These days we’re connected to the world 24/7, primarily through our smartphones but also by other devices that can track our whereabouts and capture personal data such as sleep patterns, heart rate, and more, while surveillance cameras mounted everywhere from house doors to corporate buildings monitor our every move.
Although your car might seem like a last refuge, they’re also becoming increasingly connected, thanks to cameras and sensors that are monitoring and recording everything from eye movements to moods. Connected car data has been used to alert insurance companies if drivers are accelerating too fast and braking too hard and to supply law enforcement with information on crashes and more. Some automakers have even hinted that they know if you’re having sex in the cabin. And at least right now, there’s very little you can do about it.
Headlines, Headaches, and Hackles
Within the last year, the issue of connected car privacy has made headlines, caused headaches for some vehicle owners, and raised the hackles of federal officials. In September 2023, the Mozilla Foundation’s *Privacy Not Included project outlined that connected cars stood out as overly aggressive collectors of personal data compared to other technologies it examines.
“Every one of the 25 car brands across 15 car companies earned our *Privacy Not Included warning label, which is a first,” said Jen Caltrider, Mozilla’s lead researcher for the project.
Recent events have borne out Mozilla’s conclusions. In March, The New York Times published an exposé on how automakers work with data brokers that in turn sell driver data to insurance companies. The story detailed how several owners of General Motors brand vehicles saw their insurance premiums spike even though they didn’t know they signed up for the automaker’s OnStar Smart Driver service. GM described the feature within its connected car apps as using “driving insights to become a smarter, safer driver.”
Connected Cars Catch the Attention of the Feds
Connected car data privacy has also caught the attention of Sen. Edward Markey, D-Mass., a frequent critic of the auto industry’s tech practices. In December 2023, Markey sent letters to 14 car manufacturers “urging them to implement and enforce stronger privacy protections in their vehicles.” In May, he called on the Federal Trade Commission (FTC) to investigate the car industry’s data privacy practices.
In a recent blog post, the federal agency warned auto manufacturers they “should take note that the FTC will take action to protect consumers against the illegal collection, use, and disclosure of their personal data.”
Trading Data for Services
It can be argued that cars are simply joining other connected devices that constantly collect and share personal data, but there are significant differences between the two, Amico said. When posting pics and info on social media, he said most people understand they’re trading personal data like location, search, and buying habits for services.
But a new car is a product—one that costs tens of thousands of dollars—and Mozilla’s Caltrider noted vehicle data privacy is more difficult to navigate and less transparent than the free and paid services that most tech companies offer.
Flying Under the Data Privacy Radar
Connected cars “flew under the radar” as aggressive collectors of personal data, Caltrider said, and represent a completely new and difficult category for privacy researchers. “It took us about a month to even wrap our brains around how to research the privacy of cars,” she said. They’re also the first product category in which all the examples evaluated failed the Mozilla Foundation privacy tests.
Auto Industry Consumer Privacy Protection Principles
The trade groups the Alliance of Automobile Manufacturers and the Association of Global Automakers, which at one time represented most major automakers, released a set of voluntary privacy principles back in 2014. The two groups merged into the Alliance for Automotive Innovation in 2019, and the principles were later updated in 2022.
“The auto industry Privacy Principles includes things like data minimization and transparency, which they didn’t even come close to complying with,” Caltrider said.
Collecting Information on Sexual Activity
Of all the data that car companies can potentially capture, one of the most eye-opening was about people having sex in vehicles. “One of the things that everybody latched onto was Nissan and Kia saying they could collect information on your sex life or your sexual activity,” Caltrider said.
Top Consumer Data Privacy Concerns
Even more so than consumer concerns over information being handed over to law enforcement, consumers are concerned about data going to insurance companies, Amico said. “We asked consumers what they cared about, and that was number one,” he said.
How to Protect Your Data
Caltrider said there’s not a lot consumers can do at present to protect their data in modern connected vehicles. “You can do things like don’t download a car’s app or try to opt out of things, but you might get opted back in,” she said. “The best thing consumers can do is to push for a strong, consumer-focused federal privacy law. We don’t have one, but Europe does.”
Despite the warnings and increasingly intrusive collection practices, data privacy still appears to be way down the list of car buyers’ concerns. “Most people think about cost, reliability, safety, availability, things like that,” Caltrider said. “A car means freedom and independence for many people, and the tracking of data and the monitoring is hidden.”
