15 ms·

Privacy Nightmare on Wheels’: Every Car Brand Reviewed by Mozilla

porkbeer 3y ago
Connecting your phone to a rental or friends cars bluetooth will also snarf all your contacts and identifying phone data. Often times in a way that cannot be erased, even by a tech.
- derwiki 3y ago
  Even if you decline Contact syncing but otherwise use Carplay?
- NotYourLawyer 3y ago
  When the car asks your phone for contact info, you click decline.
  - viscountchocula 3y ago
    In Android, at least, it defaults the checkbox to allow contact and text message sharing. You have to uncheck it before hitting connect. It's not actually an allow/deny contact sharing button. It's an extra step if and only if you want to deny. Dark pattern.
9328997379 3y ago
[flagged]
kiwih 3y ago
Most important sentence of the article is the first: > All 25 major car brands reviewed in Mozilla’s latest edition of Privacy Not Included (PNI) received failing marks for consumer privacy, a first in the buyer's guide’s seven-year history.
- deleted 3y ago
  [deleted]
- darkclouds 3y ago
  They didnt review any Porsche's then! Porsche is reportedly concerned over the Android Auto collecting too much data. https://www.theguardian.com/technology/2015/oct/07/google-denies-in-car-entertainment-android-auto-listens-to-users-porsche-apple https://www.theguardian.com/technology/2015/oct/07/google-de... https://www.motorbiscuit.com/porsche-models-still-not-android-auto/#:~:text=Here's%20why%20Porsche%20didn't%20provide%20Android%20Auto%20integration&text=According%20to%20Autoevolution%2C%20Porsche%20originally,the%20car%20manufacturer%20considered%20confidential https://www.motorbiscuit.com/porsche-models-still-not-androi....
  - _wf2l 3y ago
    just because they're concerned about Android auto collecting too much data doesn't mean they themselves don't using other mechanisms.
    - darkclouds 3y ago
      I dont care if Porsche collect data on my driving style to improve their cars. Car manufacturers will see how ineffective and dangerous the ABS/ESP can be in some situations, just like flappy paddle gear boxes still need a clutch pedal to engage the clutch when driving over low grip situations like oil, ice, snow and rain, and the car gets out of shape, because few are perfectly balanced. Dipping the clutch to bring the car under control and pointing in the direction you want to travel is essential in these situations. Here [1] Misha could have dipped the clutch or knocked the gears up from 4 to 5 or 6, to prevent the engine and rear wheels acting like a hand brake. Whats also interesting to note is the traction didnt kick in for a second or two, once he was already getting more side ways. Now I know the Mercedes AMG have had their traction control setup for at least a decade with drift mode tolerances, but in this situation, the traction should have cut in more quickly to bring the speed down and apply the front brakes only. So whilst the driver waits for the traction to kick in, having a clutch peddle to dip is the next best thing if the flappy paddle gear box cant knock the gearbox up a couple of higher gears quickly enough, even being able to change the brake bias quickly on the fly like in rally cars could help. Its also why when a car gets sideways, it invariably leaves skid marks on the road before a crash. Some people are capable of driving with faster reaction times than the systems can react. I know this because I've had to switch my traction control off "mid situation" to avoid a crash and now as a default switch mine off religiously when driving. I object to the data being shared, just like the UK Govt shares the names and addresses of every person who is eligible to vote with people who stand in a parliamentary election when they can stump up a £500 deposit which is far cheaper than any mailing list! Makes me wonder about the Monster Raving Loony Party! And other entities can also get this data which shows the law is not fit for purpose in some areas in todays day and age. So there should be a default data cant be shared unless opting in imo. [1] https://www.youtube.com/watch?v=rH3YpRYVTBM&t=1215s https://www.youtube.com/watch?v=rH3YpRYVTBM&t=1215s
tecleandor 3y ago
> The very worst offender is Nissan. The Japanese car manufacturer admits in their privacy policy to collecting a wide range of information, including sexual activity, health diagnosis data, and genetic data — but doesn’t specify how. My dad just bought a Nissan Qashqai (I hate it, but wathever). For legal reference, I'm on Spain, so EU GDPR framework. Every single time you start the car it shows a consent screen for data aquisition. By memory... "Driving data, location, statistics, blablabla for the Nissan Connect program." - I haven't connected nor I have a user or anything at all in the Nissan Connect apps - You can't disable the dialog, not even in the service menu - I've been digging in forums and everyone says you have to bear with that for the whole life of the car That's not ethical, and probably not even legal.
- speedgoose 3y ago
  Can you refuse as easily as you can consent?
  - andy81 3y ago
    Nag on boot already means that you can't refuse as easily as you can consent. Presumably they don't harrass users to accept the agreement once already accepted.
    - tremon 3y ago
      Presumably they don't harrass users to accept the agreement once already accepted They may have to, as long as they can't identify who's behind the wheel: a single driver can't (legally) accept those terms for all future drivers of the car.
  - deleted 3y ago
    [deleted]
- unyttigfjelltol 3y ago
  And, from a pre-smartcar perspective, a terrible driver experience. I don't understand why the consumer marketplace puts up with this.
polotics 3y ago
I went in there looking because of the amazing notion that car makers grant themselves the right to gather and divulge information related to (quote) your "sex life". And indeed KIA wins the Internet of Creeps with the aforementied explicitly included in the data they somehow (how?) aim to gather and distribute to the winds. https://foundation.mozilla.org/en/privacynotincluded/kia/ https://foundation.mozilla.org/en/privacynotincluded/kia/ Genetic information is also included, but come on, does a KIA steering wheel suck up your sweat and send it to an hidden PCR machine??? I think the people at KIA who wrote that "cover our arses" legalese going through every piece of data they could possibly at one time gather needs to factor in the cost of some customers, me included, never ever getting a KIA. Anyways as I understand they are extremely easy to steal, looks like a failing brand won't be able to get parts (or private parts) for long.
- Nereuxofficial 3y ago
  Maybe because people may have sex in their car. But yeah it is incredibly creepy how much data these companies collect
  - dividedbyzero 3y ago
    Pregnancies should be fairly straightforward to detect and are hugely valuable info for marketing.
    - NoZebra120vClip 3y ago
      Look at bright side: when car detects that you're knocked up, it can automatically route you to nearest abortion provider. No tech company will dare to track you there! https://www.reuters.com/world/us/google-delete-location-history-visits-abortion-clinics-2022-07-01/ https://www.reuters.com/world/us/google-delete-location-hist...
      - thsksbd 3y ago
        I think sarcasm is tone Id use in this case, but you do have a valid point.
okasaki 3y ago
> Who we are > The Mozilla Foundation works to ensure the internet remains a public resource that is open and accessible to us all. ??
SOLAR_FIELDS 3y ago
Curious how much less data these manufacturers get if I’m using CarPlay instead of their own homegrown console. It’s getting to the point where I straight up won’t purchase a new vehicle if it doesn’t offer CarPlay. There’s probably other sensor gathering happening around the vehicle and obviously you can’t hide things like driving habits but it feels like staying out of the manufacturer’s homegrown OS gets rid of a good chunk of the worst privacy nightmares
- inhumantsar 3y ago
  Why would it? It's not like the car's OS is off while you're using carplay. There's still microphones, GPS, cameras, etc.
  - dividedbyzero 3y ago
    I assume the manufacturer's OS would be what's running the car side of CarPlay, so it might even be able to get information from CarPlay.
- pluc 3y ago
  Are you seriously considering that your phone tracks you less than your car?
  - dreamcompiler 3y ago
    You can turn off location services on your phone. You can't in your car.
    - pluc 3y ago
      By definition as long as your mobile phone is a mobile phone it's a tracking device. You can turn it off just like you can turn your car off
  - heyoni 3y ago
    Yes.
defrost 3y ago
Previous discussion: Internet-connected cars fail privacy and security tests conducted by Mozilla 3 days ago|632 comments https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37404413
travisgriggs 3y ago
Surveillance Economy all the way baby. Until this comes to be understood et large as a basic contributing doctrine of our basic value exchange system, this type of thing will continue to be more and more pervasive. Given the multiple years we’ve been at it, I think a basic doctrine of privacy as a counterweight is too squishy to really settle in the public’s mind and countermand the negative effects of the surveillance at large. A new counter doctrine will need to take place. I’m not sure what it would be.
- b112 3y ago
  It's gotten to the point that I can't get mad at CEOs, companies: "So you're saying everyone does it, no one really complains, all our competitors do it, it's legal... and highly profitable?" I mean, of course they're doing it. I can just see a board meeting "LG even records you when you watch TV?!?", uh, OK I guess, let's do it.
  - piyuv 3y ago
    It's really like that nowadays. As I become more and more aware and learnt, I started reading privacy policies of products. All of them have blanket statements. They claim ownership of any and all data they'll access for functionality. So I stopped reading them. I implicitly agree that any product I use can and will use all the data I hand over to them. I only think if it's a beneficial trade for me. This has gotten to a point that we cannot let free markets resolve this, it requires government regulation and laws. I'm fortunate enough to live in EU.
  - porkbeer 3y ago
    I can. Selling your customer is vile for any amount of money.
    - blackpill0w 3y ago
      The thing is, you don't even lose that customer (only a tiny minority care about privacy issues), it's literally free money.
    - 3y ago
quicklime 3y ago
> Here's something you might not realize. The moment you sit in the passenger seat of a Subaru that uses connected services, you've consented to allow them to use -- and maybe even sell -- your personal information. According to their privacy policy, that means things like your name, location, "Audio recordings of Vehicle Occupants", and inferences they can draw about things like your "characteristics, predispositions, behavior, or attitudes." Call us bonkers, but we don't think that simply sitting in the passenger seat of someone's Subaru should mean you consent to having any of your personal information use for, well, pretty much anything at all. Let alone potentially sold to data brokers or shared with third party marketers so they can target you with ads about who knows what based on the the inferences they draw about you because you sat in the back seat of a Subaru in the mountains of Colorado. We're gonna really call out Subaru for this, because they lay it out so clearly in their privacy policy, but please know, Subaru isn't the only car company doing this sort of icky thing. Am I reading this correctly? I could be a passenger in my friend's Subaru, or even in an Uber, and they claim they have a right to my personal data? Surely this isn't legal, there's no way they could claim to have consent for this...
- SamuelAdams 3y ago
  Well, unethical yes. But it’s not illegal. You are not being forced to buy a car, you are free to walk away from or stop using a product at any time for any reason. How is this data tracking any different from what google, twitter, or Facebook use? If it’s legal for tech companies to collect user data, why would it be illegal for car companies?
  - inductive_magic 3y ago
    >How is this data tracking any different from what google, twitter, or Facebook use? To use an application from one of these providers, you explicitly have to agree to their terms and services: a contract between you and the company is established. How is that equivalent to taking an uber?
    - peoplefromibiza 3y ago
mosselman 3y ago
Collect information about your sex life!? In what way? Also, will these brand track geolocation information, etc? Insane that any regulator would approve of this. A car shouldn’t be smart, it should be hardware that knows nothing about you. You can then enhance the car with something like Apple car play since you already use that phone everywhere anyway. 750 billion a year industry? What kind of dystopia do we live in? Should we move to a system where a company can only do things or make things that are in their direct industry? So a car company can only make and sell cars and not sell data? I have no idea what the solutions are, but this sounds horrible.
- fhd2 3y ago
  I think rather than saying a company can only do one thing, one could argue a product should only do one thing to extract value from it: 1. One time payment 2. Subscription payments 3. Usage-based payments 4. Selling personal data (to other _products_) 5. Showing ads (based on data collected by the product itself or bought) If Google makes a car in this world, they'd have the option of making the thing free and in turn it sells data they can use for their ad business, basically how I'd say they monetise Chrome (beyond that sweet web monopoly they get out of it). I think that could potentially be a lot more honest, consumers would know exactly what price they pay. And it'd make it a bit harder to build and maintain a monopoly through strategic product portfolios. Seems like there's an argument there that complex/hidden pricing schemes and the illusion of free are too much to ask the typical consumer to untangle, it'd therefore classify as consumer protection in my book. I noticed that companies that run most of their business units as profit centers (where units also generate revenue from other units) seem to do better than those that have mostly revenue and cost centers and lots of politics in-between. So maybe we'd even get better products this way. Edit: Upon reflection, what's difficult is defining what a product is in this model. My spontaneous approach is that a product is anything than you can choose or decline to use. If my smart TV maker says "well the home menu is a different product from the TV" - totally fine. Give consumers the choice of using a different home menu and you got a deal. If those two things are inseparably (by practical means) intertwined, it's one product.
- CatWChainsaw 3y ago
  >Collect information about your sex life!? In what way? My straightforward guess is cameras pointed in the car, or collect information from the phones in the car and try to extrapolate using techniques perfected by Meta. >Should we move to a system where a company can only do things or make things that are in their direct industry? So a car company can only make and sell cars and not sell data? I would be interested in that just to see what happens to the FANGs. Google can pick between youtube and chromebooks; meta can't have its own VR headset; what even happens to Apple? It would at least get more people thinking about if hyper monopoly/monopsony and vertical integration into every area of life is actually desirable.
deleted 3y ago
[deleted]
lencastre 3y ago
It’s becoming increasingly more difficult to find cars without tracking technology which also meet environment requirements……..
- pluc 3y ago
  Even the stuff that used to be entirely consumer-oriented are now data harvesters. Want to protect your car from being stolen? Put in several GPS chips that will help us locate it - but until you need it, those chips are basically geolocation beacon for context ads. Convenience is being used to track everyone and everything.
  - dreamcompiler 3y ago
    GPS chips don't matter because they are receive-only. What matters are cellular modems. Those need to be found and disabled.
    - zo1 3y ago
      Until they make it illegal to tamper with said modems.
      - 20after4 3y ago
        I'm sure it already is.
- johngladtj 3y ago
  As designed by the regulators
- porkbeer 3y ago
  Its hard to find either. Except for used cars. The environmental impact of production is already borne, and many older models dont track you.
jokowueu 3y ago
If my car isn't connected to the internet how is this data being sent ?
- _ZeD_ 3y ago
  but your car is
  - tintedfireglass 3y ago
    How? in what way? A car neither has cellular data nor has a fiber ethernet running through it. Does it collect data and relay it to a server whenever like a mobile phone is connected or a wifi network is connected or goes to a service center?
    - Argonaut998 3y ago
      Modern cars have their own esim that don’t depend on anything external such as your phone or connecting to your network of choice. E.g., Cubic Telecom
    - eptcyka 3y ago
      They often do, and if they’re not connected, the data is stored until it’s serviced, at which point the dealership downloads all of it.
      - DANmode 3y ago
        OR you're in an accident and law enforcement dumps your vehicle's storage, OR your vehicle is hacked. Better to just never create the data, if we can avoid it.
      - AshamedCaptain 3y ago
        I also noticed that even after a "factory reset" of my head unit I could still see logs of downloaded contact names while perusing its filesystem.
      - 3y ago
ChrisArchitect 3y ago
[dupe]
- ChrisArchitect 3y ago
  Lots more discussion days ago over here: https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37401563 https://news.ycombinator.com/item?id=37401563
- tremon 3y ago
  At least this one is the original source.
- passwordoops 3y ago
  And keep it on the front page until this bs stops
layoric 3y ago
Can anyone more familiar with the subject let us know around what year of manufacturing in cars did this trend start? I don't particularly want to keep driving a petrol car, but seriously don't want this crap either.. I might just keep my 2010 alive as long as I can.
- DANmode 3y ago
  We must create the demand for true-hybrid conversion kits for the type of vehicles you have in mind.
- bsenftner 3y ago
  2016 model year for Subaru was the last year they did not have all this data gathering. 2018 for most American made cars.
  - ysavir 3y ago
    That's good to know. I bought a 2015 Subaru just a year ago. Any chance you can share your source so that I can feel complete comfort about the data privacy of my car?
    - bsenftner 3y ago
      Subaru; I posed as an internal developer and contacted a few of their software groups inquiring about their internal utilities. The systems they use now were not in place until the 2017 model year.
- lloeki 3y ago
  A quick litmus test would be any car that is able to connect to the internet or to a manufacturer app on a smartphone. My car (Honda EDM) is 2018 and is - if we want to make lousy parallels - essentially a "dumb phone". Sadly I will have to get rid of it and buy an electric or plug-in hybrid due to legislation. The only way not to get my soul sucked in would be to keep it airgapped, if that's even possible. The whole situation is an all too perfect example of "if they can do it, they will": the moment there was an upstream link manufacturers jumped on the occasion to mass-enshitify their cars. Of note, Mazda is conspicuously absent from the report, I would have been quite curious about their stance here given they were among the rare ones resisting the virtual-knobs-on-a-big-screen move.
curzondax 3y ago
although the article is mostly about in-car privacy, try querying your personal identifiable data at major auto brands online, no matter if you bought a car there or you sometimes stopped in the buying process. good luck! it's a nightmare - not only for you to file your wish, but also to get the data. and its your legal right with GDPR. tried it on two brands, it's a true nightmare.
- conquistadog 3y ago
  I was shocked when the local auto zone or equivalent looked up my car by plate and knew stuff I'd have objected to.
tomger 3y ago
I’m privacy conscious, and on the side of Mozilla here. But I wish the article showed examples of how the data is actually being shared rather than an analysis of the terms. What’s an example of my health data being used somewhere else. I know it’s hard to get proof of this but that is what would make the public more aware.
- philistine 3y ago
  Mozilla clearly has not looked at how data is collected at all. They're at step 1 of the privacy invasion story: let's shame the lawyers for all the unenforceable crap they wrote in the terms of service.
  - fredoliveira 3y ago
    > They're at step 1 of the privacy invasion story: let's shame the lawyers I would argue that they're at step 1, yes, but that step 1 is telling you these manufacturers have no respect for your privacy, period.
    - haswell 3y ago
      Which appears to be true. If these companies respected the privacy of their users, their privacy policies would not contain what they do. Regardless of current active data collection, I think it’s wise to read these policies as a declaration of intent.
- bondarchuk 3y ago
  When it's in the privacy policy: "don't care, they're not actually doing it" When they're actually doing it: "don't care, it was in the privacy policy, of course they do it" I think it's good to resist at every step.
- TedDoesntTalk 3y ago
  "So, what's the worst that could happen with your happy little Subaru Outback? Well, it would really stink to go visit your Mom, go for a ride in her new Subaru with all it's fancy, connected features, have a private conversation with Mom about how you helped your friend drive from state that outlawed abortion to one that does, and then end up have that audio recorded, then shared with law enforcement because Subaru says in their privacy policy they can share or sell that personal information, including to "detect and prevent criminal activity." That is perhaps a far fetched scenario and we really hope Subaru would never do that...but still, it seems like it is something that could happen, based on their privacy policy." https://foundation.mozilla.org/en/privacynotincluded/subaru/ https://foundation.mozilla.org/en/privacynotincluded/subaru/
verve_rat 3y ago
How does any if this work for second hand cars? If I buy a car second hand, I'm not party of any agreement between the original owner and the car maker.
rapht 3y ago
Let me repeat what I have already state elsewhere : the only way the privacy nightmare ends is when we thouroughly regulate the personal data market out of existence - meaning going one step further than GDPR and just forbid any use of my personal data except in the context of fulfilling an actual purchase or specific request by me and for communicating with me to the extent I allow it. All other uses are banned.
- api 3y ago
  That’d be pretty hard to get passed since not only does the government buy this data but political campaigns are massive customers. Every political party in the world is leveraging microtargeting now. It would require a really huge uproar, boycotts, lawsuits, and a wide spectrum movement. Hard to get that together in a world where political consciousness is constantly trapped in the tar pit of culture war trolling. The culture war pretty much guarantees no other issues can sway elections. …and of course all that data driven microtargeting is used to drive culture war rage trolling to keep things this way. They know exactly what will make you mad, and thus distract you.
- analog31 3y ago
  I think there should be a statutory penalty for possession or transmission of personal information. There's such a penalty for copyrighted music recordings. It creates an incentive for lawyers to act as bounty hunters on behalf of victims, for a cut of the settlement.
- deleted 3y ago
  [deleted]
cebert 3y ago
> Several car brands also note that it is a driver’s responsibility to tell passengers about the vehicle's privacy policies. Whoever makes these policies must get a chuckle knowing people will never do this.
- ryukoposting 3y ago
  As laughable as that rule is, it seems to me like this is also the easiest starting point for inducing change. Make a rule that says this isn't a reasonable demand, and consent must be explicit. This doesn't prevent surveillance, but it definitely makes it a lot less convenient.
franky47 3y ago
My dad bought a new Renault EV last month. The first thing the salesman asked him: Salesman: "Do you have a Google account?" My dad: "Yes, why?" Salesman: "It's mandatory for purchasing a car with us." How is that even legal?
- uconnectlol 3y ago
  it shouldnt be, its like needing loyalty points for buying things, should be counted as using a non state currency. there is just a lack of legal power on the side of people not in bed with corporations
- Angostura 3y ago
  "That's a shame", cya. Or "give me one moment while I set up an account that I will never look at again"
  - acdha 3y ago
    It has to be the first one or these companies will never change.
    - devnullbrain 3y ago
      Car dealerships are an insulating layer to protect manufacturers from the repercussions of the bullshit they inflict on customers. In exchange, dealerships are allowed to inject their own layer of bullshit.
  - OneLeggedCat 3y ago
    One moment? Have you created a Google account recently? It's not nearly as easy as it used to be. Wants to know DOB, gender, a working phone number that they verify, etc. Seems to me that by linking the phone number to what is probably the same phone number for your other Google accounts, you may as well just have used your main Google account to begin with.
    - 3y ago
erikig 3y ago
Both Nissan and Renault are under the same corporate umbrella (RNMA) and share parts and practices (including infotainment systems) quite regularly. The fact that Nissan was the worst offender and Renault the least problematic is interesting and shows that GDPR has been helpful in getting European focused brands to take privacy seriously.
uconnectlol 3y ago
14 year old script kiddies can also write a bash script and take over millions of vehicles from a home internet connection and make the crash its been proven before: https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect and will be proven again just like with all tech don't buy anything made after 1990. corporations now see your vehicle as a smart phone that just gets a stream of alpha quality software piled onto it and updated whenever they are told of their mistakes
- kh_hk 3y ago
  1990 is a bit of a stretch, I draw my line around the '00s.
- TheRealDunkirk 3y ago
  I work in the broad "automotive" sector. After ISO-9000 and 14000 and SOX and all the emissions regulations and the emissions documentation regulations and all the other make-work-for-auditing-firms regulations and certifications, the latest craze sweeping the industry is "functional safety." It sounds all well and good, but the requirements to satisfy the certifications are yet another enormous amount of work on top of all the rest, and I fear that companies are yet again getting caught up in the stuff that can be easily audited, and will be "straining at gnats and swallowing camels" when it comes to actual device security. To wit: all the stories about how KIA's are trivial to break into and drive away come to mind.
- devnullbrain 3y ago
  How do you have a pre-1990 computing device that supports SSL?
  - uconnectlol 3y ago
    i dont even want tls (since ssl is dead, just like tls will be) in my browser, why would i need that in my car? my car shouldnt have any software ever.
- javajosh 3y ago
flagrant_taco 3y ago
I assume calling out specific topics like users'sex life is a CYA move. They could very well be storing any and all audio in the car, at which point they could store info on anything said.
- alex_c 3y ago
  I agree, I assume the manufacturers aren’t out there writing code to detect, categorize and store sexual acts happening in their cars, and then selling that data to third parties. But the fact that we’re even discussing this is ridiculous.
  - jeremyjh 3y ago
    That does not sound like a safe assumption to me at all. If someone will pay for that data, I am quite sure it is happening.
    - acdha 3y ago
      It’s especially easy to imagine happening implicitly: feed everything into an ML system and if it tags it with something like “(sex noises)” or “(moaning)” (which Hollywood subtitles and other things in someone’s training data probably have) that’s searchable without anyone explicitly setting out to build a system.
      - flagrant_taco 3y ago
        I'd assume they are more likely to get valuable data from people talking about their sex life, if companies are actively trying to monetize in that way
        acdha 3y ago
        Oh, sure. The point is just that nobody has to put a business goal in to directly create that feature for it to be exposed by a general purpose classifier.
Mistletoe 3y ago
My two Toyota cars from 2001 I drive and maintain looking better every day…
nre 3y ago
Do the manufacturers have seperate aggrements for corporate/government fleet vehicles? Lots of confidential information would otherwise be recorded, like business deals and patient information.
mark_l_watson 3y ago
No mention of Honda? I was bummed since my wife and I drive a Honda.
- jlund-molfese 3y ago
  The format is not great, but Honda is there, as well as Acura https://foundation.mozilla.org/en/privacynotincluded/honda/ https://foundation.mozilla.org/en/privacynotincluded/honda/
  - mark_l_watson 3y ago
    thanks!
heikkilevanto 3y ago
Humble suggestion: What if many enough people went through the motions of buying a car, and backed off at the last moment because of unacceptable data collection. That would piss off the car dealers, who might vent their frustration to the importers, who might pass a word to the factories and designers...
- deleted 3y ago
  [deleted]
jfoutz 3y ago
I wonder what happens when lawyers realize they can subpoena all that. My client was subject to a hit and run, please provide all data related to red Subarus in San Francisco on April first from 1 pm to 2 pm pacific. Yeesh. Seems like a lot of data to wrangle.
nilslindemann 3y ago
https://www.youtube.com/watch?v=GugsCdLHm-Q https://www.youtube.com/watch?v=GugsCdLHm-Q
indymike 3y ago
Some of these terms are likely just illegal, unenforceable or flat out unpractical.
nwellinghoff 3y ago
Ok hackers. Tell us how to disable this crap. Surely all of this is easily defeated by removing the hardware that has the radio transmitter. Would love to see more technical articles on how all this stuff works such that it can be defeated or even better fake pumped.
- bob1029 3y ago
  I killed the OnStar module in my old car by cutting a wire. Willingness to violate manufacturer warranty is the #1 barrier. If you don't care, there isn't much to stop you from figuring it out on your own. Angle grinder will get you into anything. Just be careful with those high voltage systems in EVs...
  - unholythree 3y ago
    I think technically they would still have to honor the warranty on anything not directly effected by wire you cut, but you would probably have to fight them on it. Just like how warranty void if removed stickers are a lie under: https://en.m.wikipedia.org/wiki/Magnuson–Moss_Warranty_Act https://en.m.wikipedia.org/wiki/Magnuson–Moss_Warranty_Act
- Ccecil 3y ago
  From what I have seen on my 2013 VW the antenna on the roof is for the satellite/gps/phone (up to 3 wires in it, mine only has 1) the antennas for the FM/AM are incorporated into the windows...based on the brief stuff I read on the internet. So removing the roof antenna might do it...but then again it may render the system unable to start entirely (in the future it likely will). I suspect this is going to need to be reviewed on a car by car basis. And all of this assumes there isn't another antenna hidden somewhere else in the vast wiring loom (or on a pcb).
- itscrush 3y ago
  Well in Toyota's, DCM modules were recently moved behind the nav screen, have to pop the dash and remove the fuse itself to cut power to module until replaced. There's videos on youtube to help, as well as included in car manual[0]. Before recent, DCM was clearly marked in the fuse box, easily pulled there. [0] https://www.toyotanation.com/threads/disabling-the-dcm-in-my-2023-corolla-le.1748448/#lg=thread-1748448&slide=0 https://www.toyotanation.com/threads/disabling-the-dcm-in-my...
bit_logic 3y ago
California has CCPA https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac... Could this be used to force these companies to delete all personal data? It would have to be done periodically since after deletion the data would accumulate again. It seems like there's a potential business idea here of automatically sending out CCPA deletion notices to companies on a schedule. While this wouldn't stop the collection of data, regularly interrupting them with deletion requests could make storing personal data costly enough to at least reduce whatever profits they would get from it. EDIT: Looked at a few privacy policies and the CCPA link is often hard to find. Keywords to look for: "CCPA", "California Privacy", some examples of links I found: https://www.honda.com/privacy/your-privacy-choices https://www.honda.com/privacy/your-privacy-choices https://www.tesla.com/legal/privacy#data-sharing https://www.tesla.com/legal/privacy#data-sharing https://www.ford.com/help/privacy/ccpa/ https://www.ford.com/help/privacy/ccpa/ https://ksupport.kiausa.com/ConsumerAffairs/PrivacyManagement https://ksupport.kiausa.com/ConsumerAffairs/PrivacyManagemen... Something interesting I found is also this: https://www.honda.com/privacy/CCPA-Metrics https://www.honda.com/privacy/CCPA-Metrics which shows how many requests Honda received. It seems not many are aware of CCPA rights and this number of requests is not enough to deter companies from gathering personal information. These metrics need to be orders of magnitude higher to make a difference in company behavior. It seems like an automated service to send these requests and more public awareness of CCPA could help here. EDIT2: A lot of these forms ask whether you're submitting the request for yourself or you're an authorized agent doing it for someone else. I found more details on "authorized agents" on the CCPA FAQ: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa. Maybe an organization like Mozilla or EFF could setup a service where you can authorize them to do this for you? Then you could just select a checkbox of companies that you want CCPA deletion requests for and it would be sent on a regular schedule (quarterly? yearly?). If such a service became popular, it could really disrupt the personal data gathering of companies.
firefoxd 3y ago
These internet connected cars will eventually turn into Westinghouse Radiohubs. [1] For most people, even those who don't subscribe to the internet requiring service, there is no way to disable it. Especially when the radio device is inaccessible. On a separate note, I recently got a CPAP machine. It comes with a copy of the terms and conditions that i had to sign and return to the doctor. Before you connect it, you must attach an external radio device. Luckily, they botched the delivery and the device was 4 months late. Then when they finally sent it, it went to the wrong address. I called and said i never received it, before the neighbors brought my package. That's when i learned that the $1000 device i got was actually a subscription for $50 a month after the insurance contribution. I never plugged the radio device and the machine works just fine. I paid $1000 for a fan with a tube, but at least I'm not paying for the subscription and never connected the spying component. [1]: https://news.ycombinator.com/item?id=22083759 https://news.ycombinator.com/item?id=22083759
- robterrell 3y ago
  In the US, if the CPAP is being paid for by insurance, the cellular modem is used to track "compliance" -- i.e. are you using the thing enough for them to justify paying for it. But if not, the CPAPs I've seen have an "airplane" mode where the cellular modem can be turned off, and you can google for guides to physically disconnect the modem internally.
- underlipton 3y ago
  There seems to be a decent amount of terrible-business-practice-bullet-dodging these days, thanks in part to the slapdash nature of how many of these companies operate. I needed a new mattress a few years ago, and reluctantly dived into a market that is widely known to be a massive scam.[1] At the end of my second 100-day-trial, I prepared to return my unit and get my $700 back (much better than the $2000 I'd put on credit for the preceding one). However, the company I used simply processed the refund and suggested I move the mattress to a guest room, or donate it (at my expense). Something tells me that it was not actually worth anywhere close to $700. Less luck with my CPAP. The one I got through my doctor was subject to the same issues, and they even tried to charge me after I sent it back. The replacement I purchased off Craigslist had been used in a smoking household, which I didn't think would be a problem, but turned out to be a huge problem. Even after disassembling the thing, soaking every part I could in bleach, and meticulously cleaning the pump, it still pumps out air that smells faintly of tar and soot. It would be nice to live in a country where healthcare was accessible. [1]: https://boulter.com/blog/2008/08/20/the-mattress-industry-is-one-big-scam/ https://boulter.com/blog/2008/08/20/the-mattress-industry-is... (This does not reference the affiliate review hustle that has blown up since it was published.)
sholladay 3y ago
If it weren’t so hard to start a successful car company, I would say this is a situation ripe with opportunity. A privacy focused vehicle could probably sway enough customers for it to be a meaningful advantage, even if it wasn’t people’s number one priority. I wonder if Apple saw this coming when they started their automobile program, which seems less crazy to me the more time goes on. I always figured it had more to do with screen time and entertainment for when full autonomous driving becomes available. But the more I think about it, that will probably be less of a unique feature than privacy.
- javajosh 3y ago
  I think it's viable as a service business, like car stereos or tinting.
rvba 3y ago
Nice and all, but has anyone in Mozilla thought about spending money on the browser?
iamthepieman 3y ago
Are commercial vehicles the same as consumer vehicles? I know there's not really a great distinction, at least in the U.S. but if I buy a cargo van and add some seats to it, is there some distinction between that and the latest super-connected consumer model sedan?
moomoo11 3y ago
Self driving cars will be the worst offenders then. You will have no choice to move freely once all cars are self driving. You will be tracked even more than today with these cars. Personally I think cars and freedom of movement are very important. And I do everything in my power to oppose self driving cars.
natch 3y ago
Just buy a Tesla. For those of you who think for yourselves and are still reading, I'll explain why. They have the best practices of any connected car listed, it's all opt in, and they collect nothing tied to your ID. Privacy aside, also there's no haggling, and it's a better car with lower TCO and more efficient drive train and wicked fun. The leather and mahogany and built in cigar cutter is not there, but hey you have a charging network. Back to privacy, to me it's a feature, not a bug, that you can view live video from your car's many cameras while you are far away from your car. I can check from the office whether my garage door is open. That's good, not bad. Mozilla is really amping up the hyperventilation to think of this as a negative. If you read carefully it sounds like nobody contributing to the article actually sat in a Tesla and went through the experience of how choices are presented. The way I look at it most of the negatives they tried very hard to come up with in the article for Tesla boil down to "it seems we aren't sure if we can trust them because look at us, doing business with Google, which is also a privacy nightmare, and if we posture like this, Tesla might too" which is all fair, but very weak. You actually don't see Tesla posturing about privacy, although maybe they might after this article. That would be reasonable. When you do read the fine print, it is very good for consumer privacy. Just buy a great car that you love, but also one that you won't regret buying later.
- Ylpertnodi 3y ago
  >Just buy a Tesla. No. Because of the owner.
  - natch 3y ago
    He's actually a good guy, though it's your choice if he rubs you the wrong way.
    - nemo 3y ago
      He's using his bullhorn at Twitter to spread antisemitic lies at a time when hate crimes against Jews are escalating. That definitely rubs me the wrong way and I worry about those it doesn't.
zyngaro 3y ago
It’s on going to get worse with autonomous cars.
- CatWChainsaw 3y ago
  To a whole new degree. You want to go to the bar? Car says no because it talked with your health insurance and decided your liver doesn't meet minimum health requirements for beers with friends. Want to take a trip to DC? You criticized a past president on social media once, so you might be a terrorist so cars aren't allowed to take you within ten miles of the district.
vinay_ys 3y ago
One thing that is not clear is if this data collection and phone-home works even if there is no cellular plan active on the car?
hellotheretoday 3y ago
This is why I refuse to buy a new fancy car I drove my friends Subaru with lane assist and adaptive cruise control and such. It’s nice, but I figured with the level of data collection that’s going on in these cars plus the fact that there seemed to be a cellular internet connection baked into the car there had to be some fucked up nonsense going on My daily driver, a 2016 smart fortwo, is not as fancy or practical. But it is through and through a “dumb” car despite the name. It has no real modern creature comforts aside from automatic windshield wipers and headlights. Otherwise it’s like a car from 1998 with modern crash safety and I love it for that. Maybe it collects a ton of data but I’m very confident it doesn’t phone home. Plus a rear engined manual! Although a 3 cylinder one lol. At least you can park it basically anywhere
robbywashere_ 3y ago
My bicycle never spied on me
jmakov 3y ago
How don't they get sued by millions of ppl? If I buy a used car and I haven't agree to all the data collection, how is this legal?
merdaverse 3y ago
I was always skeptical of these fancy new vehicles with shiny electronics. I'm glad I still drive a 15 year old car and a 10 year old motorcycle where the most advanced tech is ABS.

Connecting your phone to a rental or friends cars bluetooth will also snarf all your contacts and identifying phone data. Often times in a way that cannot be erased, even by a tech.

derwiki 3y ago
Even if you decline Contact syncing but otherwise use Carplay?
NotYourLawyer 3y ago
When the car asks your phone for contact info, you click decline.
- viscountchocula 3y ago
  In Android, at least, it defaults the checkbox to allow contact and text message sharing. You have to uncheck it before hitting connect. It's not actually an allow/deny contact sharing button. It's an extra step if and only if you want to deny. Dark pattern.

9328997379 3y ago

[flagged]

kiwih 3y ago

Most important sentence of the article is the first: > All 25 major car brands reviewed in Mozilla’s latest edition of Privacy Not Included (PNI) received failing marks for consumer privacy, a first in the buyer's guide’s seven-year history.

deleted 3y ago
[deleted]
darkclouds 3y ago
They didnt review any Porsche's then! Porsche is reportedly concerned over the Android Auto collecting too much data. https://www.theguardian.com/technology/2015/oct/07/google-denies-in-car-entertainment-android-auto-listens-to-users-porsche-apple https://www.theguardian.com/technology/2015/oct/07/google-de... https://www.motorbiscuit.com/porsche-models-still-not-android-auto/#:~:text=Here's%20why%20Porsche%20didn't%20provide%20Android%20Auto%20integration&text=According%20to%20Autoevolution%2C%20Porsche%20originally,the%20car%20manufacturer%20considered%20confidential https://www.motorbiscuit.com/porsche-models-still-not-androi....
- _wf2l 3y ago
  just because they're concerned about Android auto collecting too much data doesn't mean they themselves don't using other mechanisms.
  - darkclouds 3y ago
    I dont care if Porsche collect data on my driving style to improve their cars. Car manufacturers will see how ineffective and dangerous the ABS/ESP can be in some situations, just like flappy paddle gear boxes still need a clutch pedal to engage the clutch when driving over low grip situations like oil, ice, snow and rain, and the car gets out of shape, because few are perfectly balanced. Dipping the clutch to bring the car under control and pointing in the direction you want to travel is essential in these situations. Here [1] Misha could have dipped the clutch or knocked the gears up from 4 to 5 or 6, to prevent the engine and rear wheels acting like a hand brake. Whats also interesting to note is the traction didnt kick in for a second or two, once he was already getting more side ways. Now I know the Mercedes AMG have had their traction control setup for at least a decade with drift mode tolerances, but in this situation, the traction should have cut in more quickly to bring the speed down and apply the front brakes only. So whilst the driver waits for the traction to kick in, having a clutch peddle to dip is the next best thing if the flappy paddle gear box cant knock the gearbox up a couple of higher gears quickly enough, even being able to change the brake bias quickly on the fly like in rally cars could help. Its also why when a car gets sideways, it invariably leaves skid marks on the road before a crash. Some people are capable of driving with faster reaction times than the systems can react. I know this because I've had to switch my traction control off "mid situation" to avoid a crash and now as a default switch mine off religiously when driving. I object to the data being shared, just like the UK Govt shares the names and addresses of every person who is eligible to vote with people who stand in a parliamentary election when they can stump up a £500 deposit which is far cheaper than any mailing list! Makes me wonder about the Monster Raving Loony Party! And other entities can also get this data which shows the law is not fit for purpose in some areas in todays day and age. So there should be a default data cant be shared unless opting in imo. [1] https://www.youtube.com/watch?v=rH3YpRYVTBM&t=1215s https://www.youtube.com/watch?v=rH3YpRYVTBM&t=1215s

tecleandor 3y ago

> The very worst offender is Nissan. The Japanese car manufacturer admits in their privacy policy to collecting a wide range of information, including sexual activity, health diagnosis data, and genetic data — but doesn’t specify how. My dad just bought a Nissan Qashqai (I hate it, but wathever). For legal reference, I'm on Spain, so EU GDPR framework. Every single time you start the car it shows a consent screen for data aquisition. By memory... "Driving data, location, statistics, blablabla for the Nissan Connect program." - I haven't connected nor I have a user or anything at all in the Nissan Connect apps - You can't disable the dialog, not even in the service menu - I've been digging in forums and everyone says you have to bear with that for the whole life of the car That's not ethical, and probably not even legal.

speedgoose 3y ago
Can you refuse as easily as you can consent?
- andy81 3y ago
  Nag on boot already means that you can't refuse as easily as you can consent. Presumably they don't harrass users to accept the agreement once already accepted.
  - tremon 3y ago
    Presumably they don't harrass users to accept the agreement once already accepted They may have to, as long as they can't identify who's behind the wheel: a single driver can't (legally) accept those terms for all future drivers of the car.
- deleted 3y ago
  [deleted]
unyttigfjelltol 3y ago
And, from a pre-smartcar perspective, a terrible driver experience. I don't understand why the consumer marketplace puts up with this.

polotics 3y ago

I went in there looking because of the amazing notion that car makers grant themselves the right to gather and divulge information related to (quote) your "sex life". And indeed KIA wins the Internet of Creeps with the aforementied explicitly included in the data they somehow (how?) aim to gather and distribute to the winds. https://foundation.mozilla.org/en/privacynotincluded/kia/ https://foundation.mozilla.org/en/privacynotincluded/kia/ Genetic information is also included, but come on, does a KIA steering wheel suck up your sweat and send it to an hidden PCR machine??? I think the people at KIA who wrote that "cover our arses" legalese going through every piece of data they could possibly at one time gather needs to factor in the cost of some customers, me included, never ever getting a KIA. Anyways as I understand they are extremely easy to steal, looks like a failing brand won't be able to get parts (or private parts) for long.

Nereuxofficial 3y ago
Maybe because people may have sex in their car. But yeah it is incredibly creepy how much data these companies collect
- dividedbyzero 3y ago
  Pregnancies should be fairly straightforward to detect and are hugely valuable info for marketing.
  - NoZebra120vClip 3y ago
    Look at bright side: when car detects that you're knocked up, it can automatically route you to nearest abortion provider. No tech company will dare to track you there! https://www.reuters.com/world/us/google-delete-location-history-visits-abortion-clinics-2022-07-01/ https://www.reuters.com/world/us/google-delete-location-hist...
    - thsksbd 3y ago
      I think sarcasm is tone Id use in this case, but you do have a valid point.

okasaki 3y ago

> Who we are > The Mozilla Foundation works to ensure the internet remains a public resource that is open and accessible to us all. ??

SOLAR_FIELDS 3y ago

Curious how much less data these manufacturers get if I’m using CarPlay instead of their own homegrown console. It’s getting to the point where I straight up won’t purchase a new vehicle if it doesn’t offer CarPlay. There’s probably other sensor gathering happening around the vehicle and obviously you can’t hide things like driving habits but it feels like staying out of the manufacturer’s homegrown OS gets rid of a good chunk of the worst privacy nightmares

inhumantsar 3y ago
Why would it? It's not like the car's OS is off while you're using carplay. There's still microphones, GPS, cameras, etc.
- dividedbyzero 3y ago
  I assume the manufacturer's OS would be what's running the car side of CarPlay, so it might even be able to get information from CarPlay.
pluc 3y ago
Are you seriously considering that your phone tracks you less than your car?
- dreamcompiler 3y ago
  You can turn off location services on your phone. You can't in your car.
  - pluc 3y ago
    By definition as long as your mobile phone is a mobile phone it's a tracking device. You can turn it off just like you can turn your car off
- heyoni 3y ago
  Yes.

defrost 3y ago

Previous discussion: Internet-connected cars fail privacy and security tests conducted by Mozilla 3 days ago|632 comments https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37404413

travisgriggs 3y ago

Surveillance Economy all the way baby. Until this comes to be understood et large as a basic contributing doctrine of our basic value exchange system, this type of thing will continue to be more and more pervasive. Given the multiple years we’ve been at it, I think a basic doctrine of privacy as a counterweight is too squishy to really settle in the public’s mind and countermand the negative effects of the surveillance at large. A new counter doctrine will need to take place. I’m not sure what it would be.

b112 3y ago
It's gotten to the point that I can't get mad at CEOs, companies: "So you're saying everyone does it, no one really complains, all our competitors do it, it's legal... and highly profitable?" I mean, of course they're doing it. I can just see a board meeting "LG even records you when you watch TV?!?", uh, OK I guess, let's do it.
- piyuv 3y ago
  It's really like that nowadays. As I become more and more aware and learnt, I started reading privacy policies of products. All of them have blanket statements. They claim ownership of any and all data they'll access for functionality. So I stopped reading them. I implicitly agree that any product I use can and will use all the data I hand over to them. I only think if it's a beneficial trade for me. This has gotten to a point that we cannot let free markets resolve this, it requires government regulation and laws. I'm fortunate enough to live in EU.
- porkbeer 3y ago
  I can. Selling your customer is vile for any amount of money.
  - blackpill0w 3y ago
    The thing is, you don't even lose that customer (only a tiny minority care about privacy issues), it's literally free money.
  - 3y ago

quicklime 3y ago

> Here's something you might not realize. The moment you sit in the passenger seat of a Subaru that uses connected services, you've consented to allow them to use -- and maybe even sell -- your personal information. According to their privacy policy, that means things like your name, location, "Audio recordings of Vehicle Occupants", and inferences they can draw about things like your "characteristics, predispositions, behavior, or attitudes." Call us bonkers, but we don't think that simply sitting in the passenger seat of someone's Subaru should mean you consent to having any of your personal information use for, well, pretty much anything at all. Let alone potentially sold to data brokers or shared with third party marketers so they can target you with ads about who knows what based on the the inferences they draw about you because you sat in the back seat of a Subaru in the mountains of Colorado. We're gonna really call out Subaru for this, because they lay it out so clearly in their privacy policy, but please know, Subaru isn't the only car company doing this sort of icky thing. Am I reading this correctly? I could be a passenger in my friend's Subaru, or even in an Uber, and they claim they have a right to my personal data? Surely this isn't legal, there's no way they could claim to have consent for this...

SamuelAdams 3y ago
Well, unethical yes. But it’s not illegal. You are not being forced to buy a car, you are free to walk away from or stop using a product at any time for any reason. How is this data tracking any different from what google, twitter, or Facebook use? If it’s legal for tech companies to collect user data, why would it be illegal for car companies?
- inductive_magic 3y ago
  >How is this data tracking any different from what google, twitter, or Facebook use? To use an application from one of these providers, you explicitly have to agree to their terms and services: a contract between you and the company is established. How is that equivalent to taking an uber?
  - peoplefromibiza 3y ago

mosselman 3y ago

Collect information about your sex life!? In what way? Also, will these brand track geolocation information, etc? Insane that any regulator would approve of this. A car shouldn’t be smart, it should be hardware that knows nothing about you. You can then enhance the car with something like Apple car play since you already use that phone everywhere anyway. 750 billion a year industry? What kind of dystopia do we live in? Should we move to a system where a company can only do things or make things that are in their direct industry? So a car company can only make and sell cars and not sell data? I have no idea what the solutions are, but this sounds horrible.

fhd2 3y ago
I think rather than saying a company can only do one thing, one could argue a product should only do one thing to extract value from it: 1. One time payment 2. Subscription payments 3. Usage-based payments 4. Selling personal data (to other _products_) 5. Showing ads (based on data collected by the product itself or bought) If Google makes a car in this world, they'd have the option of making the thing free and in turn it sells data they can use for their ad business, basically how I'd say they monetise Chrome (beyond that sweet web monopoly they get out of it). I think that could potentially be a lot more honest, consumers would know exactly what price they pay. And it'd make it a bit harder to build and maintain a monopoly through strategic product portfolios. Seems like there's an argument there that complex/hidden pricing schemes and the illusion of free are too much to ask the typical consumer to untangle, it'd therefore classify as consumer protection in my book. I noticed that companies that run most of their business units as profit centers (where units also generate revenue from other units) seem to do better than those that have mostly revenue and cost centers and lots of politics in-between. So maybe we'd even get better products this way. Edit: Upon reflection, what's difficult is defining what a product is in this model. My spontaneous approach is that a product is anything than you can choose or decline to use. If my smart TV maker says "well the home menu is a different product from the TV" - totally fine. Give consumers the choice of using a different home menu and you got a deal. If those two things are inseparably (by practical means) intertwined, it's one product.
CatWChainsaw 3y ago
>Collect information about your sex life!? In what way? My straightforward guess is cameras pointed in the car, or collect information from the phones in the car and try to extrapolate using techniques perfected by Meta. >Should we move to a system where a company can only do things or make things that are in their direct industry? So a car company can only make and sell cars and not sell data? I would be interested in that just to see what happens to the FANGs. Google can pick between youtube and chromebooks; meta can't have its own VR headset; what even happens to Apple? It would at least get more people thinking about if hyper monopoly/monopsony and vertical integration into every area of life is actually desirable.

deleted 3y ago

[deleted]

lencastre 3y ago

It’s becoming increasingly more difficult to find cars without tracking technology which also meet environment requirements……..

pluc 3y ago
Even the stuff that used to be entirely consumer-oriented are now data harvesters. Want to protect your car from being stolen? Put in several GPS chips that will help us locate it - but until you need it, those chips are basically geolocation beacon for context ads. Convenience is being used to track everyone and everything.
- dreamcompiler 3y ago
  GPS chips don't matter because they are receive-only. What matters are cellular modems. Those need to be found and disabled.
  - zo1 3y ago
    Until they make it illegal to tamper with said modems.
    - 20after4 3y ago
      I'm sure it already is.
johngladtj 3y ago
As designed by the regulators
porkbeer 3y ago
Its hard to find either. Except for used cars. The environmental impact of production is already borne, and many older models dont track you.

jokowueu 3y ago

If my car isn't connected to the internet how is this data being sent ?

_ZeD_ 3y ago
but your car is
- tintedfireglass 3y ago
  How? in what way? A car neither has cellular data nor has a fiber ethernet running through it. Does it collect data and relay it to a server whenever like a mobile phone is connected or a wifi network is connected or goes to a service center?
  - Argonaut998 3y ago
    Modern cars have their own esim that don’t depend on anything external such as your phone or connecting to your network of choice. E.g., Cubic Telecom
  - eptcyka 3y ago
    They often do, and if they’re not connected, the data is stored until it’s serviced, at which point the dealership downloads all of it.
    - DANmode 3y ago
      OR you're in an accident and law enforcement dumps your vehicle's storage, OR your vehicle is hacked. Better to just never create the data, if we can avoid it.
    - AshamedCaptain 3y ago
      I also noticed that even after a "factory reset" of my head unit I could still see logs of downloaded contact names while perusing its filesystem.
    - 3y ago

ChrisArchitect 3y ago

[dupe]

ChrisArchitect 3y ago
Lots more discussion days ago over here: https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37404413 https://news.ycombinator.com/item?id=37401563 https://news.ycombinator.com/item?id=37401563
tremon 3y ago
At least this one is the original source.
passwordoops 3y ago
And keep it on the front page until this bs stops

layoric 3y ago

Can anyone more familiar with the subject let us know around what year of manufacturing in cars did this trend start? I don't particularly want to keep driving a petrol car, but seriously don't want this crap either.. I might just keep my 2010 alive as long as I can.

DANmode 3y ago
We must create the demand for true-hybrid conversion kits for the type of vehicles you have in mind.
bsenftner 3y ago
2016 model year for Subaru was the last year they did not have all this data gathering. 2018 for most American made cars.
- ysavir 3y ago
  That's good to know. I bought a 2015 Subaru just a year ago. Any chance you can share your source so that I can feel complete comfort about the data privacy of my car?
  - bsenftner 3y ago
    Subaru; I posed as an internal developer and contacted a few of their software groups inquiring about their internal utilities. The systems they use now were not in place until the 2017 model year.
lloeki 3y ago
A quick litmus test would be any car that is able to connect to the internet or to a manufacturer app on a smartphone. My car (Honda EDM) is 2018 and is - if we want to make lousy parallels - essentially a "dumb phone". Sadly I will have to get rid of it and buy an electric or plug-in hybrid due to legislation. The only way not to get my soul sucked in would be to keep it airgapped, if that's even possible. The whole situation is an all too perfect example of "if they can do it, they will": the moment there was an upstream link manufacturers jumped on the occasion to mass-enshitify their cars. Of note, Mazda is conspicuously absent from the report, I would have been quite curious about their stance here given they were among the rare ones resisting the virtual-knobs-on-a-big-screen move.

curzondax 3y ago

although the article is mostly about in-car privacy, try querying your personal identifiable data at major auto brands online, no matter if you bought a car there or you sometimes stopped in the buying process. good luck! it's a nightmare - not only for you to file your wish, but also to get the data. and its your legal right with GDPR. tried it on two brands, it's a true nightmare.

conquistadog 3y ago
I was shocked when the local auto zone or equivalent looked up my car by plate and knew stuff I'd have objected to.

tomger 3y ago

I’m privacy conscious, and on the side of Mozilla here. But I wish the article showed examples of how the data is actually being shared rather than an analysis of the terms. What’s an example of my health data being used somewhere else. I know it’s hard to get proof of this but that is what would make the public more aware.

philistine 3y ago
Mozilla clearly has not looked at how data is collected at all. They're at step 1 of the privacy invasion story: let's shame the lawyers for all the unenforceable crap they wrote in the terms of service.
- fredoliveira 3y ago
  > They're at step 1 of the privacy invasion story: let's shame the lawyers I would argue that they're at step 1, yes, but that step 1 is telling you these manufacturers have no respect for your privacy, period.
  - haswell 3y ago
    Which appears to be true. If these companies respected the privacy of their users, their privacy policies would not contain what they do. Regardless of current active data collection, I think it’s wise to read these policies as a declaration of intent.
bondarchuk 3y ago
When it's in the privacy policy: "don't care, they're not actually doing it" When they're actually doing it: "don't care, it was in the privacy policy, of course they do it" I think it's good to resist at every step.
TedDoesntTalk 3y ago
"So, what's the worst that could happen with your happy little Subaru Outback? Well, it would really stink to go visit your Mom, go for a ride in her new Subaru with all it's fancy, connected features, have a private conversation with Mom about how you helped your friend drive from state that outlawed abortion to one that does, and then end up have that audio recorded, then shared with law enforcement because Subaru says in their privacy policy they can share or sell that personal information, including to "detect and prevent criminal activity." That is perhaps a far fetched scenario and we really hope Subaru would never do that...but still, it seems like it is something that could happen, based on their privacy policy." https://foundation.mozilla.org/en/privacynotincluded/subaru/ https://foundation.mozilla.org/en/privacynotincluded/subaru/

verve_rat 3y ago

How does any if this work for second hand cars? If I buy a car second hand, I'm not party of any agreement between the original owner and the car maker.

rapht 3y ago

Let me repeat what I have already state elsewhere : the only way the privacy nightmare ends is when we thouroughly regulate the personal data market out of existence - meaning going one step further than GDPR and just forbid any use of my personal data except in the context of fulfilling an actual purchase or specific request by me and for communicating with me to the extent I allow it. All other uses are banned.

api 3y ago
That’d be pretty hard to get passed since not only does the government buy this data but political campaigns are massive customers. Every political party in the world is leveraging microtargeting now. It would require a really huge uproar, boycotts, lawsuits, and a wide spectrum movement. Hard to get that together in a world where political consciousness is constantly trapped in the tar pit of culture war trolling. The culture war pretty much guarantees no other issues can sway elections. …and of course all that data driven microtargeting is used to drive culture war rage trolling to keep things this way. They know exactly what will make you mad, and thus distract you.
analog31 3y ago
I think there should be a statutory penalty for possession or transmission of personal information. There's such a penalty for copyrighted music recordings. It creates an incentive for lawyers to act as bounty hunters on behalf of victims, for a cut of the settlement.
deleted 3y ago
[deleted]

cebert 3y ago

> Several car brands also note that it is a driver’s responsibility to tell passengers about the vehicle's privacy policies. Whoever makes these policies must get a chuckle knowing people will never do this.

ryukoposting 3y ago
As laughable as that rule is, it seems to me like this is also the easiest starting point for inducing change. Make a rule that says this isn't a reasonable demand, and consent must be explicit. This doesn't prevent surveillance, but it definitely makes it a lot less convenient.

franky47 3y ago

My dad bought a new Renault EV last month. The first thing the salesman asked him: Salesman: "Do you have a Google account?" My dad: "Yes, why?" Salesman: "It's mandatory for purchasing a car with us." How is that even legal?

uconnectlol 3y ago
it shouldnt be, its like needing loyalty points for buying things, should be counted as using a non state currency. there is just a lack of legal power on the side of people not in bed with corporations
Angostura 3y ago
"That's a shame", cya. Or "give me one moment while I set up an account that I will never look at again"
- acdha 3y ago
  It has to be the first one or these companies will never change.
  - devnullbrain 3y ago
    Car dealerships are an insulating layer to protect manufacturers from the repercussions of the bullshit they inflict on customers. In exchange, dealerships are allowed to inject their own layer of bullshit.
- OneLeggedCat 3y ago
  One moment? Have you created a Google account recently? It's not nearly as easy as it used to be. Wants to know DOB, gender, a working phone number that they verify, etc. Seems to me that by linking the phone number to what is probably the same phone number for your other Google accounts, you may as well just have used your main Google account to begin with.
  - 3y ago

erikig 3y ago

Both Nissan and Renault are under the same corporate umbrella (RNMA) and share parts and practices (including infotainment systems) quite regularly. The fact that Nissan was the worst offender and Renault the least problematic is interesting and shows that GDPR has been helpful in getting European focused brands to take privacy seriously.

uconnectlol 3y ago

14 year old script kiddies can also write a bash script and take over millions of vehicles from a home internet connection and make the crash its been proven before: https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect https://en.wikipedia.org/wiki/Chrysler#Chrysler_Uconnect and will be proven again just like with all tech don't buy anything made after 1990. corporations now see your vehicle as a smart phone that just gets a stream of alpha quality software piled onto it and updated whenever they are told of their mistakes

kh_hk 3y ago
1990 is a bit of a stretch, I draw my line around the '00s.
TheRealDunkirk 3y ago
I work in the broad "automotive" sector. After ISO-9000 and 14000 and SOX and all the emissions regulations and the emissions documentation regulations and all the other make-work-for-auditing-firms regulations and certifications, the latest craze sweeping the industry is "functional safety." It sounds all well and good, but the requirements to satisfy the certifications are yet another enormous amount of work on top of all the rest, and I fear that companies are yet again getting caught up in the stuff that can be easily audited, and will be "straining at gnats and swallowing camels" when it comes to actual device security. To wit: all the stories about how KIA's are trivial to break into and drive away come to mind.
devnullbrain 3y ago
How do you have a pre-1990 computing device that supports SSL?
- uconnectlol 3y ago
  i dont even want tls (since ssl is dead, just like tls will be) in my browser, why would i need that in my car? my car shouldnt have any software ever.
javajosh 3y ago

flagrant_taco 3y ago

I assume calling out specific topics like users'sex life is a CYA move. They could very well be storing any and all audio in the car, at which point they could store info on anything said.

alex_c 3y ago
I agree, I assume the manufacturers aren’t out there writing code to detect, categorize and store sexual acts happening in their cars, and then selling that data to third parties. But the fact that we’re even discussing this is ridiculous.
- jeremyjh 3y ago
  That does not sound like a safe assumption to me at all. If someone will pay for that data, I am quite sure it is happening.
  - acdha 3y ago
    It’s especially easy to imagine happening implicitly: feed everything into an ML system and if it tags it with something like “(sex noises)” or “(moaning)” (which Hollywood subtitles and other things in someone’s training data probably have) that’s searchable without anyone explicitly setting out to build a system.
    - flagrant_taco 3y ago
      I'd assume they are more likely to get valuable data from people talking about their sex life, if companies are actively trying to monetize in that way
      - acdha 3y ago
        Oh, sure. The point is just that nobody has to put a business goal in to directly create that feature for it to be exposed by a general purpose classifier.

Mistletoe 3y ago

My two Toyota cars from 2001 I drive and maintain looking better every day…

nre 3y ago

Do the manufacturers have seperate aggrements for corporate/government fleet vehicles? Lots of confidential information would otherwise be recorded, like business deals and patient information.

mark_l_watson 3y ago

No mention of Honda? I was bummed since my wife and I drive a Honda.

jlund-molfese 3y ago
The format is not great, but Honda is there, as well as Acura https://foundation.mozilla.org/en/privacynotincluded/honda/ https://foundation.mozilla.org/en/privacynotincluded/honda/
- mark_l_watson 3y ago
  thanks!

heikkilevanto 3y ago

Humble suggestion: What if many enough people went through the motions of buying a car, and backed off at the last moment because of unacceptable data collection. That would piss off the car dealers, who might vent their frustration to the importers, who might pass a word to the factories and designers...

deleted 3y ago
[deleted]

jfoutz 3y ago

I wonder what happens when lawyers realize they can subpoena all that. My client was subject to a hit and run, please provide all data related to red Subarus in San Francisco on April first from 1 pm to 2 pm pacific. Yeesh. Seems like a lot of data to wrangle.

nilslindemann 3y ago

https://www.youtube.com/watch?v=GugsCdLHm-Q https://www.youtube.com/watch?v=GugsCdLHm-Q

indymike 3y ago

Some of these terms are likely just illegal, unenforceable or flat out unpractical.

nwellinghoff 3y ago

Ok hackers. Tell us how to disable this crap. Surely all of this is easily defeated by removing the hardware that has the radio transmitter. Would love to see more technical articles on how all this stuff works such that it can be defeated or even better fake pumped.

bob1029 3y ago
I killed the OnStar module in my old car by cutting a wire. Willingness to violate manufacturer warranty is the #1 barrier. If you don't care, there isn't much to stop you from figuring it out on your own. Angle grinder will get you into anything. Just be careful with those high voltage systems in EVs...
- unholythree 3y ago
  I think technically they would still have to honor the warranty on anything not directly effected by wire you cut, but you would probably have to fight them on it. Just like how warranty void if removed stickers are a lie under: https://en.m.wikipedia.org/wiki/Magnuson–Moss_Warranty_Act https://en.m.wikipedia.org/wiki/Magnuson–Moss_Warranty_Act
Ccecil 3y ago
From what I have seen on my 2013 VW the antenna on the roof is for the satellite/gps/phone (up to 3 wires in it, mine only has 1) the antennas for the FM/AM are incorporated into the windows...based on the brief stuff I read on the internet. So removing the roof antenna might do it...but then again it may render the system unable to start entirely (in the future it likely will). I suspect this is going to need to be reviewed on a car by car basis. And all of this assumes there isn't another antenna hidden somewhere else in the vast wiring loom (or on a pcb).
itscrush 3y ago
Well in Toyota's, DCM modules were recently moved behind the nav screen, have to pop the dash and remove the fuse itself to cut power to module until replaced. There's videos on youtube to help, as well as included in car manual[0]. Before recent, DCM was clearly marked in the fuse box, easily pulled there. [0] https://www.toyotanation.com/threads/disabling-the-dcm-in-my-2023-corolla-le.1748448/#lg=thread-1748448&slide=0 https://www.toyotanation.com/threads/disabling-the-dcm-in-my...

bit_logic 3y ago

California has CCPA https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac... Could this be used to force these companies to delete all personal data? It would have to be done periodically since after deletion the data would accumulate again. It seems like there's a potential business idea here of automatically sending out CCPA deletion notices to companies on a schedule. While this wouldn't stop the collection of data, regularly interrupting them with deletion requests could make storing personal data costly enough to at least reduce whatever profits they would get from it. EDIT: Looked at a few privacy policies and the CCPA link is often hard to find. Keywords to look for: "CCPA", "California Privacy", some examples of links I found: https://www.honda.com/privacy/your-privacy-choices https://www.honda.com/privacy/your-privacy-choices https://www.tesla.com/legal/privacy#data-sharing https://www.tesla.com/legal/privacy#data-sharing https://www.ford.com/help/privacy/ccpa/ https://www.ford.com/help/privacy/ccpa/ https://ksupport.kiausa.com/ConsumerAffairs/PrivacyManagement https://ksupport.kiausa.com/ConsumerAffairs/PrivacyManagemen... Something interesting I found is also this: https://www.honda.com/privacy/CCPA-Metrics https://www.honda.com/privacy/CCPA-Metrics which shows how many requests Honda received. It seems not many are aware of CCPA rights and this number of requests is not enough to deter companies from gathering personal information. These metrics need to be orders of magnitude higher to make a difference in company behavior. It seems like an automated service to send these requests and more public awareness of CCPA could help here. EDIT2: A lot of these forms ask whether you're submitting the request for yourself or you're an authorized agent doing it for someone else. I found more details on "authorized agents" on the CCPA FAQ: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa. Maybe an organization like Mozilla or EFF could setup a service where you can authorize them to do this for you? Then you could just select a checkbox of companies that you want CCPA deletion requests for and it would be sent on a regular schedule (quarterly? yearly?). If such a service became popular, it could really disrupt the personal data gathering of companies.

firefoxd 3y ago

These internet connected cars will eventually turn into Westinghouse Radiohubs. [1] For most people, even those who don't subscribe to the internet requiring service, there is no way to disable it. Especially when the radio device is inaccessible. On a separate note, I recently got a CPAP machine. It comes with a copy of the terms and conditions that i had to sign and return to the doctor. Before you connect it, you must attach an external radio device. Luckily, they botched the delivery and the device was 4 months late. Then when they finally sent it, it went to the wrong address. I called and said i never received it, before the neighbors brought my package. That's when i learned that the $1000 device i got was actually a subscription for $50 a month after the insurance contribution. I never plugged the radio device and the machine works just fine. I paid $1000 for a fan with a tube, but at least I'm not paying for the subscription and never connected the spying component. [1]: https://news.ycombinator.com/item?id=22083759 https://news.ycombinator.com/item?id=22083759

robterrell 3y ago
In the US, if the CPAP is being paid for by insurance, the cellular modem is used to track "compliance" -- i.e. are you using the thing enough for them to justify paying for it. But if not, the CPAPs I've seen have an "airplane" mode where the cellular modem can be turned off, and you can google for guides to physically disconnect the modem internally.
underlipton 3y ago
There seems to be a decent amount of terrible-business-practice-bullet-dodging these days, thanks in part to the slapdash nature of how many of these companies operate. I needed a new mattress a few years ago, and reluctantly dived into a market that is widely known to be a massive scam.[1] At the end of my second 100-day-trial, I prepared to return my unit and get my $700 back (much better than the $2000 I'd put on credit for the preceding one). However, the company I used simply processed the refund and suggested I move the mattress to a guest room, or donate it (at my expense). Something tells me that it was not actually worth anywhere close to $700. Less luck with my CPAP. The one I got through my doctor was subject to the same issues, and they even tried to charge me after I sent it back. The replacement I purchased off Craigslist had been used in a smoking household, which I didn't think would be a problem, but turned out to be a huge problem. Even after disassembling the thing, soaking every part I could in bleach, and meticulously cleaning the pump, it still pumps out air that smells faintly of tar and soot. It would be nice to live in a country where healthcare was accessible. [1]: https://boulter.com/blog/2008/08/20/the-mattress-industry-is-one-big-scam/ https://boulter.com/blog/2008/08/20/the-mattress-industry-is... (This does not reference the affiliate review hustle that has blown up since it was published.)

sholladay 3y ago

If it weren’t so hard to start a successful car company, I would say this is a situation ripe with opportunity. A privacy focused vehicle could probably sway enough customers for it to be a meaningful advantage, even if it wasn’t people’s number one priority. I wonder if Apple saw this coming when they started their automobile program, which seems less crazy to me the more time goes on. I always figured it had more to do with screen time and entertainment for when full autonomous driving becomes available. But the more I think about it, that will probably be less of a unique feature than privacy.

javajosh 3y ago
I think it's viable as a service business, like car stereos or tinting.

rvba 3y ago

Nice and all, but has anyone in Mozilla thought about spending money on the browser?

iamthepieman 3y ago

Are commercial vehicles the same as consumer vehicles? I know there's not really a great distinction, at least in the U.S. but if I buy a cargo van and add some seats to it, is there some distinction between that and the latest super-connected consumer model sedan?

moomoo11 3y ago

Self driving cars will be the worst offenders then. You will have no choice to move freely once all cars are self driving. You will be tracked even more than today with these cars. Personally I think cars and freedom of movement are very important. And I do everything in my power to oppose self driving cars.

natch 3y ago

Just buy a Tesla. For those of you who think for yourselves and are still reading, I'll explain why. They have the best practices of any connected car listed, it's all opt in, and they collect nothing tied to your ID. Privacy aside, also there's no haggling, and it's a better car with lower TCO and more efficient drive train and wicked fun. The leather and mahogany and built in cigar cutter is not there, but hey you have a charging network. Back to privacy, to me it's a feature, not a bug, that you can view live video from your car's many cameras while you are far away from your car. I can check from the office whether my garage door is open. That's good, not bad. Mozilla is really amping up the hyperventilation to think of this as a negative. If you read carefully it sounds like nobody contributing to the article actually sat in a Tesla and went through the experience of how choices are presented. The way I look at it most of the negatives they tried very hard to come up with in the article for Tesla boil down to "it seems we aren't sure if we can trust them because look at us, doing business with Google, which is also a privacy nightmare, and if we posture like this, Tesla might too" which is all fair, but very weak. You actually don't see Tesla posturing about privacy, although maybe they might after this article. That would be reasonable. When you do read the fine print, it is very good for consumer privacy. Just buy a great car that you love, but also one that you won't regret buying later.

Ylpertnodi 3y ago
>Just buy a Tesla. No. Because of the owner.
- natch 3y ago
  He's actually a good guy, though it's your choice if he rubs you the wrong way.
  - nemo 3y ago
    He's using his bullhorn at Twitter to spread antisemitic lies at a time when hate crimes against Jews are escalating. That definitely rubs me the wrong way and I worry about those it doesn't.

zyngaro 3y ago

It’s on going to get worse with autonomous cars.

CatWChainsaw 3y ago
To a whole new degree. You want to go to the bar? Car says no because it talked with your health insurance and decided your liver doesn't meet minimum health requirements for beers with friends. Want to take a trip to DC? You criticized a past president on social media once, so you might be a terrorist so cars aren't allowed to take you within ten miles of the district.

vinay_ys 3y ago

One thing that is not clear is if this data collection and phone-home works even if there is no cellular plan active on the car?

hellotheretoday 3y ago

This is why I refuse to buy a new fancy car I drove my friends Subaru with lane assist and adaptive cruise control and such. It’s nice, but I figured with the level of data collection that’s going on in these cars plus the fact that there seemed to be a cellular internet connection baked into the car there had to be some fucked up nonsense going on My daily driver, a 2016 smart fortwo, is not as fancy or practical. But it is through and through a “dumb” car despite the name. It has no real modern creature comforts aside from automatic windshield wipers and headlights. Otherwise it’s like a car from 1998 with modern crash safety and I love it for that. Maybe it collects a ton of data but I’m very confident it doesn’t phone home. Plus a rear engined manual! Although a 3 cylinder one lol. At least you can park it basically anywhere

robbywashere_ 3y ago

My bicycle never spied on me

jmakov 3y ago

How don't they get sued by millions of ppl? If I buy a used car and I haven't agree to all the data collection, how is this legal?

merdaverse 3y ago

I was always skeptical of these fancy new vehicles with shiny electronics. I'm glad I still drive a 15 year old car and a 10 year old motorcycle where the most advanced tech is ABS.