Is Your Car Spying On You?

The Car Chick (00:00)
Hey everyone, and welcome back to The Straight Shift. One of the questions that I frequently get from listeners is, what kind of car do you drive? And they’re often really surprised to hear that I drive a 2004 Mini Cooper S named Maggie. They’re not necessarily surprised by the fact that I drive a Mini or that she’s named for the late Margaret Thatcher, but that she’s so old. She’s literally old enough to drink now. So why, when I’m in the car business, buying cars for people,

why do I personally drive such an old car? Well, there are many reasons for that. Number one, I love her. Maggie is a part of my family and I get very attached to my cars. So I have no reason to want to get rid of her. I love her to death. I also don’t drive that many miles. So while she is a 2004, she only has 140,000 miles on her. Original clutch, original pretty much everything except the parts that I have

swapped out for performance reasons, although she does definitely need a new clutch this year. But I also just don’t want to deal with the high cost of buying a newer car. And quite frankly, I don’t want all of that technology. That and it’s almost impossible to find a stick shift and I will not drive anything but a stick shift. Anything else is just aiming. It’s not actually driving.

But going back to what I said about the technology, cars today are just technological marvels. They have more computers in them than the original space shuttle did.

And so much of that technology is really, really cool. They’re also a double-edged sword. I mean, it’s great that you can personalize nearly every setting in your car to where you’re positioned in the seat, the steering wheel, what your favorite radio stations are, and they can save those settings to be coordinated to your key fob, which is great if you and someone else in your household are driving that car

on a regular basis, you don’t have to constantly be resetting the car. You just open the door and it says, oh, that’s key fob one and I will set the settings to this. It’s really convenient. You also have all of the safety technology, which since people clearly are not going to learn to drive any better, I’m glad that that technology exists to keep everybody safe. But if you think about how it works, it’s made up of all these cameras and sensors.

You can easily connect your phone for hands-free calls or text messages, which I still say you should not do in the car. But you can also stream your favorite music right off your phone. A lot of manufacturers now have a smartphone app that you can download to your phone, and it lets you start the car, control certain aspects of the car, like turn on the heated seats, set the temperature. That’s fantastic to be able to have your car be the right temperature, whether…

It’s cold outside and you want it to be warm and the butt warmers are already turned on or if it’s hot outside and you want to run the AC before you get into the stifling hot car. Those things are absolutely amazing. Some cars can even alert you if the car thinks that you are getting drowsy or you’re not focusing on the road enough because it sees that your face is not paying attention. You’re not looking out the windshield. Cars can call for help and automatically send data to first responders if you’re in an accident.

Some cars can even help you find the nearest gas station or coffee shop along your route. Some cars can park themselves or even drive themselves to one extent or another. You can even shop in your car if it is Alexa enabled. It’s mind boggling when you think about just how fast this technology has advanced in cars. Just 20 years ago, Bluetooth was this amazing new thing and my car, Maggie, doesn’t have Bluetooth. I literally have nothing in that car other than what I need.

A gas pedal, a brake pedal, a stick shift. It’s all good. But other people want this technology. But we have to realize that there are some downsides to all of that tech. Yeah, they make cars more expensive and less reliable. We know that. And I would argue that they are making people actually worse drivers. But that’s not the downside that we’re going to talk about today. I come from an IT background. And so while the nerd in me gets so jazzed about all this cool technology,

that same nerd automatically starts thinking about, okay, how does this work? What’s the software behind it? What hardware does it need? What data does it need to do these amazing functions? And then who’s doing something with that data? Who can see it? Who is processing it? Who may be sharing it? So we’re gonna take a little bit of a walk on the dark side today on The Straight Shift and ask the question,

Is your car spying on you? And if it is, what can you do about it? So buckle up, put on your tinfoil hat, and let’s get into it.

Cars have had some kind of computer in them since the 1970s. What’s new is the sheer number of them and the amount of things in the car they control, which is pretty much everything. Cars today collect two different types of data, technical data and personal data. The technical data is about the car itself, how much gas is it using, the battery life, your brake wear, your tire pressures, oil and other fluid pressures and levels, engine health, et cetera.

All of that makes sense. The manufacturers use this data to help diagnose problems, improve their products, send that information to dealerships, and they can help you to remember to actually maintain your car properly. But the personal data is about you, the drivers and any passengers who are in the car. Sadly, nearly everything that you do in a car today can be tracked in some way, and you probably don’t even know it.

If you own a reasonably new car, let’s say 2016 or so, because that’s really when most of this technology started to become available in cars. So if you have a newer car, you probably have what is referred to as the infotainment system. That’s that user interface that sadly takes the place of the knobs and buttons that used to control everything from the heat to the AC to the radio station. And it gives you information on the condition of the car itself. We take it for granted these days. And when you bought that car,

the salesperson likely spent a good amount of time with you going over said technology and getting it set up for you. Whether it was pairing your phone to the Bluetooth, getting CarPlay or Android Auto setup, setting your favorite radio stations, programming your home address into the navigation system, maybe even pairing it to your garage door when you got home. In doing that, the salesperson probably just breezed right by the little privacy notice page that

pops up and just hit accept for you. You didn’t even get a chance to read it. And let’s be honest, you probably wouldn’t have read it anyway. Anytime we set up a new piece of technology, do we really take the time to read word for word the end user licensing agreement and the privacy notice? Probably not. It’s 20 freaking pages, legalese and techno babble.

Fortunately, there are expert groups whose sole purpose in the world is to read and analyze these data privacy notices in the digital world. And one of those organizations is the Mozilla Foundation. Those are the folks that created the Firefox browser. But the foundation is a global nonprofit that’s dedicated to keeping the Internet public, open, accessible to all, but also with a focus on trying to keep it as safe as possible, or at least

telling us the risks so that we can figure out how to keep ourselves as safe as possible. Now, the foundation has a program called Privacy Not Included. Mozilla folks are so funny. And they review technology products for privacy and data security. Everything from mobile phones and gaming systems, smartwatches, toys, speakers, cameras, apps, nanny cams, really anything with software and connectivity.

In 2023, they looked at cars and what they found was rather frightening. In their 2023 report, Mozilla declared that modern cars are a quote, privacy nightmare. They are the least secure technology device that you can buy today. I’m to put a link to that report in the description so you can read through it yourself.

The team reviewed 25 car brands in this research and every single one of them, all 25 car brands got a ding and a privacy not included creepy rating from the foundation. Why? Because they were found to be collecting way more

personal data that is actually necessary to operate and maintain your vehicle or to manage their customer relationship with you and for failing to protect that data. If you think about it, our cars have more opportunity to collect data about us than pretty much any other product or device that we own, even more so than our cell phones. They can track who’s driving,

where you’re going, when you’re going there, how fast you drive to get there, how long you spend in each place, where you park, how long are you parked, what music are you listening to, what phone calls are you receiving, what text messages are you getting? What are you saying? They can get your very precise geolocation from the GPS systems in the car. If you use something like Apple CarPlay or Android Auto to connect your smartphone and make your car an extension of your phone, guess what?

Now your car has access to everything on your phone, your pictures, your calendar, possibly your financial data. Not to mention any third party services that you might use in the car, like Sirius Satellite Radio or the Google Maps or Alexa. If your car has a wifi hotspot, meaning that you can access the internet from within your car, it’s basically a roving internet router. It’s broadcasting to that mobile network

your position, and the car’s serial number at all times because it’s literally a roving router. Even the simple act of rolling down the window in your car creates a data record in the car’s computer that says, at this time they rolled down the driver’s window. Some cars even go so far as to have biometrics so that you can use your fingerprint or facial recognition to start your car to unlock the vehicle to drive the vehicle.

Others allow you to control certain features with gestures. So your car’s literally watching your body and how you move. Some cars can even monitor your heart rate through these steering wheel. And cars with voice recognition, which are very common today, just like your smart device at home. If you have Alexa or the Apple version, I can’t remember what that one’s called.

But they’re literally listening to you at all times recording what you’re saying so that they can wait to recognize whatever that wake up or command word is from you. Do you ever think about how they determine when you say, Alexa, do this, or you tell your car, Hey Toyota, do this. It’s because they’ve been listening to you and listening for that word. And when they hear a word that matches the trigger word, then they wake up and are ready to accept commands, but they’re still listening

to everything that you’re saying. And we’re just kind of getting used to that because all the devices in our life seem to do that these days. And in my case, they’re just gonna hear a lot of really good cuss words and possibly some off-key singing in my car. But that information is collected and stored by the car company. You may think, okay, that’s just the world we live in now. Between browsers, the apps, all of our smart devices, everything we do is monitored in some way.

And if you’re okay with that, that’s perfectly fine. But the key with cars is unlike with the apps and our phones and other smart devices, most car owners don’t know the data is even being collected. What’s being collected, how it’s being used, if it’s being shared or sold, much less are we given the option to turn it off, to say no. There’s next to zero transparency when it comes to data collection and usage in cars today.

Most of the disclosures and little privacy policies that we breeze by and don’t read use very, very vague language that gives them a lot of flexibility in what that data is and how they use it. 52 % of cars included in the Mozilla Foundation’s research report also collect data about the world around your car. So those sensors…

that give us these great safety features like adaptive cruise control and collision mitigation braking, your 360 cameras where you can see all around the car. Those sensors and cameras are also recording information about the weather, road surfaces, traffic signs, because a lot of cars now have traffic sign recognition as a part of those safety systems. So they know where you are and what you’re doing. And 84 % of the car brands say that they have the right

to share your personal data with their partners, their vendors, service providers, even other businesses. And 76 % of them sell your data or have the right to sell your data because of that privacy policy that you kind of blindly agreed to. And they sell it to data brokers and other 56 % said that they can share this data

with government or law enforcement in response to an informal request, not a warrant, not a court order of any kind, but simply if the police ask nicely, they will share your information. Big surprise, Tesla is ranked one of the worst for selling your data. You know, think about their technology company that happens to sell cars. And so data is their business. And in fact, Tesla does consider it part of their

business model. They call it data monetization and it is a multi billion dollar revenue stream for companies. Now I’m personally not to the level of tinfoil hat kind of person, but I am concerned about data privacy and security. My IT background and some stuff that I do in cybersecurity makes me a little more paranoid than the average person I would say. But what really concerns me about the cars is that the auto manufacturers

are so willing to just share or sell your personal data to these data brokers, to advertising companies, research firms, social media companies, and even more than that, insurance companies, any old third party. That is really concerning because the potential for abuse is huge. It’s bad enough when the data is used for what I call highly targeted marking or cyber-stalking.

You know, if you drive down the same street every day, say to go to work, next thing you know, you’re getting ads popping up everywhere on all of your devices for specific businesses along that route. You hey, that coffee shop is offering you something because they know you drive by every day. That’s a little annoying and creepy. You know, on the other hand, it might be convenient because you might get a coupon for a restaurant that you haven’t necessarily checked out because you’re not paying attention to what you’re driving by you’re driving.

So there are pros and cons to it. And we see it all the time when we’re shopping online. I get it really bad because I’m constantly shopping for cars for people. next thing you know, ads for cars for everything are showing up on every device I own. I can’t get around that. It’s just a little creepier when it feels like they’re stalking you when you’re in your car. We associate cars with some level of independence and freedom in this country. And now suddenly we’re realizing that we’re being spied on potentially.

in our cars. So if you think about it, what if the automaker shares your driving data, your driving behaviors with insurance companies, and that makes it harder for you to get an insurance policy, even if you have a perfectly clean driving record, because maybe you just haven’t gotten caught like me. Now, what if your geolocation data is shared or sold? Where you go, how long you go there. If that data is made available to third parties,

so that they can create other apps that can track you. And maybe your psycho ex against whom you have a restraining order can use that data to find you, to track you, to stalk you. Am I being paranoid? Maybe, but these situations have already happened. In the spring of 2024, the FTC launched an investigation into several auto manufacturers for deceiving their customers by falsely claiming

that they would require a warrant from law enforcement in order to turn over your customer data, your location data, your driving data, any other data that the government wants. And that’s not actually true. They don’t require a warrant. They are some of the companies that will just willingly give it over if the government asks nicely. So the FTC launched an investigation into that deception, not that they would turn it over, but they were lying to us about the fact that they would just willy nilly turn it over.

Now I don’t know about you, but I really don’t want law enforcement to be allowed to access my car’s data without going through the due process that is guaranteed to us by the Fourth Amendment against illegal search and seizure. I don’t see the data in my car as being any different than say the data of my financials, which they cannot get without a court order. Why is my car data any different? So I have a real problem with that.

Unfortunately, there are limits to the laws that are out there to protect you and your privacy and your data when it comes to that data that’s collected by your car. It doesn’t even address the potential issue of these cars being able to be hacked or hackable. That’s like a whole nother podcast. But the fact is that your car does hold so much data about you that that data is actually more valuable to criminals than the car itself.

This is according to a company called Privacy 4 Cars. They are the first and only technology company that’s focused on identifying and resolving data privacy issues across the automotive industry.

Cybersecurity threats against automotive companies, particularly data breaches, have increased by 225 % over just the last three years. So not only are the car companies collecting a boatload of your personal data, but then hackers are able to steal it from them because they don’t have sufficient cybersecurity

in place to protect it. And as consumers, we don’t even know what all that data is. One of the reasons we don’t know what it is, is because automakers are bundling consent. You how you you bundle things under your insurance policy? Well, they’re bundling consent, meaning that the car’s infotainment system and often any emergency services or third party things like Sirius Satellite Radio or systems like OnStar, which can call for help if you’re an accident.

It just asks you to consent and agree to very vague terms that covers kind of everything. It’s like a one permission grants all access and it’s granting them access to data that they don’t actually need to perform the function that they are actually doing for you. If you look at your cell phone by comparison, it gives you the ability to consent to different things at different levels and you can opt out and say no to certain things.

Does Google Maps need access to my location data to do its job to get me from point A to point B? Yes, yes it does. So I consent to that. But does it need access to my contacts and my photos on my phone? No, it doesn’t need that. And so I can say no to those permissions. Cars don’t give us that option to say yes or no to each individual system and service and data that it’s looking at.

It is literally bundled together in an all or nothing situation. So if you want to use anything in your car, sometimes even if you want to be able to just drive your car, you have to say yes. So they are kind of holding us hostage by bundling this consent into one privacy notice and one, yep, I consent because I want to be able to turn my car on. And that’s if the car even asks permission at all. Some companies collect and share data without our knowledge.

And there have been lawsuits brought against some of those companies to expose what they’re doing. For example, a gentleman in Florida sued General Motors and OnStar, along with Lexis Nexis Risk Solutions for collecting and distributing his driving data without his knowledge or consent to insurance companies. And as a result, he had a hard time getting car insurance. And the companies that did offer it to him offered it to him at astronomical prices,

even though he has a clean driving record, no speeding tickets, no traffic violations, no accidents. He hadn’t had a claim, but apparently his driving style may, you know, resemble mine. And the insurance companies looked at him as a potential risk. But did they have the right to do that? Did OnStar and GM have the right to share that data with Lexis Nexis, which is a telematics broker?

and then they sold it to the insurance companies who were using it against you. It’s kind of like from that movie Minority Report where they were arresting you based on what these psychics thought you might do based on what you were thinking. And so you literally got arrested for a crime that you hadn’t committed. It had just been an errant thought through your brain. So I kind of see it like that. And yeah, OK, I’m showing my tin foil hat a little bit. But keep in mind that data is not 100 % accurate. The car may know that

the driver holding key fob one is driving, it doesn’t necessarily know who that driver is. It just knows that key fob one was put in the car. So, you know, unless it’s one of those cars that’s literally taking pictures of your face every five minutes to determine if you’re getting drowsy or not paying attention, it doesn’t necessarily know the actual person who’s driving the car. So your spouse or your kid or someone else who is driving your car who may have,

more aggressive, shall we say, behaviors than you do, you could be getting dinged on your insurance based on how they drive, not how you actually drive. GM wouldn’t comment, of course, on the lawsuit itself, but it’s interesting to note that they have since terminated their relationships with Lexis Nexis and other third-party telematics companies as of March 2024. Interesting timing there. And that’s good news. But the bottom line is

Most people don’t know what data is being collected by their car and what the manufacturer is doing with that data, if it’s being shared or sold. According to Privacy4Cars, less than 12 % of dealerships even tell their customers that the car will collect and share their personal data. They may have you sign a privacy policy when you buy the car, but that’s for the dealership and how the dealership uses, shares and protects

your data. It has nothing to do with the car itself because that’s something that the car manufacturer does and they are separate from the dealership. If they do tell you that the car shares data and usually only if you specifically ask them, most will tell you that they’re only going to share the technical data that the car needs for maintenance or warranty purposes or that it needs to share certain data with emergency services. That’s not necessarily true and it’s not necessarily that the dealers are lying to you

They don’t know either. The extent of that data is so, so complicated because of all the third party integrations in cars. Then it even took the Mozilla Foundation several months to weed through all of it and find all of those connections. So why is nothing being done to better protect consumers and our privacy when it comes to data collection in cars? The European Union has what’s called the General Data Protection Regulation, the GDPR.

And that went into effect in 2018. And it applies not just to cars, but to technology as a whole, everything from websites to mobile devices, any technology. It is the toughest privacy and security law in the entire world. And it comes with very steep penalties for companies who violate it. People who are against it say that it places an undue burden on smaller companies. And that may be true. But you know, I kind of want to err on the side of my privacy. Thank you very much.

But we don’t have anything like that in the US. We have the Privacy Act of 1974, but that only protects the privacy of individual records that are held by the federal government, not data that’s collected by businesses. California has one of the most comprehensive law. They have a Privacy Rights Act, and that state agency is currently investigating multiple automakers and vehicle technology companies, especially certain ones that are based in California. We won’t name names into

violations of data privacy. But it’s very difficult for just a simple state agency to go after an entire industry that is nationwide and worldwide. The Federal Trade Commission was asked to investigate several automakers for deceiving customers as well. And the FCC proposed some new rules around vehicle data to protect victims of domestic violence because that situation where I said

your ex can stalk you based on the data your car’s collecting, that has happened and women have died. So, we know it’s a problem and some of our lawmakers are really pushing hard for this. Several senators have introduced bills, but unfortunately they haven’t gone anywhere. And all the investigations that were launched last year have been squashed by the new administration and we’re not likely to see them to resurface anytime soon.

What can you do to protect yourself since clearly nobody else is going to do it for you? It depends on how concerned you are about your data and your privacy. Certainly contact your state representatives and let them know if you’re concerned and what those concerns are and ask them to propose or support some legislation at the federal level that will put at least a few regulations

around this so that the car companies are at least required to tell us and tell us more specifically what data they’re collecting, how they’re using it, and if they can share or sell it and give us at least some ability to say, no, I don’t consent to that. You cannot use my personal data. Beyond that, if you’re very, very concerned about your privacy and security, drive an older car. Just drive a car that doesn’t have all this stuff.

My 2004 Mini Cooper S doesn’t even have Bluetooth. And you know what, I’m okay with that because I don’t get on my phone when I’m in the car. I might put it up on the windshield mount and use it for navigation, but it doesn’t need to be connected to my car for that. If you are buying a newer car, consider educating yourself on what technology it has.

and how that technology works maybe before you buy it. And definitely look at the privacy policy for that car company as a whole. They are on the manufacturer’s websites. Read through that as a part of your research when you’re considering what brands to buy. Because some brands are a lot worse than others in terms of the vagueness of their privacy policy and the amount of data that they collect. So at least educate yourself as best you can. And then think about

Do you really want to use all this technology? Don’t just let the salesperson blindly set everything up. Yeah, it’s really convenient and helpful because they’re teaching you at the same time. But if you’re concerned, you say, hey, you know what, thanks, but I’m going to look through the manual. I’m going to watch the YouTube videos and I’m going to do a little more digging before I set up all of this information and give the car access to my personal data. Just tell them, no thanks. You can show me how some of it works, but just show me what I need to know to be able to drive off a lot and get home. Don’t let them set it up and consent.

for you. That way at least it’s your decision as much as it can be. And there’s nothing that says you have to use all the technology in the car. Maybe you don’t connect Apple CarPlay and Android Auto to give your car access to everything on your phone. Like I said, you shouldn’t be talking and texting while you’re driving anyway, even if it’s hands-free. That’s my safety soapbox. If it comes with an app to control the car from your smartphone, do you really need to use that?

Think about what privacy you are trading for that convenient functionality. And if that’s worth it to you, go for it. I am not judging. I just want you to be aware that that trade-off exists and what the potential risks are of consenting to it.

And keep in mind that smartphone app that allows you to start your car could give criminals the ability to steal the car out of your driveway. Dealerships are actually having this problem where criminals are getting access and creating accounts associated with that VIN. And then they come back at night and then steal all those cars off the dealer’s lot because they were able to get into the technology, set themselves up an account, and now their phone can just control this car and they drive it off the lot.

So again, lots of downsides to some of this technology, even for the dealers and the manufacturers. But it’s again, it’s about making an informed decision. And my God, if you rent a car, please do not connect your phone to the rental car. You don’t need it that badly. I can’t believe how many people actually do this. But the biggest thing that you can do is when you go to sell that car, if you trade it into the dealership for something newer, or even if you sell it to another person or dealership privately.

Delete all of that data before you trade it in. According to privacy for cars, over 90 % of cars that get traded in or sold still have some sort of personal data from the previous owner stored in the systems. I used to just tell my clients, know, be sure you clean out the glove compartment and all your other cubbies in the car and certainly make sure you don’t leave anything behind that might have your name and address on it, like service records. Some people just

get the service records and they fold them up and they stick them in the glove box and leave them there instead of filing them at home. And then that information has your name and address on it. These days it is so much more complicated than that because so much data is in your car. So you have to delete all that data out of the car’s infotainment system. Your entire phone book, all your contacts from your phone, your call logs,

all of your text messages, your navigation history, your home address, your garage door code, your user profiles about you. It may even be IDs and passwords to various accounts that your car is connected to. Can you imagine if your car has Alexa and you left your Amazon login and password programmed into the car for someone else to use? Even your biometric data, your medical data, it could have your financial data.

So how do you purge all of that? Depends on the vehicle, but there’s always a way to do a factory reset on that infotainment system. It’s just like on your cell phone before you would trade that in on a new one. You know, they do a factory reset. The difference is, is usually the people at the cell phone company will sit there and do that for you.

Do not count on the dealer to do that. Most dealers don’t do it or they don’t do it consistently. Or if they’re not keeping your car for their lot, they’re just gonna send it to auction. They’re not gonna waste their time going through and making sure your car is cleaned out unless they are more aware and perhaps they’re working with Privacy 4 Cars and their solutions. But look in your owner’s manual. You can just Google it for your specific car. Believe me, there will be a YouTube video that shows you how to do a factory reset

and clear out all of that data. Again, do not rely on the dealership to do this for you. I can’t tell you how many times I have gone to dealerships and test driven some used cars and you just get in the car and turn it on and boom, all the previous owner’s information pops up and I can see their home address. I can see their name. I know exactly who they are. You know, it’s a little bit scary. So that owners is on you to clear out that data

along with your sunglasses and the loose change and anything else you have in the car before you trade it in. I realize this has probably been very overwhelming and possibly a little bit terrifying. And my goal wasn’t really to scare you, but I just wanted to make you aware of the potential risks that come with all this cool new technology in the cars and what the trade off is between convenience and functionality and privacy.

and security. That is the world we live in today, but just being aware of it and being able to make more informed decisions for yourself is what empowers you.

Are you concerned about the privacy and security risks posed by cars today? Or are you more like, Meh, it is what it is. What are you going to do about it? Let me know in the comments. I want to know how you guys feel about it. Please subscribe to the show if you haven’t and shared it with your community. And if you have any questions, please go to my website, thecarchick.com and submit those to me. And I will do my best to address them in an episode. And don’t forget my online car buying course, the No BS Guide to Buying a Car, your inside track to getting the best deal.

How do you pick the right car for yourself? How do you make all the right decisions? And then how do you approach the shopping so that you get a great deal and avoid all the bullshittery that dealers sometimes pull? Thanks again for joining me folks. Until next time, drive safely.