Bird

Is the Bird app safe?

Bird is safe enough to ride with, but it is not one of the stronger scooter apps on privacy or fairness to riders. The company went bankrupt in December 2023 and came back in 2024 under a new owner, Third Lane Mobility, and it still runs fleets in many cities; its App Store listing claims more than 350. The app's Apple label is short and shows no tracking, yet its privacy policy covers ID scans, selfies used for age checks and ad partners. In July 2026 Italy's consumer authority fined it twice, once for cutting off riders' accounts without warning. We score it 54/100, below Lime (62).

The app is published by Blue Jay Transit Inc. of Miami, which the privacy policy names as the data controller. It is rated 4+ on the App Store, although Bird's terms say riders must be over 18.

What Bird collects

Apple's label lists purchases, location, contact info, user content, identifiers, usage data and diagnostics as linked to you, and nothing in the "used to track you" section. Google Play gives a fuller picture: it says Bird shares approximate and precise location with other companies for analytics and for advertising or marketing, and also shares photos, email address, device IDs and payment info for purposes such as fraud prevention.

The privacy policy, last updated on 17 April 2026, explains where those photos come from. Where local rules set a minimum age, Bird may ask for a driver's licence or other government ID, which can show your birth date, gender and photo. It may use self-taken photos or videos to check your age, and photographs, videos or "body mass" to confirm that only one person is riding. At the end of a ride the app asks you to photograph the parked scooter; that image, your estimated location and device details go to Google's ARCore service to pinpoint the vehicle.

Bird also shares rider data with cities and transit authorities where its permits require it, often in the Mobility Data Specification format that many US cities use. The policy says Bird does not sell personal data for money, but that cookies on bird.co send browsing data to ad companies, which California law can treat as a sale. Because the policy discloses more ad sharing than Apple's label suggests, we score privacy on the policy and Google Play listing.

What Italy found

On 28 July 2026 Italy's competition and consumer authority, AGCM, fined Bird Rides Italy S.r.l. twice. The first fine, €300,000, was for making it slow and hard for holders of Rome's annual Metrebus transit pass to activate the free rides Bird had promised under its city permit. Lime and Dott were fined in parallel cases.

The second fine, €450,000, is the one we weigh more heavily. AGCM found that Bird deactivated user accounts across Italy without telling riders in advance what behaviour could lead to a block and without giving them a chance to respond. Internal emails quoted in the decision show Bird's own legal team warning that permanent bans for missing end-of-ride photos could breach consumer law, and that a system of gradual warnings would be fairer. Bird argued that riders on free passes parked carelessly. Bird could appeal to the regional administrative court of Lazio within 60 days.

The decision also records two privacy points. Bird's legal team noted that ID documents, card numbers and birth dates for the Rome pass were collected through Google Forms and Sheets, and questioned keeping pass ID numbers after users deleted their accounts. And in November 2025 Italy's data protection authority, the Garante, sent Bird a request for information about how it processes user data. We found no decision from the Garante.

Older items are local and about licensing. In 2018 Bird pleaded no contest in Santa Monica to running a scooter business without a city licence and agreed to pay $300,000 in fines and costs. Cases like that are about permits rather than riders' data, so we treat them as context.

Security and the bankruptcy

We found no reported breach of Bird rider data. We also found no bug bounty programme on HackerOne or Bugcrowd and no security.txt file on bird.co, so there is no published route for researchers to report flaws. Google Play says data is encrypted in transit and that you can request deletion. The policy promises only "commercially reasonable" security measures.

Bird bought its rival Spin in September 2023 and filed for Chapter 11 bankruptcy in Florida three months later, on 20 December 2023, together with Spin. Third Lane Mobility now runs both brands and says it logged 35 million rides in 2024. The current privacy policy has been in effect since 23 March 2024 and names Blue Jay Transit, not the old Bird Global, as the company responsible for your data.

How to ride Bird more safely

1. Allow location only while using the app, and refuse tracking if iOS asks.
2. Upload a clear photo of the parked scooter at the end of every ride; missing photos led to bans in cases AGCM examined.
3. Check the brakes, lights and tyres before you start, and end the ride at once if anything feels wrong.
4. Wear a helmet and ride alone; Bird says it may use photos to confirm one rider.
5. Delete your account when you stop riding. The policy says ride and payment history are then deleted or anonymised, unless Bird needs them for legal reasons.

How we scored it

Regulatory record (72) is the strongest factor: two small Italian consumer fines and an open request from the privacy regulator, but no privacy fine. Privacy (48) and transparency and control (48) are the weakest, because Google Play and the policy show location and photos shared for ads and checks that Apple's label does not, and because AGCM found Bird blocked accounts without warning. For a European rival that has published accident figures, see Voi.