Photography by Nico Di Pasquale moment | Getty Images
So-called connected cars, vehicles equipped with Internet access, are becoming the norm, and their proliferation is raising alarm bells for consumer data privacy advocates.
By 2030, more than 95% of passenger vehicles sold will likely have built-in connectivity, according to Counterpoint Technology Market Research. This allows vehicle manufacturers to offer functionality related to safety, security, predictive maintenance, and forecasting. But it also opens the door for companies to collect, share or sell data about driving habits and other personal information that people may not want to share.
Most automakers provide options to opt out of unnecessary data sharing, but as with many other consumer technologies where money can be made from selling data, these settings are often buried within menus, according to Parv Sharma, a senior analyst for the company. Counterpoint. A 2021 McKinsey report predicted that various use cases for automotive data monetization could generate annual revenues of $250 billion to $400 billion for industry players by 2030.
To be sure, there may be good reasons to collect driver and vehicle data for safety and functionality purposes, and it may be difficult or impossible to opt out of some essential services, such as emergency and security-related data sharing. James Hodgson, director of smart mobility and automotive research at global technology intelligence firm ABI, said predictive maintenance is among the reasons for more data sharing, allowing manufacturers to identify a used part in their fleet is broken sooner than expected in order to issue a recall. research.
But there are growing concerns about privacy as reports spread about car companies sharing driver data with insurance companies, and as car companies get into the insurance business themselves. The first is that driving habits and vehicle usage details can be reported to data collectors and shared with insurance companies to make pricing decisions. This should not be confused with the new model of usage-based insurance, offered by companies from Progressive to Root, which offers drivers the potential to earn lower rates if they specifically allow insurers to install devices in cars that track their behavior.
There are also concerns that sensitive personal information could be shared or sold to advertising companies, or inadvertently leaked in a way that bad actors could use.
“The amount of personal and vehicle information that car companies collect, share and sell sometimes exceeds what is necessary to get someone from point A to point B safely,” said Jane Caltrader, a privacy researcher at the Mozilla Foundation. “And it's getting worse.” . Mozilla's September report gave 25 major car brands failing marks when it comes to consumer privacy. The report was titled: “It's official: Cars are the worst product category we've ever reviewed for privacy.”
Many consumers simply don't know how their data is being used, or that it is being used at all. A Salesforce survey of more than 2,000 U.S. car owners and lessors found that few drivers understand the definition of a connected car and the data being collected. Although drivers may be willing to trade personal data for the benefits of a connected car — such as advanced personalization and cheaper insurance — not knowing how the data will be used could leave consumers vulnerable, industry specialists say.
There is no easy answer for customers looking to enhance their data privacy behind the wheel. One option, which is becoming increasingly less practical, is to buy an older car that can't collect your data.
Another option is to research the automaker's privacy protections before purchasing. This information can often be found on the car manufacturer's website or through an online search using keywords such as company name, privacy, and connected car. For example, many companies say in their privacy policies that they do not sell customer data, but that does not mean that they do not share it with third parties. What's more, the definition of a sale can be nuanced, depending on factors like state privacy laws, Caltrader said.
What Ford, Hyundai, Nissan and BMW say
Before you download the automaker's app for your car or sign up for a free trial of its connected services, review your options for opting out. Ford, for example, said it is offering customers a choice regarding any sharing of connected vehicle data. Hyundai said it allows owners and renters to choose whether they want to sign up for its connected services by accepting the terms and conditions at any time while they are using the car. Nissan also said it allows consumers to opt out of data collection. For its part, BMW said in a statement issued in September that it “allows vehicle drivers to make informed choices regarding the collection and processing of their personal information. Furthermore, we allow our customers to delete their data whether on their apps, vehicles or online.”
If you have already downloaded the app or signed up for connected services, ask your vehicle manufacturer about options to opt out. Additionally, in some states such as California, Colorado and Connecticut, consumers can submit requests to their car company regarding what personal information is collected and how it is shared, said Coupon Zweifel Keegan, D.C. managing director at the International Privacy Association. Professionals. A few states allow consumers to opt out of having their personal information sold, and more are moving in that direction, he added.
Just consider what you might be giving up in exchange for greater privacy protection. Choosing not to share data comes with trade-offs, because it often requires disabling useful or desired features, said Mo Al-Badour, consulting director at SBD Automotive. These features can include navigation, remote unlocking, and the ability to receive service-related updates.
Consumers should be sure to review their privacy settings periodically, Caltrader said.
The government is looking into car privacy regulations
There are several regulatory efforts underway to understand automakers' data-sharing practices and control potential privacy violations. For its part, the Enforcement Division of the California Privacy Agency announced a review of the connected vehicle industry during its board meeting in July 2023. A company spokesperson said that this review is ongoing, declining to comment further.
Automakers' data-sharing practices could also become fodder for federal action. Basic disclosure of data practices is not necessarily enough to avoid enforcement by the FTC, Zweifel Keegan said.
This issue is receiving wider attention. Sen. Edward J. Markey (D-Mass.), a member of the Senate Commerce, Science, and Transportation Committee, sent letters in December to 14 automakers urging them to implement and enforce stronger privacy protections in their cars.
“Today’s cars are smartphones on wheels,” he wrote in an email. He added: “We cannot allow automakers’ desires for profits to override the need to protect consumer privacy, which is why I requested answers from 14 companies about their practices related to data and privacy protections in their cars.” Self-regulation has failed. “The federal government must be a leader in the fight to protect consumers’ right to privacy,” Markey said.
“We urgently need a comprehensive federal consumer privacy bill that will address this circumstance and prevent a patchwork of state laws,” Eric Goldman, associate dean for research and professor at Santa Clara University School of Law, wrote in an email.
Perhaps the best scenario for automakers and consumers is that increased interest leads more car companies to use stricter data privacy practices as a marketing tool, similar to how Apple differentiates itself from competitors, Hodgson said. That's not the case today, he said, but at some point manufacturers may compete on the idea that consumers can easily turn off certain data.
