Your car might have more insight into your life than you think.
A group of federal lawsuits involving companies like Honda, Toyota, Volkswagen, General Motors, and Ford claimed that their vehicle infotainment systems were downloading and storing private text messages and call logs from connected phones.
It was highlighted that, in some cases, GM gathered precise location data as frequently as every three seconds.
Although the cases were dismissed, it wasn’t due to a court ruling that the technology couldn’t do what the plaintiffs alleged.
Data Disappearance
In GM’s case, for instance, the district court determined that the plaintiffs failed to demonstrate sufficient harm according to Washington’s privacy law. Additionally, it mentioned that they had not shown that GM itself assessed, utilized, or even had the capacity to retrieve the data stored in the vehicle.
This didn’t mean GM was secretly reading drivers’ messages, but neither did the case dismissal address the pivotal tech issue. Plaintiffs asserted that the infotainment system automatically downloaded and retained text messages and call logs from connected devices, and the court didn’t rule out this possibility.
That ambiguity adds to the challenge for consumers trying to grasp modern connected cars. Your phone communicates with your car, which in turn communicates with manufacturer servers. Companion apps also interface with various companies.
Understanding exactly what information is exchanged—and where it ultimately lands—can be unexpectedly complicated.
A recent study by researchers at Northeastern University and Consumer Reports illuminates this issue further.
Researchers examined 21 newer vehicle models and 30 accompanying smartphone apps. They discovered that 19 of the 21 cars reached out to at least one external third party over Wi-Fi, including some major tech corporations.
The smartphone apps enhanced these connections even more.
Seven of the 30 apps sent sensitive identifiers—like VINs, email addresses, phone numbers, or precise locations—to firms tied to advertising and analytics. The study also suggested that linking a manufacturer’s app to the vehicle could significantly increase the number of external firms receiving data.
Now, let’s look at insurance.
Driver Profiles
General Motors presents one of the clearest records of what can transpire once driving data leaves a car.
GM once had a feature known as OnStar Smart Driver, which allowed customers to track their driving habits.
According to the Federal Trade Commission, GM and OnStar collected precise location and driving behavior data from millions of vehicles and sold this information to third parties, including consumer-reporting agencies.
The details could get quite specific.
The FTC indicated that it covered instances of hard braking, speeding, and late-night driving. Some users had their precise location data collected as frequently as every three seconds.
Consumer-reporting agencies like LexisNexis and Verisk then utilized GM’s driving data to create reports on individual drivers. Insurance companies reportedly referenced these reports to establish rates, and in some situations, deny coverage.
This isn’t about targeted ads or a data broker tracking your favorite coffee shop. It directly influences your car insurance costs.
One consumer expressed frustration to GM, stating that while he understood OnStar would monitor him, he didn’t realize that this information could be shared with third parties affecting his insurance rates.
GM has since discontinued Smart Driver and its telematics agreements with LexisNexis and Verisk, explaining that they ended the program based on feedback from customers.
The FTC didn’t just stop there. Earlier this year, it finalized an order requiring GM to obtain explicit consent before collecting or sharing particular connected vehicle data and prohibiting the company from sharing covered geolocation and driver-behavior information with consumer-reporting agencies for five years.
Behind the Data
Deciphering all of this isn’t as straightforward as you might assume.
The Northeastern researchers constructed a Faraday enclosure at Consumer Reports’ testing facility in Connecticut to block cellular signals and isolate the Wi-Fi communications from the vehicles. They monitored where the cars and their apps were attempting to connect.
While they were able to identify numerous companies receiving the traffic, they couldn’t consistently see what the content was; a lot of it was encrypted.
This isn’t proof that all transmissions contained sensitive personal information. However, it does suggest that even researchers focused on this very issue sometimes can’t ascertain exactly what data is flowing between today’s vehicles and the companies they contact.
For the everyday car owner, the visibility is even dimmer.
You purchase the vehicle. You download the app. You consent to the terms. Perhaps you activate remote start, navigation, emergency help, or one of the many other connected features that new vehicles have.
Most people aren’t contemplating the advertising and analytics operations working behind the scenes.
And why would they?
Two-Way Connectivity
This doesn’t imply that connected car technology is inherently negative.
For example, emergency services need to know the vehicle’s location. Navigation requires location data. An app that enables remote starting of the car clearly must communicate with it.
Yet, there’s a significant distinction between gathering data necessary for a service and allowing that information to flow throughout an ecosystem that the owner hardly knows exists.
Consumers shouldn’t have to become privacy experts to grasp this difference.
Before activating connected features, I would really want to know some key aspects.
- What information is the car collecting?
- Who receives this data?
- Can they sell or share it?
- Is there an option to disable data collection?
- Could any of this data influence a consumer report regarding me?
For years, the narrative surrounding connected cars has been that they are superior, smarter, and more convenient—and perhaps they are. Just keep in mind: the connection runs both ways.
