4 ms·

>"Car Data, will create an ecosystem to link the ever-expanding set of vehicle data to authorized data usage, such as pay-how-you-drive insurance, road monitori

by Dah00n 6y ago

>"Car Data, will create an ecosystem to link the ever-expanding set of vehicle data to authorized data usage, such as pay-how-you-drive insurance, road monitoring, and fleet management." I hope for once to be surprised with privacy features..

Animats 6y ago
That would interfere with marketing. "Where did you go today? We know." - Car Data slogan?
rad_gruchalski 6y ago
Such things already exist. Here’s an example: https://www.caruso-dataplace.com/ https://www.caruso-dataplace.com/ So today a consent of the vehicle owner is required and the owner needs to document the they “posses” the rights to the vin. This is how it works for bmw: you request data through that portal, the portal requests the access through the manufacturer. The manufacturer sends a consent request to the registered owner via email. If consent is granted via connected drive portal, data market starts receiving data and so do you. To even be eligible for consent request, the vehicle needs to be car data enabled which is done at a dealership with pen and paper signature. At least that’s how it works in Germany right now. Disclosure: I know the sales and tech team at Caruso Dataplace but I’m not connected to the company in any commercial way.
- yummypaint 6y ago
  Does the car not transmit any data prior to authorization?
  - rad_gruchalski 6y ago
    That I do not know. All I know is: if there is no signature to consent to car data sharing, nobody ever will be able to request the consent. The car may be trying talking to manufacturer but what happens there, I do not know. This is all regulated by the ISO 27017 standard.
- AlotOfReading 6y ago
  How does the manufacturer have the owner's email after something like a private resale? Would they just send the consent request to the original purchaser?
  - maxerickson 6y ago
    Presumably the registered owner can be updated. It should be easy enough to prove ownership to a dealer or whatever and have them update the registration. It seems to me that the corner cases there are more unfortunate than dangerous.
  - rad_gruchalski 6y ago
    Depends how you purchase the second hand vehicle. If the first owner did a trade in, it’s all easy to manage. If it’s a direct sale, I guess it’s worth asking the first owner for the connectivity status. Even so, I believe a visit at a dealer with registration document would get that resolved pretty fast.
    - throwawayboise 6y ago
      Pretty sure that in the US, the various states provide manufacturers with updates to vehicle title and registration changes. This is primarily so that vehicle owners can be notified of safety recalls.
sahaskatta 6y ago
I'm the co-founder of https://smartcar.com https://smartcar.com and we are in an adjacent space. We provide an API for cars to make it easy for developers to integrate with vehicles. Part of that process is to let consumers go through an Oauth flow and accept permissions before an app has access to a vehicle. In my opinion, it's possible put privacy in the hands of consumers and enable developers to buidl apps for cars easily. I'm hoping this consortium adheres to these principles too.
- marshmallow_12 6y ago
  will it merely be a generic initial 'i agree to terms and conditions' or a fully transparent, ongoing process of transferring data, with the user having ultimate control. If the latter is true, i salute you and wish you luck.
  - sahaskatta 6y ago
    It's a 3-click flow. 1) Read Privacy Policy 2) Login Screen: Authenticate with username/password 3) Permissions Screen: review items and hit allow. You can see an example of this flow on our homepage: https://smartcar.com/product/connect/ https://smartcar.com/product/connect/ P.S. There's no other way for developers/apps/businesses to obtain access to a APIs for a car. The owner of the car has to explicitly go through this flow.
- londons_explore 6y ago
  Letting users hand over their data with just an OAuth prompt ceased to be acceptable in 2018 when Cambridge Analytica extracted data from millions of naieve Facebook users who just clicked "accept" to hand over data... I hope your platform only allows users to hand over data to thoroughly data-security-audited companies or your platform might be in for a rude awakening...
  - sokoloff 6y ago
    Has a tech platform ever been successfully launched relying on thoroughly audited partner companies to get that platform off the ground?
tempaccount2342 6y ago
well.. they buried it in there a bit, but they did include a way to get out of running google analytics on all websites in a given browser through an extension. They link to it under their cookie policy: https://global-carconnectivity.org/wp-content/uploads/2020/07/CCC-Cookie-Policy-17-6-2018.pdf https://global-carconnectivity.org/wp-content/uploads/2020/0...

by Dah00n 6y ago

Animats 6y ago

That would interfere with marketing. "Where did you go today? We know." - Car Data slogan?

rad_gruchalski 6y ago

Such things already exist. Here’s an example: https://www.caruso-dataplace.com/ https://www.caruso-dataplace.com/ So today a consent of the vehicle owner is required and the owner needs to document the they “posses” the rights to the vin. This is how it works for bmw: you request data through that portal, the portal requests the access through the manufacturer. The manufacturer sends a consent request to the registered owner via email. If consent is granted via connected drive portal, data market starts receiving data and so do you. To even be eligible for consent request, the vehicle needs to be car data enabled which is done at a dealership with pen and paper signature. At least that’s how it works in Germany right now. Disclosure: I know the sales and tech team at Caruso Dataplace but I’m not connected to the company in any commercial way.

yummypaint 6y ago
Does the car not transmit any data prior to authorization?
- rad_gruchalski 6y ago
  That I do not know. All I know is: if there is no signature to consent to car data sharing, nobody ever will be able to request the consent. The car may be trying talking to manufacturer but what happens there, I do not know. This is all regulated by the ISO 27017 standard.
AlotOfReading 6y ago
How does the manufacturer have the owner's email after something like a private resale? Would they just send the consent request to the original purchaser?
- maxerickson 6y ago
  Presumably the registered owner can be updated. It should be easy enough to prove ownership to a dealer or whatever and have them update the registration. It seems to me that the corner cases there are more unfortunate than dangerous.
- rad_gruchalski 6y ago
  Depends how you purchase the second hand vehicle. If the first owner did a trade in, it’s all easy to manage. If it’s a direct sale, I guess it’s worth asking the first owner for the connectivity status. Even so, I believe a visit at a dealer with registration document would get that resolved pretty fast.
  - throwawayboise 6y ago
    Pretty sure that in the US, the various states provide manufacturers with updates to vehicle title and registration changes. This is primarily so that vehicle owners can be notified of safety recalls.

sahaskatta 6y ago

I'm the co-founder of https://smartcar.com https://smartcar.com and we are in an adjacent space. We provide an API for cars to make it easy for developers to integrate with vehicles. Part of that process is to let consumers go through an Oauth flow and accept permissions before an app has access to a vehicle. In my opinion, it's possible put privacy in the hands of consumers and enable developers to buidl apps for cars easily. I'm hoping this consortium adheres to these principles too.

marshmallow_12 6y ago
will it merely be a generic initial 'i agree to terms and conditions' or a fully transparent, ongoing process of transferring data, with the user having ultimate control. If the latter is true, i salute you and wish you luck.
- sahaskatta 6y ago
  It's a 3-click flow. 1) Read Privacy Policy 2) Login Screen: Authenticate with username/password 3) Permissions Screen: review items and hit allow. You can see an example of this flow on our homepage: https://smartcar.com/product/connect/ https://smartcar.com/product/connect/ P.S. There's no other way for developers/apps/businesses to obtain access to a APIs for a car. The owner of the car has to explicitly go through this flow.
londons_explore 6y ago
Letting users hand over their data with just an OAuth prompt ceased to be acceptable in 2018 when Cambridge Analytica extracted data from millions of naieve Facebook users who just clicked "accept" to hand over data... I hope your platform only allows users to hand over data to thoroughly data-security-audited companies or your platform might be in for a rude awakening...
- sokoloff 6y ago
  Has a tech platform ever been successfully launched relying on thoroughly audited partner companies to get that platform off the ground?

tempaccount2342 6y ago

well.. they buried it in there a bit, but they did include a way to get out of running google analytics on all websites in a given browser through an extension. They link to it under their cookie policy: https://global-carconnectivity.org/wp-content/uploads/2020/07/CCC-Cookie-Policy-17-6-2018.pdf https://global-carconnectivity.org/wp-content/uploads/2020/0...