BOSTON (AP) 鈥� Most major car manufacturers admit they may be selling your personal information 鈥� though they are vague on the buyers, a new study finds, and half say they would share it with the government or law enforcement without a court order.
The proliferation of sensors in automobiles 鈥� from telematics to fully digitized control consoles 鈥� has made them prodigious data-collection hubs.
But drivers are given little or no control over the personal data their vehicles collect, researchers for the nonprofit Mozilla Foundation said Wednesday in their . Security standards are also vague, a big concern given automakers鈥� track record of susceptibility to hacking.
鈥淐ars seem to have really flown under the privacy radar and I鈥檓 really hoping that we can help remedy that because they are truly awful,鈥� said Jen Caltrider, the study鈥檚 research lead. 鈥淐ars have microphones and people have all kinds of sensitive conversations in them. Cars have cameras that face inward and outward.鈥�
Unless they opt for a used, pre-digital model, car buyers 鈥渏ust don鈥檛 have a lot of options,鈥� Caltrider said.
Cars scored worst for privacy among more than a dozen product categories 鈥� including fitness trackers, reproductive-health apps, 鈥� that Mozilla has studied since 2017.
Not one of the 25 car brands whose privacy notices were reviewed 鈥� chosen for their popularity in Europe and North America 鈥� met the minimum privacy standards of Mozilla, which promotes open-source, public interest technologies and maintains the Firefox browser. By contrast, 37% of the mental health apps the non-profit reviewed this year did.
Nineteen automakers say they can sell your personal data, their notices reveal. Half will share your information with government or law enforcement in response to a 鈥渞equest鈥� 鈥� as opposed to requiring a court order. Only two 鈥� Renault and Dacia, which are not sold in North America 鈥� offer drivers the option to have their data deleted.
The automakers are vague on disclosing to whom they are selling what they collect, though the researchers have little doubt it includes data brokers, marketers and dealers. Partners with installed products and services, including SiriusXM, Google Maps and Onstar, are also amassing data.
鈥淚ncreasingly, most cars are wiretaps on wheels,鈥� said Albert Fox Cahn, a technology and human rights fellow at Harvard's Carr Center for Human Rights Policy. 鈥淭he electronics that drivers pay more and more money to install are collecting more and more data on them and their passengers."
鈥淭here is something uniquely invasive about transforming the privacy of one鈥檚 car into a corporate surveillance space,鈥� he added.
A trade group representing the makers of most cars and light trucks sold in the U.S., the Alliance for Automotive Innovation, took issue with that characterization. In a to U.S. House and Senate leadership, it said it shares 鈥渢he goal of protecting the privacy of consumers.鈥�
It called for a federal privacy law, saying a 鈥減atchwork of state privacy laws creates confusion among consumers about their privacy rights and makes compliance unnecessarily difficult.鈥� The absence of such a law lets connected devices and smartphones amass data for tailored ad targeting and other marketing 鈥� while also raising the odds of massive information theft through cybersecurity breaches.
The Associated Press asked the Alliance, which has to provide car owners and independent repair shops with access to onboard data, if it supports allowing car buyers to automatically opt out of data collection 鈥� and granting them the option of having collected data deleted. Spokesman Brian Weiss said that for safety reasons the group 鈥渉as concerns鈥� about letting customers completely opt out 鈥� but does endorse giving them greater control over how the data is used in marketing and by third parties.
In a 2020 52% of Americans said they had opted against using a product or service because they were worried about the amount of personal information it would collect about them.
On security, Mozilla's minimum standards include encrypting all personal information on a car. The researchers said most car brands ignored their emailed questions on the matter, those that did offering partial, unsatisfactory responses.
Japan-based Nissan astounded researchers with the a stark contrast with Big Tech companies such as Facebook or Google. 鈥淪ensitive personal information鈥� collected includes driver's license numbers, immigration status, race, sexual orientation and health diagnoses.
Further, Nissan says it can share 鈥渋nferences鈥� drawn from the data to create profiles "reflecting the consumer鈥檚 preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.鈥�
It was among six car companies that said they could collect 鈥済enetic information鈥� or 鈥済enetic characteristics," the researchers found.
Nissan also said it collected information on 鈥渟exual activity." It didn't explain how.
The all-electric Tesla brand scored high on Mozilla鈥檚 鈥渃reepiness鈥� index. If an owner opts out of data collection, Tesla鈥檚 privacy notice says the company may not be able to notify drivers 鈥渋n real time鈥� of issues that could result in 鈥渞educed functionality, serious damage, or inoperability.鈥�
Tesla did not respond to questions about its data practices.
In a statement, Nissan said it takes 鈥減rivacy and data protection for our consumers and employees very seriously. When we do collect or share personal data, we comply with all applicable laws and provide the utmost transparency.鈥�
Mozilla's Caltrider credited laws like the 27-nation European Union's General Data Protection Regulation and California's Consumer Privacy Act for compelling carmakers to provide existing data collection information.
It's a start, she said, by raising awareness among consumers just as occurred in the 2010s when a consumer backlash prompted TV makers to offer more alternatives to surveillance-heavy connected displays.
Frank Bajak, The Associated Press
