Your Car May Be Watching You, Listening to You, and Profiting From It

Cars are getting smarter. New cars are packed with an ever-increasing array of sensors, telematics, digital consoles, microphones, and cameras to the point that they're essentially computers on wheels. Like every other digital device we interact with, they spend a good amount of time sucking up all the information about us we're willing to share — and then some.

Mozilla, the company behind the privacy-conscious Firefox browser, recently released a piece about the findings from their latest "Privacy Not Included" survey. Their researchers examined some of the latest models from 25 different car brands to see what kind of data they harvested, whether or not the data collection was necessary to the cars' functions, what they did with the data, and what kind of security measures were in place to protect the cars' owners from hackers and other ne'er-do-wells.

The results were grim.

No Tinfoil Hat Needed

Every single car brand Mozilla researched earned the worst possible privacy and security ratings that Mozilla could bestow. Every single brand collected too much data. Some 84% of the brands turned right around and sold that data to any number of different companies. All but two of the 25 brands gave drivers little to no control over their personal data. Not a single one managed to even meet the bare minimum of what Mozilla considers adequate security standards.

In other words: Your car may be watching you, listening to you, and selling your private information to other companies without your knowledge. Oh, and do you remember the concerns about hackers taking control of self-driving vehicles or getting into your car's systems and locking you out until you paid a ransom? That's not just a thought experiment.

Your car's systems almost certainly have fewer built-in security measures against hackers than the first Hotmail account you set up back in the late 90s — except now there's way more at stake than just having your Runescape account stolen. Everyone has weak spots in the walls around their digital lives, even if you aren't too trusting with emails from Nigerian princes. Yours might have four wheels.

As regular consumers we have practically no recourse against this kind of reckless and insecure data harvesting. It's one thing when we know that our data is captured by our phones, computers, Bluetooth-enabled pregnancy tests, app-controlled toasters, smart dryers, smart speakers, and every other device that can connect to the internet — at least then we know (or hope) that our data is protected by reasonably competent security measures and hidden deep within millions of other data points. It's another thing entirely when you know your data is being captured by companies who aren't doing enough to keep your data private.

How Bad Could It Be?

In short: Bad. In long: It's so much worse than you could imagine. We've already touched on the abysmal security measures that car companies put in place to safeguard your information, but it's worth noting just how invasive and downright weird the data collection really is.

Here's a fun example. According to Mozilla, Nissan's privacy policies — the 1,000-page long bricks of legalese that you technically agree to when you buy or use their products — declare that they have both the right and ability to collect and share information on your sexual activity, health diagnosis data, and genetic information.

It gets worse.

Nissan's policy also states that they can share and sell "[i]nferences drawn from any Personal Data collected to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes" for targeted marketing purposes.

That's right, operating a Nissan vehicle gives them the right to put together a psychological profile about you and sell it to whoever they please. And if you're driving a car with cameras or any other kind of sensors inside the cabin, well, they know you often yell at traffic, pick your nose, occasionally drive home from happy hour, sing along to Taylor Swift at full volume, and sometimes do all of that at once – PLUS what that says about you as a person.

And don't even get us started about what they can and will collect if you download their app.

What Can We Do?

As powerless as we may feel in the ever-widening maw of data harvesting, there are a few things you can do to protect yourself against these spies on wheels.

The first and easiest thing is to not buy a car packed with modern features. Getting an older car is your best bet, but if you do some digging you can find some modern cars that are cheap or customizable enough that you can get them without all the tech built in.

A more drastic option is finding the cameras and recording devices on your vehicle and disabling them. This will affect the resale value, of course. You can also do your part to spread the word and put pressure on carmakers to stop invasive data collection.

Finally, you should be aware that there are federal and state privacy laws that may regulate what carmakers can share about the information they collect from you without your knowledge. While carmakers (and many other companies) are legally allowed to obtain a wealth of information about you, particularly when you purchase a product and agree to the terms, there may still be limits. And if your personal information is compromised in a data breach, the carmaker could be held liable if you suffer from identity theft or lose money because of it.

Or you could get a horse. That'd pretty much put the whole concern to rest.

Related Resources:

• What Is Invasion of Privacy? (FindLaw's Learn About the Law)
• What Is the 'Reasonable Expectation of Privacy'? (FindLaw's Learn About the Law)
• Can My Cellphone Data Be Used Against Me? (FindLaw's Law and Daily Life blog)