Transit agencies around the country are adopting a new generation of fare payment systems. Agencies including New York’s MTA, Boston’s MBTA, and Houston METRO are in the process of switching to what’s known as “open-loop” systems that enable riders to tap into the system using digital wallets on their phones or with their credit cards.

These technologies come with clear benefits for riders, but they also carry the risk of exposing more personal data. TransitCenter’s new report, “Do Not Track: A Guide to Data Privacy For New Transit Fare Media,” maps out how to navigate the pitfalls of these new technologies when it comes to privacy. 

For riders, “open-loop” systems can reduce the hassle of paying the fare or refilling a farecard. They can also improve service, especially on buses, by cutting the time it takes passengers to board. For agencies, the new systems can reduce fare collection costs and provide better origin and destination information, helping to better plan service. But agencies must put safeguards in place to protect rider privacy and prevent intrusion by law enforcement, like sharing riders’ travel data with Immigration and Customs Enforcement (ICE).

The switch to these new fare payment technologies can accelerate access to riders’ trip data by other government agencies. In New York, for instance, individuals’ MTA trip data can be retrieved much faster with the new OMNY system than with the older MetroCard system. Organizations like the Surveillance Technology Oversight Project (STOP) have raised concerns about the ability of NYPD and ICE to access MTA customer data. STOP has also warned about the potential for OMNY to compromise a rider’s right to anonymous public speech and association.

The switch also dramatically increases the amount of data collected by third party payment processors. This can allow private companies to create detailed profiles of individuals’ personal lives, behaviors, and preferences—all through peoples’ purchasing histories and without their consent. The American Civil Liberties Union has warned that open-loop payment systems may yield private companies more detail on not just how much we spend on travel, but when and where we travel, as well. This information has the potential to be used to exacerbate racially disparate impacts of consumer scoring (lowering a person’s creditworthiness, for instance, because they ride transit).

“Do Not Track” presents a four-point agenda to protect riders’ privacy and empower riders to choose the payment method that best works for them: 

1. Ensure that riders retain the ability to pay without being linked to a credit card account or other personal identifier. These payment options must be priced at the same rate as payment systems that do enable personal identification. This includes agency-issued fare cards with a stored value that can be refilled with cash at a fare card machine or third-party vendor. 
2. Make secure data management an organizational priority. Agencies should adopt policies for secure data management, and strive to constantly improve data security like  they actively seek to improve service and operations. 
3. Clearly and transparently communicate privacy policies. Riders should be able to easily find out what data is collected, how that data is used, and which parties can access their data. Agencies should communicate the privacy benefits of refilling cards with cash.
4. Use data sources that protect personal privacy to improve service planning for riders. Many transit agencies use fare payment data to assess how riders are using the system. They then use this data to adjust service to best fit rider needs. Other data sources, such as automated passenger counters (APCs) and passenger surveys, may provide similar information while collecting less personal data.

The increased involvement of third parties in fare payment underscores the need for better data collection and management policies within transit agencies. Transit agencies must recognize their new role in generating mobility data, and take precautions to ensure that data is not abused. Through proactive measures, they can protect rider privacy even as new technologies emerge. 

To learn more, read the full report.