Lifecycle data exposure in shared micromobility: A scoping review and audit of public vehicle feeds and operator disclosures

Shared micromobility - dockless electric scooters and bicycles rented via smartphone - is a transport service that cities procure through permits and concessions but do not operate. Because the operator alone observes what its vehicles collect and retain, public disclosure provides an externally observable layer of information relevant to operator data practices, although it does not independently verify actual operator practice. This study maps how observable lifecycle data handling is, across three components. A scoping review following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) screened 2,169 records and assessed 145 full texts, yielding 18 included studies (5 target-domain empirical, 9 target-domain documentary, 4 near-domain) with the strongest evidence at the operation stage. A cross-sectional audit collected 1,428 reachable public General Bikeshare Feed Specification (GBFS) feeds in a single pass; in 813 motorized feeds, reported with 95% Wilson confidence intervals (CIs), a vehicle identifier appeared in 100.0% and coordinates in 99.4%, but battery percentage in only 68.9%, with marked regional heterogeneity. A coding audit of 13 operator privacy notices found operational processing documented thoroughly, but no notice addressed device disposal or a vulnerability-reporting channel. These are disclosure signals, not demonstrations of harm. A lifecycle model links each stage to evidence strength and to proposed, unvalidated controls, identifying candidate domains for further empirical and contractual evaluation.