Privacy: Vehicle owners have little control over data collected
By Frank Bajak | The Associated Press
Most major car manufacturers admit they may be selling your personal information —though they are vague on the buyers, a new study finds, and half say they would share it with the government or law enforcement without a court order.
The proliferation of sensors in automobiles — from telematics to fully digitized control consoles — has made them prodigious data-collection hubs.
Heavy traffic heads south on Interstate 93 over the Zakim Bridge on Friday in Boston. A study released Wednesday found that most major brands admit they may be selling your personal data. MICHAEL DWYER — THE ASSOCIATED PRESS
But drivers are given little or no control over the personal data their vehicles collect, researchers for the nonprofit Mozilla Foundation said Wednesday in its latest “Privacy Not Included” survey. Security standards also are vague, a big concern given automakers’ track record of susceptibility to hacking.
“Cars seem to have really flown under the privacy radar and I’m really hoping that we can help remedy that because they are truly awful,” said Jen Caltrider, the study’s research lead. “Cars have microphones and people have all kinds of sensitive conversations in them. Cars have cameras that face inward and outward.”
Unless they opt for a used, pre-digital model, car buyers “just don’t have a lot of options,” Caltrider said.
Cars scored worst for privacy among more than a dozen product categories — including fitness trackers, reproductive-health apps, smart speakers and other connected home appliances — that Mozilla has studied since 2017.
Not one of the 25 car brands whose privacy notices were reviewed — chosen for their popularity in Europe and North America — met the minimum privacy standards of Mozilla, which promotes open-source, public interest technologies and maintains the Firefox browser. By contrast, 37% of the mental health apps the nonprofit reviewed this year did.
Nineteen automakers say they can sell your personal data, their notices reveal. Half will share your information with government or law enforcement in response to a “request” — as opposed to requiring a court order.
The automakers are vague on disclosing to whom they are selling what they collect, though the researchers have little doubt it includes data brokers, marketers and dealers. Partners with installed products and services, including SiriusXM, Google Maps and Onstar, also are amassing data.
“Increasingly, most cars are wiretaps on wheels,” said Albert Fox Cahn, a technology and human rights fellow at Harvard’s Carr Center for Human Rights Policy.
“There is something uniquely invasive about transforming the privacy of one’s car into a corporate surveillance space,” he said.
The Alliance for Automotive Innovation, the industry’s largest trade group, took issue with that characterization. In a letter sent Tuesday to U.S. House and Senate leadership, it said it shares “the goal of protecting the privacy of consumers.”
It called for a federal privacy law, saying a “patchwork of state privacy laws creates confusion among consumers about their privacy rights and makes compliance unnecessarily difficult.” The absence of such a law lets connected devices and smartphones amass data for tailored ad targeting and other marketing — while also raising the odds of massive information theft through cybersecurity breaches.
Japan-based Nissan astounded researchers with the level of honesty and detailed breakdowns of data collection its privacy notice provides, a stark contrast with Big Tech companies such as Facebook or Google. “Sensitive personal information” collected includes driver’s license numbers, immigration status, race, sexual orientation and health diagnoses.
The automaker also said it can share “inferences” drawn from the data to create profiles “reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes.”
It was among six car companies that said they could collect “genetic information” or “genetic characteristics,” the researchers found.