TuJu vs Waze: The Clause Behind PMX's Push

TuJu vs Waze: The Clause Behind PMX's Push

On 20 October 2026, Prime Minister Anwar Ibrahim chaired the third meeting of the National Cyber Security Committee (JKSN) and, among other items, encouraged Malaysians to use TuJu — the highway navigation app built by the Malaysian Highway Authority (LLM) — as an alternative to Waze. The reason given: Waze is "subject to the laws of the Israeli government".

That sentence is doing a lot of work, and it deserves better than either a reflexive eye-roll or a panicked uninstall. The claim is not a vibe — it is a checkable contractual fact. Checking it also teaches something more useful than the headline: how jurisdiction, data collection, and product dependency stack inside a modern navigation app, and what "digital sovereignty" actually buys you when the layer underneath still belongs to someone else.

What was actually said

The JKSN meeting covered the Cyber Security Act 2024, MyDigital ID security, preparations against quantum computing threats via post-quantum cryptography (PQC), autonomous AI threats, and the protection of National Critical Information Infrastructure (NCII). Per Malay Mail's report of the Bernama wire and The Star's coverage of the same meeting, the TuJu-vs-Waze line came out of that same digital-sovereignty agenda, with movement data — where Malaysians go, when, and who holds that trail — as the concern.

"We cannot compromise when it comes to the security of our citizens' data and identities," Anwar said, tying the navigation push to the broader MyKad and MyDigital ID identity ecosystem.

The clause exists — go read it

Here is the part most coverage skips: you do not have to take anyone's word for the Israeli-law claim. It is in Waze's own Terms of Use, under a section titled Governing Law and Jurisdiction, and it reads:

These Terms will be governed solely by the laws of the State of Israel, without giving effect to any conflicts of law principles. Any dispute, claim or controversy arising out of, connected with or relating to these Terms and the Service, will be under the exclusive jurisdiction of the competent court in the Tel Aviv district in Israel.

The same document identifies the service provider as Waze Mobile Ltd., "a company incorporated and operating under the laws of Israel", registered in Tel Aviv. This is not new wording slipped in during a busy news cycle: Snopes, fact-checking a viral version of this claim in July 2026, used archived copies to confirm that Waze's terms have referenced Israeli governing law since its founding in 2008. Waze was founded in Israel that year and acquired by Google in 2013.

What the clause means — and what it does not

Read the clause precisely. Both over-reading and under-reading miss the point.

It does mean: if you sue Waze, or Waze sues you, Israeli law governs the contract and Tel Aviv courts hear the dispute. Your consumer remedies against the app run through that channel, not a Malaysian one. The data controller named in the Waze privacy policy is Waze Mobile Ltd. in Tel Aviv, and the policy explicitly contemplates Israeli data protection law as one of the frameworks that may apply to your information.

It does not mean: that Israel's government operates Waze, or that there is public evidence of Israeli state surveillance through the app. Snopes found no credible public evidence confirming that claim, and a Google spokesperson told Snopes it is "completely false" that Waze shares data for surveillance purposes. The honest framing is the uncomfortable one: a governing-law clause tells you which legal system can compel the operator. It does not tell you whether anyone has. You are relying on the operator's disclosures plus whatever your own regulator can audit.

The part that should worry any privacy-literate user

Waze's data collection is not exotic. It is standard for the category — and that is exactly the problem. The privacy policy says Waze collects detailed location, travel, and route information as GPS and sensor data combined with timestamps and IP addresses, saved as a route history of all your journeys. Depending on device and account settings, it may collect this "even when you are not using the app". The policy further states that Waze shares de-identified information — including account settings, location and route-related data and metadata — with Google affiliates to develop and improve mapping products.

This is where the sovereignty argument has teeth, and it is not about one country's flag. A 2025 investigation by Dutch outlet Follow the Money documented how location data from apps like Waze flows into Israel under the European Commission's adequacy framework, with privacy campaigners arguing that movement metadata is precisely what lets an observer map who attended which gathering on which day. The metadata is the artifact. The geopolitics of the moment is what finally got ordinary Malaysians to read a governing-law section they have been clicking past for a decade.

Enter TuJu — and its honest limits

TuJu is a joint venture between LLM and Prosignal Consortium Sdn Bhd, running since 2022 and launched publicly on 26 November 2025 at the Seremban southbound R&R by Works Minister Datuk Seri Alexander Nanta Linggi. The name blends "two" — two-way information between LLM and drivers — with jarak or julat. Feature-wise it covers the highway use case seriously: real-time ETA, toll cost calculation, CCTV feeds from LLM's traffic management centre, R&R facility listings (surau, food, petrol, EV chargers), an SOS button, incident reporting, and integration with MyJalan for road damage complaints.

Recent updates shipped a more modern interface on Android — with voice search and toll announcements among the features listed in the Google Play release notes — and teased TujuAdd (Tuju+) with AES camera notifications, a feature not yet shipped. Before anyone installs it in a patriotic rush: the app has real rough edges. At the time of writing it holds a 2.6-star rating on the Apple App Store, with reviews describing map flicker while driving and weak routing outside highways. Per launch coverage by paultan, under the skin TuJu uses Google's mapping and POI data, and at launch it did not support CarPlay or Android Auto.

That last detail deserves its own paragraph, because it is the most important engineering lesson in the whole story.

Sovereignty is layered — name the layer you mean

TuJu running on Google map data means switching from Waze to TuJu does not remove Google from your stack. What it changes is the contractual relationship over your movement trail: the data controller you can complain to, the terms that govern the app, the courts that hear disputes, and in principle the jurisdiction whose law can compel disclosure of the account-level data the app holds. It does not change the underlying map provider, and nothing in the public materials commits TuJu to keeping Malaysian location data inside Malaysia.

This is the same pattern we wrote about in when governments start building their own digital stack: swapping one vendor's app for a national alternative moves the sovereignty boundary, it does not dissolve dependencies. If your threat model is "I do not want a foreign government to hold a legally enforceable hook into my daily movement history", a Malaysian-operator app on Malaysian-law terms genuinely changes the picture. If your threat model is "no foreign cloud or mapping provider should touch my data", it changes almost nothing — and you would need to audit the full data path, map tiles included.

Malaysian developers building on location data have the same homework regardless of which navigation app they ship: the Personal Data Protection Act framework treats location trails as personal data when a living individual is identifiable, and "our processor is overseas" is a question to answer in your documentation, not a surprise to discover in an audit.

A five-minute audit you can run yourself

You do not need a prime minister's briefing to do this. Any app with public terms can be checked the same way we checked Waze above. This script pulls a terms-of-use page and extracts the governing-law sentence:

#!/usr/bin/env python3
"""Extract the governing-law clause from an app's Terms of Service."""
import re
import sys
import urllib.request


def governing_law(url: str) -> str | None:
    req = urllib.request.Request(
        url, headers={"User-Agent": "Mozilla/5.0 (compatible; tos-audit)"}
    )
    html = urllib.request.urlopen(req, timeout=20).read().decode("utf-8", "ignore")
    text = re.sub(r"<[^>]+>", " ", html)
    text = re.sub(r"\s+", " ", text)
    hits = re.findall(
        r"(?:governing law|governed by|exclusive jurisdiction)[^.]{0,220}\.",
        text,
        flags=re.IGNORECASE,
    )
    return hits[0].strip() if hits else None


if __name__ == "__main__":
    if len(sys.argv) != 2:
        sys.exit("usage: tos_audit.py <terms-url>")
    print(governing_law(sys.argv[1]) or "No governing-law clause found")

Run it against Waze's terms and you get the Tel Aviv clause in one hit. Run it against whatever app you are evaluating — a transit app, a delivery app, an e-wallet — and you learn in thirty seconds which legal system your dispute would live under. Pair that with a quick read of the privacy policy's data-controller and data-transfer sections, and you have done more diligence than most users did of Waze itself, until yesterday.

The bottom line

PMX's claim about Waze's governing law is accurate as a matter of public record, and steering users toward a local alternative is a coherent move inside Malaysia's wider digital-sovereignty agenda — the same agenda that produced the JKSN discussion of MyDigital ID, PQC, and NCII protection. But sovereignty is a stack, not a switch: TuJu is a Malaysian-controlled contract layer over a highway-centric product that still leans on Google map data, with a 2.6-star iOS rating and rough edges around it. Use it where it fits — highway runs with live CCTV and toll arithmetic are genuinely better served by an LLM-backed feed — keep Waze where its routing network is still years ahead, and let the deciding question be the one the JKSN meeting actually raised: who holds your movement trail, and under whose law.