Every time you tap in at a Tube station or scan your phone on a Southern Rail barrier, you’re generating a timestamped, location-stamped record that sits inside at least three different databases. Most passengers assume the data is just used to charge the right fare. It isn’t. The full picture of what gets logged, who it gets shared with, and what it reveals about your daily life is considerably more interesting than TfL or any of the train operators are volunteering to tell you.
I’ve spent time pulling apart the privacy notices, data sharing agreements, and API documentation sitting across TfL’s developer portal, the National Rail Enquiries infrastructure, and the major train operating company apps. What’s buried in there is not reassuring. This is a breakdown of the actual technical picture.
What an Oyster card actually logs
The Oyster card itself holds minimal data on the chip: your balance, the last eight journey records, and a few pass definitions. That’s intentional. The chip is MIFARE DESFire, and the on-card storage is tightly constrained. But that local data is almost beside the point. The real picture lives on TfL’s back-end systems.
Every tap-in and tap-out event generates a transaction record containing your Oyster card UID, the station or bus stop ATCO code, a timestamp accurate to the second, the validator ID (which maps to a specific gate or reader), the fare deducted, and a running journey state flag. These records are batched from validators and pushed to TfL’s data warehouse. For registered Oyster users, those records are linked to your name, address, email, date of birth, and any associated payment method. TfL retains identifiable journey history for registered cards for eight weeks by default, according to their privacy notice, though anonymised journey data is retained for much longer and fed into their network planning systems.
If you use an Oyster card that isn’t registered, the journey data still exists on TfL’s systems tagged to the card UID. That UID is a stable pseudonymous identifier. Pair it with a single registration event (say, you topped it up online once) and TfL can retroactively link every journey you made before and after that event.
Contactless payment cards and the bank data bridge
Contactless is where National Rail Oyster data privacy UK tracking gets genuinely complex. When you tap a Visa or Mastercard on a TfL or National Rail reader, the transaction goes through a different chain. TfL processes contactless through a back-end operated by Cubic Transportation Systems (now part of Omdia’s transport portfolio). Cubic holds the journey-level data and reconciles it against the card’s PAN (Primary Account Number) to apply daily and weekly fare caps.
Critically, this means Cubic holds a dataset mapping your bank card to precise journey times and locations. The data sharing agreement between TfL and Cubic allows Cubic to use aggregate and anonymised data for service improvement. Whether “anonymised” is doing any meaningful work there is a legitimate question given that re-identification of transit data is well-documented in academic research. A 2013 MIT study on mobile phone data demonstrated that just four spatial-temporal data points are enough to uniquely identify 95% of individuals. Transit tap data has comparable density.
Train operators running their own contactless infrastructure outside London (for example, Avanti West Coast’s ticketing gates or TransPennine Express’s readers) operate a similar model, usually through Flowbird or Scheidt & Bachmann back-ends. The specifics of those data retention and sharing arrangements vary by operator and are buried in procurement contracts that aren’t published.
What the train operator apps actually collect
This is where I found the most aggressive data collection hiding in plain sight. The major TOC apps (Trainline being the big aggregator, plus operator-specific apps from Avanti, LNER, and others) collect considerably more than just your booking history.
Trainline’s Android app requests location permissions, and whilst the app frames this as “show nearby stations,” the location calls happen during background sessions if you leave the permission on “always allow.” Trainline’s privacy notice confirms they collect “device information, usage analytics, and location data” and share these with “advertising partners and analytics providers.” Their listed third-party recipients include Braze for push notification analytics, Amplitude for product analytics, and Adjust for mobile attribution. Adjust in particular is an advertising measurement platform whose primary function is cross-app tracking.
LNER’s app, built on a Salesforce marketing cloud back-end, logs every search query you make, the tickets you view but don’t purchase, and the times you open the app. That behavioural data feeds into their CRM segmentation and is used for retargeted email campaigns. This isn’t nefarious on its own, but most passengers have no idea their abandoned train search at 07:14 on a Tuesday is being recorded and stored against their account profile.
The National Rail app built on the NRE (National Rail Enquiries) API layer similarly logs journey plan queries. NRE is jointly owned by the train operating companies through the Rail Delivery Group, and their data governance documentation is sparse on specifics about what third parties receive query-level data.
The OSINT and profiling potential buried in the data
Here’s the uncomfortable bit, and the reason this data deserves more scrutiny than it gets. A full journey history for a regular commuter is an extraordinarily detailed behavioural profile. From consistent tap-in times at a local station, you can infer home location to postcode level. From tap-outs at specific destinations, you can infer workplace. Irregular journeys late at night on weekends map social patterns. Journeys to hospital stations (St Thomas’, the Royal Marsden, Great Ormond Street) carry obvious sensitive inferences.
This is not hypothetical. TfL has already demonstrated this data’s sensitivity by being required under the UK GDPR (enforced by the ICO) to respond to Subject Access Requests with journey logs. Passengers who’ve made SARs have received spreadsheets showing every tap event for months. That’s useful for fraud disputes. It also illustrates exactly how granular and linkable the dataset is.
For anyone doing open-source intelligence work, a compromised TOC account or a successful social engineering attack on a TOC’s customer service operation would yield a ready-made movement history. It’s the kind of attack surface that sits alongside the UK’s national ANPR network in terms of what it reveals about a person’s physical movements. The two datasets, if correlated, would be extraordinarily powerful for surveillance.
Train operators have also been caught sharing data with law enforcement beyond what most passengers would expect. Under the Regulation of Investigatory Powers Act (RIPA) and successor legislation, TOCs can receive lawful requests for journey data from police forces without notifying the passenger. The volume of such requests is not publicly reported in a consolidated form.
Data sharing with third parties: the small print
Beyond law enforcement, the third-party sharing landscape is messy. Most TOC privacy notices list recipients including: payment processors, fraud prevention agencies (where CIFAS and related bodies come in), marketing analytics platforms, cloud infrastructure providers (AWS and Azure both host significant parts of the rail industry’s data stack), and “business partners.”
That last category is the one that should get your attention. For rail operators, “business partners” can include hotel chains (booking add-ons), taxi and rideshare platforms (last-mile integrations), and travel insurance providers. Every integration is a potential data pipe. I’d argue the industry’s approach to third-party data sharing is no tighter than the telematics black box ecosystem, where movement data leaks through poorly secured APIs to parties the end user has never heard of.
The Rail Delivery Group published a data strategy document in 2024 that explicitly frames passenger journey data as an asset for “commercial development and retail partnerships.” That’s the clearest signal yet about how the industry views this data. Not as a byproduct of ticketing, but as a revenue stream.
What you can actually do about it
Using an unregistered Oyster card reduces but doesn’t eliminate linkability, since TfL can still correlate the UID with any online top-up. Cash top-ups at machines without logging in are the closest you’ll get to pseudonymous travel on the network. Contactless bank cards are worse because the PAN links directly to your bank identity.
For app usage, the standard advice applies: review permissions, disable location when the app isn’t active, and use the web browser version of booking platforms rather than the app where possible. Browser-based sessions typically have less telemetry access than native apps, though cookies and fingerprinting still apply.
Making a Subject Access Request to TfL (and to Trainline or your TOC of choice) is illuminating if you want to see exactly what they hold. Under UK GDPR you’re entitled to a copy of all personal data, and the process is free. TfL has an online SAR portal. Most TOCs take the full statutory 30 days and some push back on scope. This kind of investigation sits in the same territory as looking at how CIFAS and fraud prevention databases build profiles about you from multiple sources without your knowledge: the data exists, it flows, and most people never think to ask what’s in it.
The rail industry’s data practices need proper scrutiny from the ICO, not just boilerplate privacy notices. Until that happens, every tap of your Oyster is doing more work than moving the barrier gate.
Frequently Asked Questions
How long does TfL keep my Oyster journey history?
For registered Oyster accounts, TfL retains identifiable journey data for eight weeks. Anonymised and aggregated journey data is kept considerably longer for network planning purposes. If you’ve made a web top-up, TfL can also link your card UID to your account retroactively, covering journeys made before registration.
Is using a contactless bank card on trains more private than an Oyster card?
No, in most ways it’s less private. Contactless transactions link your PAN (Primary Account Number) directly to your bank identity, and the back-end processor (typically Cubic for TfL) holds journey-level data mapped to that card. An unregistered Oyster card uses a pseudonymous UID, which is harder (but not impossible) to link to your real identity.
What data do train operator apps like Trainline collect?
Trainline collects device information, location data (if permitted), usage analytics including searches and viewed-but-not-purchased tickets, and shares this with third parties including Braze, Amplitude, and Adjust. Adjust is specifically a cross-app advertising measurement platform, meaning your behaviour can be tracked across other apps on your device.
Can UK police access my train journey records without telling me?
Yes. Under the Regulation of Investigatory Powers Act and successor legislation, train operators can be required to provide journey data to law enforcement without notifying the passenger. There is no consolidated public reporting on how frequently these requests are made across the industry.
Leave a Reply