The feeling of freedom when driving alone on the highway is now an illusion: packed with cameras and sensors, today’s cars collect vast amounts of data, which, without the driver’s knowledge, are sent to insurance companies and other unknown parties. The collection and transmission of passenger data is mentioned in the terms of use and privacy policies of car manufacturers, but in reality no one bothers to read these long and difficult to understand texts.
The car can, among other things, track your routes, record who else is in the vehicle with you, what you listen to on the radio, whether you’re wearing a seatbelt, whether you’re speeding or braking suddenly. And while sensors can make driving safer, the data can have a variety of uses. Car manufacturers aren’t required to disclose who they sell the data to, but insurance companies are among their biggest customers and sometimes use the information to set higher premiums for certain drivers. The issue affects most modern cars that are connected to the internet. According to consulting firm McKinsey, 50% of vehicles on the road in 2021 were connected to the internet, a percentage that is expected to rise to 95% by 2030.
The Mozilla Foundation, the maker of Firefox, analyzed the privacy policies of 25 car manufacturers in 2023. None met the security and privacy standards the foundation uses to compare companies. Mozilla researchers even said that cars were “the worst product category we’ve ever reviewed for privacy.”
According to Mozilla’s report, manufacturers reserve the right to collect name, age, weight, financial details, facial expressions, psychological state and other characteristics. Kia’s policy, for example, says the company can collect sensitive data about drivers’ “sex lives” and health. A Kia spokesperson said that no information about customers’ intimate lives is ever collected and that this reference simply reflects California’s definition of sensitive data. Kia added that it only sells data to insurance companies with the driver’s consent. In Mozilla’s report, 19 of the 25 manufacturers analyzed say in their policies that they reserve the right to sell the collected data.
In the US, state and federal authorities have filed lawsuits against General Motors, accusing it of selling location data without consent. Other examples include Honda and Hyundai, which have been accused of similar practices by US senators.
“They’re taking all the information they collect about you, and there’s a lot of it, and using it to make inferences about who you are, how intelligent you are, what your psychological profile is, what your political beliefs are,” said Jen Caltrider, head of research at Mozilla. According to her, there are no clear rules for using this data. It could potentially be used for targeted advertising or end up in the hands of potential employers making hiring decisions. Law enforcement can even buy vehicle data when they can’t get a search warrant. In the US, a driver of a General Motors car asked for and received copies of his data from the company, only to discover that it had been sent to LexisNexis, a consumer data agency.
The 130 pages he received detailed every move he and his wife had made over the past six months. According to his complaint in the New York Times, the insurance company admitted that this data was one of the reasons his insurance premiums increased by 21%.
The Federal Trade Commission in the US intervened in this matter, banning GM from selling data for five years. After that period, the company can only resume with the explicit consent of drivers. The situation is a little better in Europe, where there are rules for some sensitive data. Consumers also have the right to request copies of data and their deletion. However, car manufacturers can collect data as long as this is stated in the privacy policy. “Europeans still depend on privacy policies,” said Caltrider. “And you have to be content with the promise that the rules will be enforced, which is not always the case, especially with cars.”
And the problem could grow in the future, as the US is expected to force car manufacturers to install infrared cameras that detect whether a driver is drunk or excessively tired. This data will be collected for safety reasons, but manufacturers may find ways to use it for other purposes as well.