Rent a Lime bike and it vanishes from the company’s public availability feed. Finish your trip and it reappears at a new location. If the same identifier connects those two observations, anyone watching the feed can approximate where your trip started and where it ended. That linkage, not the feed itself, is the alleged exposure. Apps and services engaging in secretly tracking users highlight how real the stakes of location data exposure can be.
A researcher reportedly found that Lime’s implementation allows that kind of route inference, apparently because vehicle observations remain linkable across trips. GBFS, the open data standard Lime uses, explicitly requires operators to randomize vehicle IDs after each completed trip to prevent exactly this.
The gap between what the standard requires and what Lime allegedly delivers is the reported problem. Lime’s response to the researcher’s findings has not been confirmed, and it remains unclear whether Lime rotates identifiers correctly in every market.
How the Feed Becomes a Map
A script polling public data snapshots may be enough to approximate where a rental began and ended.
Before a rental, a bike appears in Lime’s public availability feed with its location, status, and identifier. The moment it is unlocked, the vehicle drops off the feed, because active rentals are not supposed to appear there.
When the trip ends and the bike is parked, it reappears at a new location. A script collecting successive feed snapshots can record the disappearance, record the reappearance, and connect the two points.
That connection approximates an origin and destination without accessing any account data. A 2026 paper presented at the Privacy Enhancing Technologies Symposium describes the same disappearance-and-reappearance method as a practical technique for inferring individual trips, reporting reconstruction of more than 80 percent of trips in two cities studied, even in systems that include some privacy protections.
What the Standard Was Supposed to Prevent
GBFS already identified persistent vehicle IDs as a privacy risk; the open question is whether implementation kept up.
GBFS is the open data standard used by shared-mobility operators, cities, and trip-planning apps to publish real-time vehicle availability. It is not a proprietary Lime system; it is the same infrastructure that third-party trip planners use to show nearby scooters and bikes.
The specification explicitly requires vehicle IDs to be rotated to a random string after each completed trip. It also bars active-rental vehicles from appearing in the public feed at all.
Those rules exist because GBFS maintainers already recognized what a persistent identifier can expose. The alleged problem, if confirmed, is not a flaw in the standard. It is a flaw in following it.
It is worth noting that a 2022 peer-reviewed study reported Lime switched from static to dynamic vehicle IDs after September 2019. Whether that practice is applied consistently across all current markets is not established by the available evidence.
The Tension That Makes This Hard to Fix
Some municipalities require operators to publish GBFS feeds, which limits how quickly an operator can change what the feed exposes.
Some cities may require operators to publish GBFS feeds as a condition of operating on public streets, though the available evidence does not confirm this applies universally across Lime’s markets. San Jose’s Flock problem illustrates how public infrastructure surveillance and privacy trade-offs play out in urban mobility contexts. Because of those potential obligations, simply suspending the feed may not be straightforward.
Practical mitigations exist. Stricter ID rotation, reduced location precision, delayed publication, and rate limits that make bulk scraping harder are all documented options. The last approach works similarly to how streaming platforms throttle simultaneous connections to limit automated access.
Several key facts remain unconfirmed. These include whether Lime rotates identifiers correctly in every market, what specific municipal contracts require beyond baseline GBFS compliance, and whether Lime has issued any formal response to the researcher’s findings. Gadget Review contacted Lime for comment; no response was received before publication.
What This Means for Riders
The feed exposes vehicle movement rather than account data, but that distinction matters less than it might seem.
The GBFS vehicle-status feed does not publish your name, payment details, or account information. Connecting a route to a specific person requires additional data from outside the feed.
The risk grows when an observer retains historical snapshots and combines them with maps, public records, or other location datasets. Repeated observations near a home address, a medical clinic, or a workplace can suggest patterns that are far from anonymous. A surveillance app built to target individuals based on movement patterns shows how readily location data enables identification.
Researchers describe this as the linkage problem: individually unremarkable data points that become identifying when combined across time. Riders currently have no technical recourse while the feed remains public and ID rotation in their market is unconfirmed. Exploring bike gadgets may be useful for cyclists looking to take more control over their riding experience in the meantime.
