The car industry is even worse for your privacy than the worst tech company -- and that's because the worst behavior of the tech industry is embedded in every car. This report from @[email protected] is what Consumer Reports should have done years ago -- and it is infuriating. https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
*Privacy Not Included: A Buyer’s Guide for Connected Products

All 25 car brands we researched earned our *Privacy Not Included warning label – making cars the worst category of products that we have ever reviewed

Mozilla Foundation
@dangillmor @mozilla I own a modern Hyundai and get emails about my "Vehicle Health" every month or so, which indicates data collection via LTE that I don''t want, never asked for.
I don't know how to verifiably disable this other than physically disconnecting the antenna that also serves my GPS nav system.
@jab01701mid if you can stick something in between (not literally, in software) you may be able to filter out certain data from being sent, but that's just an idea
@dangillmor @mozilla For those of us who buy used cars, wondering what is the last guaranteed-safe-from-snooping model year…
@ShutterbugDoug @dangillmor @[email protected] If your car’s factory stereo includes a cassette tape deck, then you are probably safe.

@ShutterbugDoug @dangillmor @mozilla I think you'd be better off looking for what isn't in the car. My cars don't have (builtin) Bluetooth, cell\onstar or WiFi, despite two of them being 2014 and 2017. They don't have any outside communications.

I'm very curious what electric (or even hybrid) cars 'lack' those amenities. It seems those cars have all leaned into connectivity.

Critique *Confidentialité non incluse : Nissan

How creepy is your car? We read the privacy policies so you don’t have to. Learn how your favorite car brand stacks up when it comes to protecting your privacy and security.

Mozilla Foundation

@dangillmor @mozilla

Wow, @derekreilly and @bobbyllew, this is an eye opener. It hadn't even occurred to me that these car companies are monetizing their owners. Makes perfect sense - of course they would do this; they're tech/auto businesses, many of whom have publicly dodgy pasts.

I think this needs to be highlighted. Surely each company must have PR-trained privacy officers who can be held accountable, who can try to justify this?

@dangillmor @[email protected]
And Musk's Tesla's take pictures of you at that.
@dangillmor @mozilla the fact that *cars* have privacy related issues makes me wanna walk into the ocean. Fuck that oh my god, why does a car need an app
@dangillmor @mozilla So, when you sell a used car, is anyone required to inform the new owner about any of this? Or does the manufacturer just get to continue collecting data? (I already know the answer, ofc).
@dangillmor @[email protected] Can’t we make it illegal for cars (appliances, etc) to collect personal data on us? I’m feeling like we’re all being ground up and sold to a data hungry monster. #SoylentGreen But it’s our data.
@Catawu @dangillmor @mozilla @vascorsd Hi, have you heard of Europe and the GDPR?
@Squig @Catawu @dangillmor @mozilla @vascorsd This report includes European cars! I don't see how they can possibly be complying with the GDPR, but it's clear Renault and Dacia are at least pretending to.
@Squig @dangillmor @[email protected] @vascorsd I had not heard about that. I shall look into it.

@dangillmor @[email protected] I run a pi-hole on my home network, Tesla is by far at the top of the blocked servers on the list. It’s basically nonstop communications. I didn’t even know about this but added new blocklists recently & it climbed up to the top fast. I own a Volvo, never seen anything but reading this I’ll have to do some research, see what IPs they might be using. But in the end they have LTE so it doesn’t matter

I now always have to make clear that I bought a Tesla before Mushk lunacy.

@dangillmor @mozilla Consumer Reports serves the manufacturers now.
@dangillmor @mozilla I've recently rented a VW Passat and it had several levels of privacy, the strictest set being the default. Out of curiosity I've checked what the lower sets included and was horrified to see that besides telemetrics (how and where I drive), it could have reported from streamed music metadata to app-specific usage.
How the data is supposed to be used is probably described in the manual's page 3974, using a size 6 font in the footer, printed white on white.
@dangillmor @mozilla Plox recommend ways to fuzz these data. Cover the cameras with tape (as one does with their mobile)? Is there some device that can be carried on board to jam the signals? Use a freakin paper map instead of GPS! I don't need a goddam nanny or #TikTok... just get me point A to point B and I'll take care of the rest...
@dangillmor @mozilla my sex data? Won’t they be disappointed….
@dangillmor @[email protected] Do they really collect all this data or is it just in the privacy policy? I mean, how exactly does a Kia collect genetic information a Nissan sexual activity? Of course this shouldn't be in the privacy policy but if it's not really collected than it's not an issue.

@goc @dangillmor @mozilla The article is mostly making fun of privacy agreements & policies and not very usable about practical questions like that. For example, while Teslas are more than capable of collecting all kinds of information on you, as a practical matter, unless they're just outright lying, which I suppose is possible, they don't send that data off the car in most cases.

I suspect the items about sexual activity are there just because any cameras on the car might pick that up, so they're enumerating it – it is something to keep in mind, I guess?

I suspect most data selling is the same sort of data selling every other merchant does.

@dangillmor

To note, Tesla was the absolute worst on their list.

@jmcrookston @dangillmor Is it really the worst, though? They mostly don't send data off the car unless you opt-in or there's a crash/security event or something, and they let you delete everything associated with your account. They seem pretty upfront about what they do. (Unless they are outright lying about it, which I suppose is a possibility.) This article is mostly mocking the agreements, which I appreciate, but as far as what they actually do, it seems about what you'd expect? am I wrong?

I suspect most car makers are actually pretty good, as well. Same problems with any bush-league online merchant apply, of course – financial details stored using less-than-best-practice.

@jmcrookston @dangillmor although, the whole "safety-critical event" thing makes me wonder – suppose you're speeding in an accident; will that be subpoenaed?

But I guess they could probably even subpoena your cell records to get that, so I suppose that ship has sailed.

@ech @dangillmor

Well it's the last on the list, is all I was pointing out.

But to answer, the problem is who knows. Have to know what they do, and I think Mozilla's point writ large is who knows.

That's probably bad drafting for quite a bit of it. I remember more than one kerfuffle where a social media platform was called out for an irrevocable worldwide licence to reproduce your copyrighted works. Well, of course. Because they need to show your pictures.

But we never really know ...

@ech @dangillmor

If they are the worst on the list and don't send data off the car that strikes me as decent for privacy.

Save me looking, what does Mozilla say about that? Maybe I'll have to read the whole report.

I suspect the thrust of all of this is the privacy policies don't really say what is collected, and what it's used for. They tend to end up these boilerplate statements and once in a while one hits the news for wanting to own your first born.

@jmcrookston @dangillmor Well, they do send data off the car for "safety-critical events"

They say about Tesla:
* good that they don't sell data to 3rd parties (but you can opt-in, and maybe that is confusing)
* reminder of the scandal regarding employees sharing pictures from the cameras
* privacy policy is somewhat vague in some areas (sharing with law enforcement, and so on)
* if you opt-out of all data sharing, you don't get software updates/etc because they cut all connectivity, so that is stupid

I think those are the highlights.

my note: the picture sharing scandal implies super-poor internal processes for handling customer data, which is unfortunately far too common for low-end tech firms. (I've worked in several, and it is quite shocking.)

@dangillmor couple this with the fact that you forfeit a whole bunch of your civil rights when you get behind the wheel in the US and the idea that cars symbolize freedom becomes absolutely laughable
@dangillmor I don't understand why people buy new cars anymore. It's like online enshittification but having to pay 5 figures for it.
@dangillmor @mozilla So maybe it's a wise decision to keep my Honda 2012, without a GPS built in…?

@dangillmor @mozilla

This is going to become an ever more challenging problem, especially for existing at-risk populaces. We're already seeing the need for safe, anonymous human medical transport across geographic boundaries as a direct result of certain recent political policy changes in the US over the past couple years

@dangillmor @[email protected] @siracusa

What is the metric for ‘sexual activity’? Parked with 2 people in car? Parked near the No-tell motel? Parked at a location not home, work, or public shop? Date night?

@dangillmor @[email protected] @siracusa

If the van is a rocking, don’t come a knocking; faraday cage is electrified.

@dangillmor @mozilla Excellent article on car manufacturers lack of respect for consumer privacy or any expectations thereof.

@dangillmor @mozilla

Super creepy, but I just got an idea for #writing a celebrity stalker fic

@dangillmor @[email protected] let’s not forget the automobile industry’s incompetence when it comes to security as well. I’m sure there’s more than a few Kia and Hyundai owners that can attest.
@dangillmor I've been bothered by this for years, ever since Louis Rossmann was showing those Massachusetts "vote no on question 1" ads on his channel. Vote 1 to keep my data safe?! Why the 🤬 does my car have my data in the first place?
@dangillmor I wonder why Volvo wasn’t in the list.
Too small?