Cars have eyes and are spying on you: How in-car tech can breach data privacy

Tech-loaded cars may offer a lot of convenience to owners, but can also become a data privacy nightmare. Study by a California-based agency reveals that modern cars with connected features through apps and satellite collect massive personal data of the user and share externally. The agency, called Mozilla Foundation, reviewed 25 car brands operating in United States and European countries and found all of them breaching data privacy. The study has raised a debate whether cars should also be monitored for practically spying on the owner.

Nissan, Tesla, Kia, Hyundai Motor, Toyota, Volkswagen and BMW are some of the global brands who have been found breaching data privacy. The study says vague data security standards while using in-car apps, telematics, digital controls can steal personal data. These may include sensitive personal information to sexual activity and more. Almost every car manufacturer studied have admitted that they are collecting such personal information which they share with government or law enforcement agencies.

The survey, called Privacy Not Included, has raised a big concern given that these vehicles are also susceptible to hacking. Jen Caltrider, the study’s research lead, says, “Cars seem to have really flown under the privacy radar and I’m really hoping that we can help remedy that because they are truly awful. Cars have microphones and people have all kinds of sensitive conversations in them. Cars have cameras that face inward and outward."

The survey also says that cars have the worst data privacy record among dozen other products ranging from connected home appliances like Google or Alexa, fitness trackers to even smart speakers. The survey marked Nissan as the worst among all the brands studied. The survey says the Japanese auto giant is “probably the worst car company we reviewed, and that says something because all car companies are really bad at privacy." Nissan says it can draw inferences from the data to create user profiles which reflect the the person's ‘preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes’. The carmaker has also admitted that it can even collect 'genetic information' or 'genetic characteristics'. However, Nissan did not explain how it collects data on sexual activity of its users.

Kia and Hyundai are not too far behind either. Caltrider says, "Kia mentions sex life. General Motors and Ford both mentioned race and sexual orientation. Hyundai said that they could share data with government and law enforcement based on formal or informal requests."

Tesla also scored high on Mozilla’s “creepiness" index. According to the survey, opting out of data collection in a Tesla car is difficult as its privacy notice says the EV maker may not be able to notify drivers “in real time" of issues that could result in “reduced functionality, serious damage, or inoperability."

Out of the 25 brands surveyed, 19 said they can sell personal data, while half of them are ready to share these information with governments on request. Renault and Dacia are the only two carmakers who offer drivers to delete all data collected by their cars.