Modern cars are a nightmare for people who care about their privacy. Car manufacturers not only collect personal data from drivers on a large scale, but also special personal data about their health, ancestry and sex lives. To make matters worse, the auto industry is shadowy and vague about these data collection practices, most automakers resell this information to third parties, and consumers can do little to nothing about it.
Those are the main findings from Mozilla's latest edition of *Privacy Not Included. The tech company scrutinized the privacy policies of 25 automakers and concluded that all manufacturers collect too much personal information from customers.
Cars rolling off the assembly line today are equipped with state-of-the-art gadgets and technologies. Many of these additions benefit the safety of the driver and passengers it carries. Entrepreneur Elon Musk described such cars as "computers on wheels" several years ago.
"The conversation about what driving a computer means for the privacy of its occupants, however, has not really taken off yet," Mozilla said. The developer of the Web browser Firefox argues that automakers have quietly transformed into "powerful data-consuming machines" in recent years. "Machines that, because of all those boastful bells and whistles, have unparalleled power to watch, listen and collect information about what you do in your car and where you go."
Mozilla researchers spent more than 600 hours studying the privacy policies of 25 different car manufacturers. The resulting picture is not exactly reassuring.
One of the conclusions is that all of the manufacturers surveyed collect more personal information from drivers than is necessary to drive a vehicle safely and responsibly. To gather this data, they use a variety of sources: sensors and software embedded in the car, services drivers use while driving, the car manufacturer's smartphone app, and external sources such as Google Maps.
The ways in which car companies collect and share driver data are extensive and complicated, according to Mozilla. This is not limited to your personal data and information about your driving style: car manufacturers are also interested in information about your health, genetics, music you listen to, locations you visit, and even your sex life. They then use that information to gather more data on things like intelligence, skills and interests, Mozilla claims.
The majority of automakers (84 percent) sell this information for "business purposes" to third parties, including service providers and companies that deal in personal data. More than half (56 percent) say they will share your data with the government or investigative and intelligence agencies if they receive a request to do so. "The willingness of car companies to share your data is beyond uncanny. It has the potential to cause real harm and inspired our worst car and privacy nightmares (...) So while you're driving from A to B, you're funding your car's thriving side business in the data industry in more ways than one," the researchers write.
A whopping 92 percent of car manufacturers give drivers no control over their personal data. Only Renault and Dacia -both of which have the same parent company- mention in their privacy policies that drivers have the right to have their personal data deleted.
What is of great concern to the researchers is the lack of attention to cybersecurity. No manufacturer says out loud whether the data it collects is encrypted or not. That is "the bare minimum" in terms of security and privacy, according to the researchers. Inquiries yielded nothing. Most automakers ignored Mozilla's questions. Those that did respond did not provide complete answers to security questions.
According to Mozilla, there are several measures you can take as a consumer to somewhat limit the amount of data car manufacturers collect, including not installing the manufacturer's app, or disabling the sharing of your location data on your smartphone. But those are just drops in the ocean.
"Consent is an illusion," Mozilla concludes. "Often they ignore your consent. Sometimes they assume it. Car companies do that by assuming you have read and approved their policies before you get in their car (...) So when car companies say they have your 'consent' or won't do something 'without your consent,' that often doesn't mean what it should mean."
To make drivers more aware of car manufacturers' data collection practices and to form a fist against them, Mozilla has created an online petition.
