Hey Utahns, Your Car Is Spying On You

This news item came across the wire today:

Major automakers are failing privacy tests. According to a new study from the Mozilla Foundation, cars collect a significant amount of personal data that can be sold or shared. The analysis gave a privacy warning label to each of the 25 major automakers studied.

In a trio of articles on Mozilla's website, the tech company cites dozens of privacy breeches associated with consumers and their cars.

From the article: It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy

1. They collect too much personal data (all of them)

We reviewed 25 car brands in our research and we handed out 25 “dings” for how those companies collect and use data and personal information. That’s right: every car brand we looked at collects more personal data than necessary and uses that information for a reason other than to operate your vehicle and manage their relationship with you. For context, 63% of the mental health apps (another product category that stinks at privacy) we reviewed this year received this “ding.”

4. We couldn’t confirm whether any of them meet our Minimum Security Standards

It’s so strange to us that dating apps and sex toys publish more detailed security information than cars. Even though the car brands we researched each had several long-winded privacy policies (Toyota wins with 12), we couldn’t find confirmation that any of the brands meet our Minimum Security Standards.

Our main concern is that we can’t tell whether any of the cars encrypt all of the personal information that sits on the car. And that’s the bare minimum! We don’t call them our state-of-the-art security standards, after all. We reached out (as we always do) by email to ask for clarity but most of the car companies completely ignored us. Those who at least responded (Mercedes-Benz, Honda, and technically Ford) still didn’t completely answer our basic security questions.

A failure to properly address cybersecurity might explain their frankly embarrassing security and privacy track records. We only looked at the last three years, but still found plenty to go on with 17 (68%) of the car brands earning the “bad track record” ding for leaks, hacks, and breaches that threatened their drivers’ privacy.

What Data Are Cars Collecting?

Amazingly, Mozilla found 17 pages worth of data that our cars are collecting about us. Seventeen pages!

Some of it was innocuous, like name and phone number. But some of it was downright scary -- your date of birth, your location at all times, credit and/or debit card numbers, social security number, medical information and even fingerprints -- and that's just the tip of the iceberg.

Said one Mozilla researcher: "Practically all of the privacy policies we looked at used qualifying language when listing the data points they collect. Words like ‘such as,’ ‘including,’ or ‘etc.’ tell us we are only getting a sample of what is collected and not the full picture.”

This summation by Mozilla should make all of us stand up and take note:

With car companies' long history of lying, cheating, and putting profit before everything, including human lives, we’re worried about what they have planned for the future.