GabyA new study has shocked drivers. It turns out that 25 leading automotive brands collect and share deeply personal data. Cars from major brands are monitoring drivers’ private lives — including health information, weight, and even sexual activity.
Cars monitor drivers’ personal lives.
“Smart” cars from major global brands, including Nissan, Volkswagen, and Tesla, collect personal data from drivers using sensors, microphones, cameras, software, and more. After gathering this information, automakers share it with technology companies, governments, car dealers, data brokers, and even other drivers.
Beyond health and sexual status, the data can include driving habits, inferred intelligence, facial expressions, immigration status, race, and even genetic information. Independent experts have also warned that cybercriminals could gain remote access to vehicles and steal drivers’ personal data.
A team from the Mozilla Foundation conducted the study. They told the Daily Mail that cars — whether fully electric, hybrid, or gasoline — were the worst category of products they’d ever tested for privacy.
Many car brands engage in “privacy laundering”: they use language that suggests they protect consumer privacy while actually doing very little to do so.
Jen Caltrider says many people still think of their car as a private space where they can call a doctor, have a personal conversation with a child on the way to school, cry over a breakup, or drive to a place they wouldn’t want anyone to know about. That perception is increasingly inaccurate. New cars are collecting vast amounts of personal information.
Some cars even collect data about sexual activity.
Researchers looked at the privacy practices of companies and the apps that connect to vehicles, not at individual cars. By that measure, the worst offender in their analysis was the Japanese brand Nissan. Its cars connect with the MyNissan app, which lets owners remotely start and stop the vehicle, lock and unlock doors, flash the headlights, and more.
The app can also collect and share drivers’ sexual information, diagnostic data, genetic information, and other confidential details for targeted marketing. Nissan admits in its privacy policy that it collects a wide range of personal information, though it doesn’t specify exactly how. The app’s Google Play listing once claimed it “does not share data with third parties,” a statement that was later corrected.
Kia’s privacy policy says it may collect information about “sex life or sexual orientation.” Is there a legitimate reason for a carmaker to need that? Probably not.
Unclear privacy rules facilitate surveillance.
Tesla isn’t the worst offender the researchers examined, but it still has privacy shortcomings. The company says in its documentation that it does not sell or share personal information with third parties.
Still, researchers say it’s hard to fully trust Elon Musk’s multibillion-dollar company. Tesla has a questionable track record when it comes to protecting people’s privacy inside its electric cars and outside, where outward-facing cameras can capture others.
The other significant violator was Volkswagen. The company collects personal details (age, gender) and driving behavior (seatbelt use, braking habits) for targeted marketing. That data comes from the myVW app, the We Connect ecosystem of online services, VW dealers, or a combination of those sources.
Toyota, the world’s best-selling automaker, publishes an “almost incomprehensible galaxy” of 12 privacy policy documents. Yet it still collects driver-behavior data such as acceleration, speed, direction of travel, and image data from in-car cameras and sensors.
Mercedes-Benz, known for luxury design, could potentially share personal information for advertising, but it couldn’t explain its complex privacy policy clearly to researchers.
Ford uses a voice-recognition system to “draw conclusions about you” — inferring likely preferences and other characteristics — which it may share with third parties.
Renault raised the least concern; it’s “not that bad” on privacy, but researchers couldn’t confirm whether it encrypts personal data stored in its vehicles.
They collect personal data not only from drivers but also from passengers.
Overall, experts found that passengers can’t properly consent to this data collection because consent is often treated as “implied” simply by being a passenger. For example, Subaru considers a passenger a user, which it treats as agreement to its privacy policy.
Several brands (including Nissan and Ford) also state that the driver is responsible for informing passengers about the vehicle’s privacy policy. Researchers warn that serious data breaches are common — for example, the leak of personal information for millions of Toyota customers earlier this year.
