How to Keep Your Car From Spying on You

Your car is watching you. What can you do to stop it?

Many vehicles today and their related phone apps are packed with safety and convenience features, including digital maps, navigation linked to GPS and the internet, remote starting and vehicle locaters to find your car in a crowded parking lot. Many also have microphones for voice control and some have cameras that detect who is driving to adjust things such as the seat.

But those features and others can have a dark side: Many can track where you go and when, how fast you drive and how hard you brake, where you park and spend time, even what music or podcasts you listen to. Such information can be a gold mine for marketers and insurers—and a target for hackers.

Privacy researchers say car buyers may not realise they agree to have such data collected by the automaker when they sign the papers for a new vehicle or use the carmaker’s phone app.

The Mozilla Foundation, a technology-focused nonprofit, examined the privacy practices of 25 car brands. Its conclusion: “These are the worst of any category we’ve reviewed,” says Jen Caltrider, director of the group’s Privacy Not Included program. Among its findings are that most carmakers collect personal information, give customers little control over it, and may sell or share it with others.

Privacy experts say they also are concerned about provisions in car-maker privacy policies that allow them to share driver information with law-enforcement authorities under certain circumstances—sometimes without a warrant.

On May 14, the Federal Trade Commission told vehicle makers that it was  monitoring their actions  regarding car data. “Cars are much like mobile phones when it comes to revealing consumers’ persistent, precise location,” the agency said in a blog post. It added that companies “do not have the free license to monetise people’s information beyond purposes needed to provide their requested product or service….”

The industry response

The car industry says that the combination of vehicle data monitoring, GPS and wireless communication—a field known as telematics—provides important features, some of them safety-related. Some systems can detect when you’ve been in an accident and call emergency services, or locate a car if it’s stolen. They can help you avoid a traffic jam or potential road hazards. Cars also can give you maintenance reminders, such as when a vehicle needs an oil change or new tires, and allow the carmaker to track the durability and function of certain components for future improvements.

A vehicle-industry trade group in 2014 issued  voluntary guidelines  for the collection and use of car data. The group, now called the Alliance for Automotive Innovation, says its members should give car owners and lessees choice in the “collection, use and sharing” of certain information and that this information should be collected “only as needed for legitimate business purposes.”

Some privacy groups, however, say the voluntary guidelines aren’t specific enough and aren’t always followed.

“It seems like an empty promise,” says Thorin Klosowski, a security and privacy expert with the nonprofit Electronic Frontier Foundation. “Car companies are becoming tech companies. Self-policing hasn’t been shown in other tech industries to be a reliable way for companies to operate.”

What is needed, according to these experts, is a federal privacy-protection law along the lines of the European Union’s General Data Protection Regulation. The car industry, for its part, also  backs a federal privacy law , in part to have a nationwide standard as a number of states have adopted their own, differing laws.

Most carmakers issue their own lengthy privacy policies stating how they collect and disseminate car data. Some state that they can share or sell the information to third parties including marketers if the car owner agrees to it.

Among the six biggest sellers of vehicles in the U.S., Ford Motor says customers can turn off data and location sharing with the company. It says it “doesn’t sell any connected-vehicle data to brokers, period.”  General Motors says it is “fostering trust through responsible data practices, enhanced user controls and clear benefits for customers.” Toyota says it gives customers “transparency and choice” in how vehicle data is collected and used and that they can “turn off all data transmission.”

Stellantis, owner of Chrysler, Dodge and Jeep, says any data it collects “is in accordance with applicable state privacy laws .  Accordingly, Stellantis provides customers with a way to opt out of data collection.” Honda says it is “very clear about what we collect and how our owners can opt out” and “when we might share collected data with third parties.” Hyundai declined to comment and deferred to the Alliance for Automotive Innovation for a response.