Automakers including Stellantis have been rebuilding their in-car platforms using Google software. That might be one reason why so many are flunking Mozilla’s privacy test; indeed, nobody passed it.
Automakers “can collect deeply personal data such as sexual activity, immigration status, race, facial expressions, weight, health and genetic information, and where you drive,” with microphones, cameras, phones, and sensors in the car, as well as their car apps, web sites, and dealership systems. They combine the data to make inferences about buyer traits. None appear to use encryption in the car to keep this data safe.
The “* Privacy Not Included” survey was sent to major marques and was supplemented by researchers reading tirelessly through privacy policies and apps; the entire process took 600 hours.
The Mozilla Foundation reported that Nissan was the worst offender, admitting to taking in sexual activity, health data, and even genetic data, without saying how; they also said they could sell pretty much anything they collected to anyone.
Volkswagen was also a major offender, with demographics and driving behaviors taken fro marketing. The company also tagged Toyota, Kia, and Mercedes. The luxury automaker pre-installs TikTok in some of its cars. Some automakers obfuscate their actual policies in multiple documents, e.g. 12 different files for Toyota.
Renault was actually the least bad, surprisingly since it works with Nissan. Mozilla credited European data laws, though they would also apply to Volkswagen and Mercedes.
Sharing with law enforcement is generally considered to be fraught with danger as police requests in the past have sometimes been spawned by individual officers to track people down and settle grudges. For this reason, most tech companies require law enforcement to make formal requests; automakers do not appear to have this relatively minor bar in place.
As the report says, data breaches are also common; Toyota and Volkswagen both had massive data leaks, while Tesla staff watched videos of their owners from in-car cameras.
Former Chrysler marques
Former Chrysler marques had the worst privacy policy web site, according to the company. “Teeny, tiny font, the most frustrating navigation, no way to search through the privacy policy for keywords, no way to download the full privacy policy to keep a record of it.” The actual privacy policies “aren’t much better.”
A California supplement notes that sensitive information about people under 16 is not sold; however, that doesn’t apply to anyone else. The key sentence is:
we may sell or share: identifiers, usage data, customer records, geolocation, commercial information, and inferences to or with affiliates and subsidiaries, dealers, marketing and advertising partners, and analytics providers.
FCA US notes that they collect a great deal of infroamtion through UConnect and the app—“your name, precise geolocation, Vehicle Identification Number (VIN), driver’s license number, and other government identifiers, browsing history, search history, biometric identifiers, such as fingerprints or facial templates…” — and they collect even more through data brokers and social media.
They also collect data from third party apps in UConnect, e.g. Amazon Alexa, and images captured with the vehicle cameras; and full trip data (including steering and ignition events, cruise control data, and such). This is all put together “to create a profile reflecting an individual’s preferences, characteristics, predispositions, behavior, attitudes, intelligence, abilities or aptitudes.”
Data cannot be deleted unless you live in a state (like California) with strong privacy laws or you live in Europe. You may however be able to reach out to SiriusXM and other third party providers to stop the data collection, but then emergency services will be stopped along with various vehicle updates. FCA US does say that they de-individualize data—stripping your name off when they use it internally—but this isn’t a foolproof process (see the conclusion).
Why this happens
The United States has almost no privacy laws which apply to companies; while law enforcement and government agencies are not allowed to snoop without a warrant, they get around this easily by buying commercial data about people. Nothing stops organized crime bosses or other malefactors from doing the same, since license plate tracking companies, camera operators, and phone companies are all happy to sell data on individuals at a low price. In theory some of these companies “anonymize” the data by stripping people’s names out, but it’s been proven to be easy to link the data to individual people.
