Surveillance on Wheels: How Top US Car Makers Spy on Drivers
Back in 2018, PIA blog was one of the first to warn about smart cars’ imminent threat to privacy. The increasing use of computerized components within vehicles meant that a new wave of surveillance – carried out by your own car – was coming. And increasingly affordable mobile communications allowed much of the data gathered by a vehicle’s sensors to be sent back to the manufacturers in real time.
The quantity of data gathered and transmitted is considerable. Even back in 2019, the Washington Post estimated that it amounted to 25 Gbytes per hour. Since then, it is likely to have increased.
But even more data is collected but not transmitted. Instead, it is stored on the vehicle to provide historical information to mechanics during servicing and repairs. Although that’s a sensible approach, it does lead to another privacy problem. Since most people are unaware of the detailed personal data their vehicles have gathered, they may not think to delete it when they sell their car.
What is Auto Surveillance?
Recognizing the privacy-invasive nature of auto data collection, the company Privacy4Cars offers free Android and iOS apps to help delete the surprisingly detailed information logged by vehicle entertainment systems – things such as phone numbers dialed, call logs, location history and garage door codes. More recently, Privacy4Cars has launched a new tool that offers a Vehicle Privacy Report for individual cars:
Each Vehicle Privacy Report includes two key pieces of information: the Vehicle Privacy Label, which is a set of ten standardized clickable icons that synthesize the data collection, sharing, and selling practices of vehicle manufacturers, per their public documents, and the Vehicle Privacy History, which lists known actions businesses have taken to protect the privacy of their customers.
The new report offers a simple way to analyze exactly what data vehicles are collecting about their drivers. Writing for Wired magazine, Matt Burgess has used this tool to examine some top US models and provides interesting details about what is now routine auto surveillance. Naturally, manufacturers gather standard – but highly personal – information such as names, postal addresses, email addresses, Social Security numbers and driving license details. Intelligent cars also collect and store technical data from in-car sensors.
For example, Burgess found that Toyota’s Tacoma, Camry, RAV4, and Highlander models collected detailed information about driving behavior. These include acceleration and speed, steering, braking functionality, and travel direction. They can also gather various in-vehicle preferences, including favorite locations saved on their systems, and even images from external cameras or sensors.
Honda’s CR-V and Civic vehicles also collect driver behavior information, including detailed pedal position, engine speed, and steering angle. It retains data about internet and mobile communications such as search content, call history information, and voice commands. By now most people are aware that their search histories provide extremely revealing information about what they are doing and even thinking about. Using the Vehicle Privacy Report, the Wired article found that the popular Ford F150 truck:
can collect driving data and characteristics, such as your speed, how you push the pedals, and seat-belt-related data. Information about your travel direction, precise location, speed, and local weather can be gathered from the vehicle.
Voice recognition systems in some of its vehicles can gather information when they are listening. Its “media analytics” involves capturing information about what you listen to in your car, including “radio presets, volume, channels, media sources, title, artist, and genre.”
Mass Auto Surveillance is Here and It’s Lucrative
Although media analytics might seem harmless enough, it can provide useful insights about a person’s interests. The other data from sensors clearly amounts to real-time non-stop surveillance of where you’ve been.
The Chevrolet Silverado collects a range of vehicle data, including battery, ignition, gear status, and diagnostic information. It even notes “window data” – presumably when and how windows are opened. It’s hard to see why that might be useful, but it does indicate how fine-grained the information from car sensors has become. Other elements gathered by the Silverado include location, route history, speed, and “braking and swerving/cornering events.” The last of these would probably be of interest to insurance companies as proxies for how well someone drives.
The final models explored in the Wired article are the Jeep Grand Cherokee, and the Ram Pickup, two popular vehicles in the US:
The driving data the company collects, according to its documents, includes the dates and times you use it, your speed, acceleration and braking data, details of the trip (including location, weather, route taken), and, among other things, cruise control data. Like other manufacturers, it also collects data about the status of your car, including “refueling activity,” battery levels, images from cameras, and error codes that are generated. Your face and fingerprint data may be collected if you use services, such as digital keys, that need this kind of information to operate, the documents say.
What is striking about these results is how far things have moved in the five years since we first noted on this blog that surveillance on wheels was likely to become an issue. There’s no reason to think that even more detailed information will not be gathered from yet more sensors and sent back over 4G and 5G mobile Internet connections – mostly without car owners having any idea that they are being watched every second they drive.
The only possible brake on this particular acceleration is legislation. In the EU, the GDPR already provides broad protection against the abuse of this personal data. It remains to be seen whether the US will bring in anything equivalent at the federal level to protect people’s privacy when they drive.
Featured image by Alf van Beem.
