment bans unreasonable searches without a warrant. Yet these outdated rules are effectively a warrantless geofence search the size of New York City, running 24/7, forever. As we argue in our legal brief, this is unconstitutional and should be struck down.

New York City claims it needs trip records to enforce passenger-safety and driver-fatigue rules. However:

• It has never explained why it needs precise location data of passengers to know how long a driver has been driving.

• The driver-fatigue rule bars a base from dispatching a driver after 10 hours of passenger time in a day, or 60 in a week. Black car and limo utilization is so low that a chauffeur would have to work more hours than there are in a day to ever reach that limit.   

• NYC doesn’t break out black car and limo complaints from ride-share, but even counting ride-share, it issues about one fine for every million trips. Yellow taxis draw 33 times as many. Black cars and limos are far safer than ride-share. 

The city has a poor security record. In 2014, it released 173 million taxi trips in response to a Freedom of Information (FOIL) request, protected by a weak hashing algorithm (MD5 — which was broken in 2008), and and an internet user was able to cross-reference trip records with publicly available information to identify the time, date, pick-up location, drop-off location, and even the fare and tip paid by individual public figures. The TLC still lets black-car bases log into its portal with nothing but a base number, EIN and ZIP code — all public information — and no password or two-factor authentication. Bases transmitted their trip records over unencrypted FTP until early June 2026, more than a decade after the rule took effect, and only as this lawsuit pressed the point. Even when they implemented encryption for uploads, they sent the same default password in plaintext to all bases. An agency that protects data this carelessly cannot be trusted to hold a permanent, citywide record of where everyone goes. The question is not whether it leaks, but when.

A ruling that bulk, suspicionless trip-tracking is constitutional would hand every state regulator in the United States carte blanche to collect even more data on their citizens.

Fair question, and the answer is the whole point: we only collect what we need to give you a ride. We don’t sell it. We fight demands for it — and our privacy policy says exactly that. The city collects everyone’s data, keeps it indefinitely, and shares it. The issue was never that data exists; it’s a permanent government list with no cause and no limit.

Wheely is being represented by Skadden, Arps, Slate, Meagher & Flom LLP. The full complaint in the case of Wheely USA v. New York City can be found here.