In 2023, Mozilla released a report noting that modern U.S. cars had the worst security and privacy standards of any major technology industry the organization tracks. That was followed by a major NYT report in 2024 showing how automakers routinely hoover up oodles of consumer driving and phone info, then sell access to that data to auto insurance companies looking to justify rate hikes.
Despite a lot of noise and fury, the U.S. doesn’t do anything about this for the same reason we refuse to pass a modern privacy law or regulate data brokers: “we” (more accurately the people who purportedly democratically represent us) have repeatedly decided that making gobs of money is significantly more important that human lives, public safety, consumer privacy, or even national security.
Consumer Reports is conducting a more recent follow up study in collaboration with Northeastern University. The full study will arrive next week, but their breakdown of what they’ve found indicates the problem hasn’t gotten better — and in some cases may have gotten worse.
The researchers tested 21 vehicles and their companion mobile apps at CR’s Connecticut auto testing facility using a faraday cage to isolate and analyze vehicle communications. They found they all funneled oceans of behavioral, driving, browsing, location, and other data to a long list of industries and companies. Often without fully informing consumers:
“…almost a quarter of the vehicle apps were found to be sending out personally identifiable information, including vehicle owners’ names, vehicle identification numbers (VINs), and precise geographic locations. That information can make it easy for companies to link driving behavior to personal data profiles created by data brokers and marketers. Such profiles are routinely sold to banks, insurers, pharmaceutical companies, lenders, and retailers, who can use it for personalized loan terms and filtered bank and insurance offers, a CR and CalMatters investigation found.”
Car makers, as they’ve always done, often blame third parties for any “data leakage” and act surprised when provided details on the width and depth of the data transfer. One company, Honda, claims it put an end to the problem immediately (which in a working country, regulators would independently confirm):
“General Motors, Honda, Nissan, and Stellantis (which owns 14 auto brands, including Chrysler, Dodge, Fiat, and Jeep), said some recipients of driver data were prohibited from independently using or selling any data they are provided. But the Northeastern researchers found those restrictions aren’t necessarily effective: After they showed their findings to Honda, the company instructed one of its vendors, Amplitude, to delete all of the location data it had received and stopped sending it going forward.”
In a lot of instances (much like the “smart TV” and other markets), if consumers try to take informed action to opt out of collection and protect themselves, they lose vehicle functionality.
Again, carmakers do this because they know the federal U.S. government won’t meaningfully hold them accountable. And the government won’t hold them accountable because the current U.S. government is too corrupt to function in the public interest — and incentivized toward apathy because it unconstitutionally exploits this dysfunction to buy data and avoid warrants.
Despite their own products lacking privacy and security standards, these same automakers are intensely lobbying the government to ban Chinese vehicles from the U.S. market, usually under the pretense that they’re just really worried about U.S. privacy and security (Dem lawmakers in Michigan want to ban Chinese EVs from even visiting the state).
But as we saw with the “TikTok ban,” this is all annoyingly performative. China doesn’t need TikTok, EVs, or Chinese-made drones to collect sensitive U.S. consumer data because they can already buy most of it on the open and largely unregulated market. And they can buy most of it on the open market because the U.S. Congress is too corrupt to function in the public interest, despite ample pretense to the contrary.