Are there ANY car manufacturers NOT selling data about you / your car?

Reading @pluralistic 's Feb 28 piece about VW tracking cars (and not providing the info unless you pay): https://pluralistic.net/2023/02/28/kinderwagen/

Cory Doctorow writes:
---
> And yet, here we are. Like most (all?) major car makers, Volkswagen has filled its vehicles with surveillance gear, and has a hot side-hustle as a funnel for the data-brokerage industry.
---

Is anyone keeping a list of car manufacturers who are NOT doing this?

Pluralistic: VW wouldn’t locate kidnapped child because his mother didn’t pay for find-my-car subscription (28 Feb 2023) – Pluralistic: Daily links from Cory Doctorow

@pluralistic I'll note that after reading this, I want to hang on to our two older cars from 2014 for as long as possible!

@danyork @pluralistic In the future perhaps only electric pedal-assist bicycles can be built independently without any tracking software... If they'd *really*, really want to...

Maybe electric motorcycles too, if some shops would feel so adventurous/rebellious...

@danyork @pluralistic is it possible to aftermarket modify a car to NOT do this?
@joshbuddy @pluralistic That's a good question. I would suspect that with at least a few manufacturers you might run into "anti-tampering" systems that would cause other problems with your car.
@danyork @pluralistic
One thing I hadn't realized was that our province at least keeps track of your oil changes, and the mileage when you had it. This way resellers can't change the odometer without it being apparent.
@danyork Occam says: “No.” But I’d be glad to be proved wrong. Until then, assume your vehicle is a snitch.
@danyork @pluralistic
I'd like to see that privacy impact assessments for cars sold in the EU.

@danyork @pluralistic *sigh* And here I was lead to believe I am a paranoid fuck. I think Im more and more okay with driving my dumb vehicle (dumb in the sense that my car is so old it only has the most basic of computer. No fancy tools, gps, or the gadgets tech people love). Cami is just.... Cami the Toyota Camry Station Wagon.

((Yes, I recognize that California is gonna want her gone because she is an ICE vehicle))

@Catwoman69y2k I'm with you! I like my cars "dumb" in this sense!
@danyork @pluralistic making a list is hard because it varies widely by model and trim, even among one carmaker. I have a car with no telematics, but the higher ‘luxury trims’ from the same year/same model DO have a cellular modem (and, I assume, these share data with the mfr and its 10,000 closest friends). If anyone builds such a list it will be incredibly nuanced, using it to drive (pardon the pun) a purchase decision may be difficult.
Who Is Collecting Data from Your Car? – The Markup

A firehose of sensitive data from your vehicle is flowing to a group of companies you’ve probably never heard of

@danyork @pluralistic My 2019 Nissan Leaf asks every time I switch on if I want to send data from the car to their server. I can press "decline" if I don't want to.

@danyork @pluralistic Since there are few if any not doing it, a better thing might be a list of how each one is, and how to disable it.

But also, there are still manufacturers with options that don't have power locks and windows. It's probably unlikely these are doing data collection.

@danyork @pluralistic wonder how that is compliant with UK data protection laws or EU gdpr where you can request all data a company holds about you
@sldrant @pluralistic Probably not at all compliant… but here in the USA we have no such privacy protections, and our US Congress has shown close to zero interest in doing so.
@danyork @pluralistic yes, outside of California I've heard of no interest in privacy like that. I wonder if the data collection on cars is different in the US vs EU too. My Nissan collects data, and makes me agree every time I start it, but I confess I have little idea what data is collected or how it is used

@danyork @sldrant @pluralistic
A European company is still subject to the GDPR even if acting on a foreign country.

Maybe they use a US subsidiary to claim it is not subject to that?

@danyork @pluralistic my 2016 base-trim-level Jeep doesn’t know SHIT about me, it barely knows it’s a car
@pluralistic @danyork 2012-2014 cars were a sweet spot for value & individuality removed from vendor snooping
@danyork @pluralistic @aral As a VW SUV owner that is impacted by the 3G sunset disablement of Car Net, I now wonder if I should get the fix that is supposed to be coming this spring. I guess we all naively assume that we’re not handing over the keys (literally) to our lives when we opt for convenience. This is terrifying.

@danyork
Here's my guess.

{ }

That's the list.

@pluralistic @chris

@dirkhh @pluralistic @chris Ha! Yes, I suspect that is correct!

@danyork @pluralistic

The EU is looking at legislation, but no clear descisions yet. A lot of companies want access to car data.

https://www.reuters.com/business/autos-transportation/eu-car-data-tussle-insurers-others-brace-delays-disappointment-2023-02-16/

"Stellantis have their own big data plans. It expects to generate 20 billion euros ($21.4 billion) annually by 2030 from software products and subscription services."

Note: Stellantis own a number of car brands, including Alfa Romeo, Chrysler, Citroën, Dodge, Fiat, Jeep, Opel, Peugeot, Ram, and Vauxhall.

In EU car data tussle, insurers and others brace for delays, disappointment

A broad coalition of insurers, leasing companies, car repair shops and others are calling on the European Commission to propose rules for fair access to valuable vehicle data soon, fearing further delays could see the initiative shelved after European Parliament elections in 2024.

Reuters

@danyork @pluralistic

In case anyone here owns a #Hyundai #Kona and wants to delete the cellular modem, here is the Step-by-step guide. Technical difficulty: Easy

https://techno-fandom.org/~hobbit/cars/ev/offnet.html

Kona EV: no more Bluelink

Finding and disabling the cellular modem for BlueLink in the Kona EV

@danyork @pluralistic Maybe stick to very basic cars like https://www.citroen.co.uk/ami
Citroën Ami 100% Electric Quadricycle | Citroën UK

Discover Citroën Ami: a 100% electric quadricycle designed for urban living. It looks just like a small electric car. Drive this electric quadricycle in the city now!

@danyork @pluralistic
... I suppose the best defense is an old car. My 2004 Jeep Grand Cherokee doesn't sell my information. I plan to continue taking care of it... maybe eventually pine (https://www.pine64.org/) will make us a car?
Open. Friendly. Community Driven. | PINE64

PINE64 is a large, vibrant and diverse community and creates software, documentation and projects.

PINE64

@danyork @pluralistic EU companies would be subject to the GDPR. Tracking data for your car is clearly 'personal data' under §4.1

They would need your permission for processing it (skipping the case of a collision, which would probably be covered by the eCall law, though), you could retract your permission, get it erased, and you would have the right to obtain access to the data (article 15)

Yet, Volkswagen is a German manufacturer...

@lispi314 @dalias @sldrant

@platonides @danyork @pluralistic @lispi314 @sldrant The law (GDPR) should require eCall to be implemented in a least-data-collected manner practical (i.e. outgoing only on crash), but it's not clear to me whether it actually does.

@dalias @danyork @pluralistic @lispi314 @sldrant
Right. eCall making the cars forcefully call for help on a crash seems sensible.
The vendors taking advantage of having needed to implement that to sell a track-my-car *if the user consents* (perhaps through some setting in their dashboard) would be fine as well.
But the car manufacturer doing that with no consent? That seems a big no-no.

I see a case for a battling owner forcing the manufacturer to change their car so it does not to track him.

@platonides @danyork @pluralistic @lispi314 @sldrant Yes. I don't see why nobody is pursuing these kinds of GDPR cases. The law is no use if nobody brings cases... 😫
@danyork @pluralistic this makes me glad I have a really old car
@danyork @pluralistic presumably not in the EU / UK, where it would be highly illegal
@danyork @pluralistic If you don't need the services and you're not paying for them, I suppose you could always remove the telematics SIM.

@danyork @pluralistic Unfortunately, this will become more and more common. Expect any car brand that isn't collecting data today to do so in the near future.

And even without an active connection, ECUs log a ton of offline data, that will be uploaded to the manufacturer's servers when your car goes to the workshop. Many major car manufacturers (Renault, Stellantis, Volkswagen, ...) are pushing towards mandatory use of their cloud-connected diagnostic tools even for the most basic repair tasks (E.g for an oil change).