Waze Navigation & Live Traffic Security & Privacy Scorecard

Waze

Waze is a GPS navigation app providing real-time traffic updates, turn-by-turn directions, and community hazard reporting powered by millions of drivers.

What This Means for You

Your precise GPS location is collected continuously in the background, linked to your identity, and shared with Google's advertising systems, while your calendar events and contacts are also uploaded to Waze servers.

Recommendation: Acceptable with Awareness

Waze provides excellent navigation but collects precise location linked to your identity for advertising. Accept only if comfortable sharing location data with Google's ad infrastructure.

Best For: Drivers who prioritize real-time community traffic data and accept ad-funded data collection

Key Findings

Data Security - 3 findings (1 low, 2 info)

Network Security - 3 findings (1 medium, 1 low, 1 info)

Code Safety - 4 findings (2 medium, 2 low)

Privacy - 6 findings (4 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

• Precise location: Continuous GPS traces including position, heading, and speed, collected in the background
• Calendar data: Full calendar event content including appointment details, meeting notes, and conference URLs
• Contacts: Phone numbers from your address book, transmitted to Waze servers
• Bluetooth environment: Nearby beacon scans (venue and location data) uploaded without specific disclosure
• Voice data: Audio recordings when using voice features, processed via Google Cloud
• Device information: Device identifiers and usage data for analytics and crash reporting

Third-Party Data Sharing

The following third parties may receive your data:

• Google Mobile Ads - Receives precise location linked to your identity for targeted advertising
• Google GMM (location tracker framework) - Receives raw GPS traces including speed and heading
• Firebase (Crashlytics, Cloud Messaging, Remote Config, A/B Testing, Dynamic Links) - Crash reports, app configuration, and messaging
• Google Cloud Speech - Processes voice recordings when you use voice features
• Google Sign-In / AppAuth - Handles account authentication flows
• Spotify iOS SDK - Music integration
• SKAdNetwork (49 ad networks) - Privacy-preserving attribution for ad campaign measurement

Understanding the Scores

Security: 90/100
Privacy: 84/100

Security Breakdown

• Data Security: 95/100 - Secure credential storage with appropriate protection levels; some files assigned weaker protection than necessary
• Network Security: 93/100 - All production connections use HTTPS; staging infrastructure left in the production build creates a minor attack surface
• Code Safety: 91/100 - Solid overall code hygiene; URL scheme handling lacks caller authentication and domain restrictions

Privacy Breakdown

• Data Collection: 86/100 - Collects broad data including location, contacts, and calendar; privacy manifest covers most categories
• Data Sharing: 93/100 - Sharing is limited primarily to Google services; no cross-app tracking via device ad identifier
• User Control: 90/100 - Standard iOS permission prompts used; background data collection continues after initial consent

Positive Security Features

• All production network connections use HTTPS with no exceptions configured
• Secure credential storage using multiple Keychain protection tiers including device-only and passcode-required levels
• No advertising device identifier (IDFA) access; attribution uses Apple's privacy-preserving SKAdNetwork framework instead
• On-device voice activity detection reduces the amount of audio sent to external servers
• No server-side secrets or private credentials found anywhere in the app bundle
• File sharing with the Files app is explicitly disabled

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Contact and Calendar Data Transparency
   Disclose whether contact phone numbers are processed on-device or transmitted as-is, how long non-user contacts' data is retained, and which specific calendar fields are sent to servers.

2. Bluetooth Data Disclosure
   The privacy manifest does not list Bluetooth beacon data as a collected data type. Indoor positioning via beacon scans should be disclosed as a distinct data collection practice.

3. Voice Processing Transparency
   The privacy manifest declares audio data as linked to identity but does not name Google Cloud as the external processor. Users should be informed that voice features involve external server processing.

Security Enhancements

1. Remove Staging Infrastructure from Production Builds
   Staging domain entries in URL validators, universal links entitlements, and hardcoded staging addresses should be excluded from App Store releases to eliminate the residual attack surface.

2. URL Scheme Caller Validation
   External URL schemes used for partner integrations could be strengthened by validating the action context, reducing the risk of any installed app triggering navigation or other actions without user intent.

Technical Context

App Type: Navigation and mapping, location-sensitive with advertising integration
Classes Analyzed: iOS binary and framework symbols
Third-Party Services: 15 identified
Context Tags: location, ads, social, contacts, navigation, bluetooth

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Waze
Version: 5.18.0 (Build 1)
Analysis Date: 2026-04-17
Package: com.waze.iphone

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 5.18.0 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors