11 ms·

> Here's something you might not realize. The moment you sit in the passenger seat of a Subaru that uses connected services, you've consented to allow them to u

> Here's something you might not realize. The moment you sit in the passenger seat of a Subaru that uses connected services, you've consented to allow them to use -- and maybe even sell -- your personal information. According to their privacy policy, that means things like your name, location, "Audio recordings of Vehicle Occupants", and inferences they can draw about things like your "characteristics, predispositions, behavior, or attitudes." Call us bonkers, but we don't think that simply sitting in the passenger seat of someone's Subaru should mean you consent to having any of your personal information use for, well, pretty much anything at all. Let alone potentially sold to data brokers or shared with third party marketers so they can target you with ads about who knows what based on the the inferences they draw about you because you sat in the back seat of a Subaru in the mountains of Colorado. We're gonna really call out Subaru for this, because they lay it out so clearly in their privacy policy, but please know, Subaru isn't the only car company doing this sort of icky thing. Am I reading this correctly? I could be a passenger in my friend's Subaru, or even in an Uber, and they claim they have a right to my personal data? Surely this isn't legal, there's no way they could claim to have consent for this...

SamuelAdams 3y ago
Well, unethical yes. But it’s not illegal. You are not being forced to buy a car, you are free to walk away from or stop using a product at any time for any reason. How is this data tracking any different from what google, twitter, or Facebook use? If it’s legal for tech companies to collect user data, why would it be illegal for car companies?
- inductive_magic 3y ago
  >How is this data tracking any different from what google, twitter, or Facebook use? To use an application from one of these providers, you explicitly have to agree to their terms and services: a contract between you and the company is established. How is that equivalent to taking an uber?
  - peoplefromibiza 3y ago
    Your access and use of the Services constitutes your agreement to be bound by these Terms, which establishes a contractual relationship between you and Uber. If you do not agree to these Terms, you may not access or use the Services. The Services may be made available or accessed in connection with third party services and content (including advertising) that Uber does not control. https://www.uber.com/legal/en/document/?country=hong-kong&lang=en&name=general-terms-of-use https://www.uber.com/legal/en/document/?country=hong-kong&la...
    - acdha 3y ago
      Yes: using Uber obviously involves a relationship between you and Uber, and you agree to that when you open the app. What’s different here is that car manufacturers are claiming that, say, sitting in that Uber gives them the right to record your audio and sell it to advertisers. That’s illegal in many places such as the EU or states with two-party consent laws, and it’s unlikely that courts would accept it elsewhere without some kind of informed consent.
      - peoplefromibiza 3y ago
        > hat’s illegal in many places such as the EU or states with two-party consent laws you accepted the tos, you've been informed, that's not unlawful if you gave your consent and the data is kept in the EU. Moreover, the article is claiming that the manufacturer can "maybe even sell" the recordings but the official statement is that they are only collecting the data, not selling it (it would be stupid to claim otherwise). The blog post specifically use the sentence and maybe even sell, because it is not stated anywhere. > and it’s unlikely that courts would accept it elsewhere without some kind of informed consent. meanwhile the advertisers already used your data, and there's nothing you could do about it. Except not using Uber (that's why I never used one, even though cabs in my Country and especially in my city, are a big "mafia style" mob)
        acdha 3y ago
        > you accepted the tos, you've been informed, that's not unlawful if you gave your consent and the data is kept in the EU. Are you seriously saying that everyone who gets in an Uber signs a form the driver gives them saying that the car manufacturer might resell all of their data?
- hgomersall 3y ago
  I'm not so sure. There are certain expectations about how things are used. There's no reasonable expectation that getting into someone else's car implies any consent that the manufacturer of the car can now harvest data about you at will. I reserve judgement on the legality of this until it's actually tested. In any case, it being legal is readily remediable if the law makers care enough.
- bluecalm 3y ago
  In EU it's very illegal. You can't tie consent to use personal data which isn't absolutely necessary to provide the service. If it wasn't car companies (pet EU regulators industry) we would be talking about billions in fines already.
  - cccbbbaaa 3y ago
    It is possible; maybe you are mistaking it for other legal basis such as legitimate interest. Or maybe I get this wrong? But you are right that this is illegal, because just sitting in a car is not a “specific, informed and unambiguous indication of the data subject's wishes”, which mandatory for consent (GDPR article 4(11)). Neither it is “transparent” (GDPR article 6(1)a).
    - janosd 3y ago
      Even if you can justify something with legitimate interest, which is a huge if, the data subject must be informed and have the option to object.
- Retric 3y ago
  A car passenger isn’t party to the contract nor informed of its existence. You can write anything you want, but no that doesn’t make it a valid contract.
  - jtbayly 3y ago
    FB has pictures of people who are not users of FB, as well as shadow profiles of such users. Seems very similar to me.
    - philistine 3y ago
      If I'm not mistaken, this has never been definitely proven in court. We know they do it, but courts have never discussed that. Doesn't make it legal.
      - jtbayly 3y ago
        To be clear, I’m not claiming it’s legal (or agreeing with the guy who says it’s no big deal). Just pointing out it is fairly equivalent. More than I expected before I started thinking about the comparison.
        Retric 3y ago
        To be equivalent FB would need to be taking the photos themselves and then selling the data. I really can’t think of a good online equivalent. Google street view would be close except they blur peoples faces.
        tough 3y ago
        didnt they only start blurring on maps after european courts told them so?
        jtbayly 3y ago
        Shadow profiles are - collected by FB - without even the pretense of consent - sold to the highest bidder
- CatWChainsaw 3y ago
  I've never been a fan of the "you're free to severely hinder your ability to operate in society because them's the breaks" schtick. Why not change the laws? Why not be better?
  - catchnear4321 3y ago
    whoa whoa whoa, this wild talk of putting in effort for a better future is dangerous. you might upset the status quo. worse, you might succeed, proving all the naysayers to be both negative and wrong.
- atoav 3y ago
  Sorry but you are getting this wrong. 1. Certain rights cannot be easily waived depending where you live — this requires "informed consent". Informed consent means you laid out what you are collecting and for which purposes clearly and in easy language — and that I consented to that. 2. Implying consent through action ala "by entering these doorsteps you have signed away your firstborn child" doesn't work. 3. At least under the GDPR not consenting shall not lead to a worse service. If I enter the car of some guy and his cars manual (available only as pdf download) says on page 234 that he automatically consents to this by using the car, the manufacturer did neither gain his, nor my informed consent. This is illegal under the GDPR — a law that doesn't only apply to cookie banners and the internet, but to any form of data collection. (In the EU of course)
CatWChainsaw 3y ago
I want to know more about the "genetic information" collection. Is there a needle and an entire next-gen sequencer hiding under my seat, or will that be in the 2027 model?
- moffkalast 3y ago
  There's a little arm that extends from the dash and scrapes a few skin cells off your neck, HHGTTG style.
- uoaei 3y ago
  Perhaps they wipe down the seats and feed it into a machine when doing "routine maintenance" at a dealership or licensed repair shop?
  - Ccecil 3y ago
    Or is it...this is in case they are asked to allow DNA collection from your car while being serviced without a warrant based on request from law enforcement. I am assuming it doesn't go that far and is referring more towards eye/hair/skin color...maybe just a CYA in case they "accidentally" collect info that could be identifying on a level not allowed (discrimination/privacy laws?).
- api 3y ago
  My guess is that they told a lawyer to write an agreement that allows them to collect absolutely anything with no limits whatsoever.
- deleted 3y ago
  [deleted]
- foresto 3y ago
  It's possible they're paving the way for abuse of future technology. For example: https://www.smithsonianmag.com/science-nature/scientists-pull-animal-dna-out-of-thin-air-180979324/ https://www.smithsonianmag.com/science-nature/scientists-pul...
bondarchuk 3y ago
Excuse my French, but audio recordings, holy shit. I thought we were still living in a society where recording audio of unsuspecting people in semi private spaces was at least a line that would not be crossed that casually. Apparently not.
- 0xEF 3y ago
  I agree with you, but we also collectively bought devices with active mics, cameras and a constant internet connection while legal aspects of data privacy were (and still are) a bit of a Wild West, so I'm not sure what anyone expected. We as consumers and citizens need to stop assuming our governments and corporations will just do the right thing and not tread those ethically grey lines. When "consent" is defined by those doing the exploiting, only total abstinence from the decision is the safe option, but we all continued to buy smart phones. Note, this is not a justification, but an attempt to understand how we got to now in hopes that by seeing where we've been, we can collectively make better decisions about where we are headed.
  - dahart 3y ago
    > legal aspects of data privacy were (and still are) a bit of a Wild West, so I’m not sure what anyone expected. […] we all continued to buy smart phones. Widespread breach of privacy is not a valid excuse for companies to continue violating privacy and even collecting potentially illegal surveillance, right? Phone taps and home searches without a warrant have been illegal for decades, and the fourth amendment to the constitution prohibits government search without probable cause in general. So what I expect is that the existing and established laws and goals carry forward in obvious and reasonable and unsurprising ways from the consumer’s point of view, without vested interests trying to pretend like digital devices’ ability to communicate are somehow radically different from any other type of communication. The only thing that’s changed is that recording and sharing and searching got much, much faster and easier. People who stand to benefit from that are arguing that because it got easier, it should be allowed, but from the privacy perspective it’s the opposite: because it got easier it means we need to actually enforce privacy, and put a stop to the contorted arguments that try to justify data collection without explicit consent.
nerdponx 3y ago
There's no statute prohibiting it, so it's legal until they lose in court.
- tremon 3y ago
  What about states with all-party consent for recording conversations?
  - nerdponx 3y ago
    Sure, but that's dependent on jurisdiction. Maybe you have standing in federal court if you drive from a one-party-consent state to a two-party-consent state, making it a matter of interstate commerce. Or a federal court would just rule that it's governed by the law of the state in which you registered the vehicle. In the US there's no federal protection for this that I'm aware of.
- ben_w 3y ago
  GDPR, to the extent that this data collection also occurs with European vehicles Are you sure there aren't local data privacy rules elsewhere that this also violates? GDPR itself basically just unified the existing privacy laws across ~EU member states.
  - nerdponx 3y ago
    I was thinking about the USA in my post, but if the GDPR protects against this then that's great. I've also seen mention that in e.g. Germany the standard EULA is basically illegal (or at least unenforceable) because you can't reasonably agree to it.
trackofalljades 3y ago
I read the whole thing, wondered how any of this could be possible, and then realized "oh, this is about that stupid expensive monthly service thing I don't use." Neither of my Subaru's is transmitting anything to anywhere. They're just GPS (and FM radio) receivers. I mean, yes, the terms are insane, but I'd also never agree to a silly monthly subscription Internet/entertainment/whatever thing from a car company. I'd never even pay for Sirius.
- TedDoesntTalk 3y ago
  > Neither of my Subaru's is transmitting anything to anywhere How do you know that? There's a 5G modem.
  - TimTheTinker 3y ago
    I also assume that as long as the car is in range of a 5G tower, the NSA is able to remotely activate the mic and modem to capture recordings, regardless of a person's location in the world and regardless of whether they're paying for service. Ditto (eventually) for several other spy agencies around the world. Given Apple's and Google's emphasis on security, I'm doubtful the same is happening for phones... but with targeted use of zero-days (assuming the right ones exist) it's at least possible in theory.
    - bennettnate5 3y ago
      > the NSA is able to Or, you know, your telco provider, who then bundles and sells such data in aggregation to third party services. They've been caught doing it with location services over and over; it wouldn't take much for them to include audio recordings, as long as they have their terms & conditions sorted out
      - throwaway50605 3y ago
        Telco provider uses data from their towers. They don't transmit information from your phone.
TedDoesntTalk 3y ago
> inferences they can draw about things like your "characteristics, predispositions, behavior, or attitudes." Presumably this includes GPS data, so they know if you frequent Starbucks or McDonald's. And sell your data appropriately.
TedDoesntTalk 3y ago
"So, what's the worst that could happen with your happy little Subaru Outback? Well, it would really stink to go visit your Mom, go for a ride in her new Subaru with all it's fancy, connected features, have a private conversation with Mom about how you helped your friend drive from state that outlawed abortion to one that does, and then end up have that audio recorded, then shared with law enforcement because Subaru says in their privacy policy they can share or sell that personal information, including to "detect and prevent criminal activity." That is perhaps a far fetched scenario and we really hope Subaru would never do that...but still, it seems like it is something that could happen, based on their privacy policy.
- croes 3y ago
  What if they are forced by governmental order to hand over their data?
  - vulcan01 3y ago
    The question is, why are they collecting it in the first place?
    - kingcobraninja 3y ago
      Two and a half words: post-purchase monetization
      - jprete 3y ago
        I think the GP's question is more rhetorical, or, to put it as a non-rhetorical question: "Why is it acceptable on any level for my car to become a spyware device on par with Facebook, when I paid an enormous sum to be its owner and controller for my own benefit, and not to become a residual profit stream for ${CAR_COMPANY}?".
      - imglorp 3y ago
        Recurring revenue. What's a dossier like that with on the market when it includes location, Bluetooth IDs of all occupants and private conversations? $5/mo? $10$?
bparsons 3y ago
The US has some of the weakest privacy laws on earth. Your real time location data (and everything else) from phone apps is sold on a semi-open marketplace to bill collectors, marketers, spies and PI's.
- hunter2_ 3y ago
  Phone apps developed by well-known companies such as Google, Microsoft, Uber, banks, etc.? Or just the shadier apps whose developers most people haven't heard of outside of the app store like IoT junk?
  - DANmode 3y ago
    Mixture of those, and also ISPs.
javajosh 3y ago
>Surely this isn't legal It's worse than that. The way the law works is that you'll only have standing to sue if you're harmed in some way. But since your data is slurped into a big black box, and then passed around and used by 3rd parties, the connection back to the original ingress point is tenuous at best. Some of those 3rd parties, arguably the most harmful, will themselves be law enforcement, and in the US they have qualified immunity, section 720, and a vast array of a) excuses to snoop and b) immunity from consequence. So, it's worse than illegal because you'll never have standing to sue them and find out. Of course, the solution is to not buy their products or, if you do, substantially modify them to remove all owner-hostile features after-market. Indeed, I predict a healthy secondary car (and phone!) market where trusted 3rd parties "sanitize" the product to protect the owner.
rcyeh 3y ago
Thanks for posting this. At the dealer last year, I thought it strange when, after I refused the Starlink Security Plus subscription with fee, they offered it “for free”. Starlink Safety Plus is already included for the first three years. Looking at the MySubaru app, it looks like I can cancel any subscription. There is also this opt-out setting to “Send Vehicle Location at Ignition-Off”: Vehicle Location If you choose to opt out of this service, MySubaru will not collect your vehicle location when you turn your ignition off. You will still be able to locate your vehicle by sending a remote command through the MySubaru app.

SamuelAdams 3y ago

Well, unethical yes. But it’s not illegal. You are not being forced to buy a car, you are free to walk away from or stop using a product at any time for any reason. How is this data tracking any different from what google, twitter, or Facebook use? If it’s legal for tech companies to collect user data, why would it be illegal for car companies?

inductive_magic 3y ago
>How is this data tracking any different from what google, twitter, or Facebook use? To use an application from one of these providers, you explicitly have to agree to their terms and services: a contract between you and the company is established. How is that equivalent to taking an uber?
- peoplefromibiza 3y ago
  Your access and use of the Services constitutes your agreement to be bound by these Terms, which establishes a contractual relationship between you and Uber. If you do not agree to these Terms, you may not access or use the Services. The Services may be made available or accessed in connection with third party services and content (including advertising) that Uber does not control. https://www.uber.com/legal/en/document/?country=hong-kong&lang=en&name=general-terms-of-use https://www.uber.com/legal/en/document/?country=hong-kong&la...
  - acdha 3y ago
    Yes: using Uber obviously involves a relationship between you and Uber, and you agree to that when you open the app. What’s different here is that car manufacturers are claiming that, say, sitting in that Uber gives them the right to record your audio and sell it to advertisers. That’s illegal in many places such as the EU or states with two-party consent laws, and it’s unlikely that courts would accept it elsewhere without some kind of informed consent.
    - peoplefromibiza 3y ago
      > hat’s illegal in many places such as the EU or states with two-party consent laws you accepted the tos, you've been informed, that's not unlawful if you gave your consent and the data is kept in the EU. Moreover, the article is claiming that the manufacturer can "maybe even sell" the recordings but the official statement is that they are only collecting the data, not selling it (it would be stupid to claim otherwise). The blog post specifically use the sentence and maybe even sell, because it is not stated anywhere. > and it’s unlikely that courts would accept it elsewhere without some kind of informed consent. meanwhile the advertisers already used your data, and there's nothing you could do about it. Except not using Uber (that's why I never used one, even though cabs in my Country and especially in my city, are a big "mafia style" mob)
      - acdha 3y ago
        > you accepted the tos, you've been informed, that's not unlawful if you gave your consent and the data is kept in the EU. Are you seriously saying that everyone who gets in an Uber signs a form the driver gives them saying that the car manufacturer might resell all of their data?
hgomersall 3y ago
I'm not so sure. There are certain expectations about how things are used. There's no reasonable expectation that getting into someone else's car implies any consent that the manufacturer of the car can now harvest data about you at will. I reserve judgement on the legality of this until it's actually tested. In any case, it being legal is readily remediable if the law makers care enough.
bluecalm 3y ago
In EU it's very illegal. You can't tie consent to use personal data which isn't absolutely necessary to provide the service. If it wasn't car companies (pet EU regulators industry) we would be talking about billions in fines already.
- cccbbbaaa 3y ago
  It is possible; maybe you are mistaking it for other legal basis such as legitimate interest. Or maybe I get this wrong? But you are right that this is illegal, because just sitting in a car is not a “specific, informed and unambiguous indication of the data subject's wishes”, which mandatory for consent (GDPR article 4(11)). Neither it is “transparent” (GDPR article 6(1)a).
  - janosd 3y ago
    Even if you can justify something with legitimate interest, which is a huge if, the data subject must be informed and have the option to object.
Retric 3y ago
A car passenger isn’t party to the contract nor informed of its existence. You can write anything you want, but no that doesn’t make it a valid contract.
- jtbayly 3y ago
  FB has pictures of people who are not users of FB, as well as shadow profiles of such users. Seems very similar to me.
  - philistine 3y ago
    If I'm not mistaken, this has never been definitely proven in court. We know they do it, but courts have never discussed that. Doesn't make it legal.
    - jtbayly 3y ago
      To be clear, I’m not claiming it’s legal (or agreeing with the guy who says it’s no big deal). Just pointing out it is fairly equivalent. More than I expected before I started thinking about the comparison.
      - Retric 3y ago
        To be equivalent FB would need to be taking the photos themselves and then selling the data. I really can’t think of a good online equivalent. Google street view would be close except they blur peoples faces.
        tough 3y ago
        didnt they only start blurring on maps after european courts told them so?
        jtbayly 3y ago
        Shadow profiles are - collected by FB - without even the pretense of consent - sold to the highest bidder
CatWChainsaw 3y ago
I've never been a fan of the "you're free to severely hinder your ability to operate in society because them's the breaks" schtick. Why not change the laws? Why not be better?
- catchnear4321 3y ago
  whoa whoa whoa, this wild talk of putting in effort for a better future is dangerous. you might upset the status quo. worse, you might succeed, proving all the naysayers to be both negative and wrong.
atoav 3y ago
Sorry but you are getting this wrong. 1. Certain rights cannot be easily waived depending where you live — this requires "informed consent". Informed consent means you laid out what you are collecting and for which purposes clearly and in easy language — and that I consented to that. 2. Implying consent through action ala "by entering these doorsteps you have signed away your firstborn child" doesn't work. 3. At least under the GDPR not consenting shall not lead to a worse service. If I enter the car of some guy and his cars manual (available only as pdf download) says on page 234 that he automatically consents to this by using the car, the manufacturer did neither gain his, nor my informed consent. This is illegal under the GDPR — a law that doesn't only apply to cookie banners and the internet, but to any form of data collection. (In the EU of course)

CatWChainsaw 3y ago

I want to know more about the "genetic information" collection. Is there a needle and an entire next-gen sequencer hiding under my seat, or will that be in the 2027 model?

moffkalast 3y ago
There's a little arm that extends from the dash and scrapes a few skin cells off your neck, HHGTTG style.
uoaei 3y ago
Perhaps they wipe down the seats and feed it into a machine when doing "routine maintenance" at a dealership or licensed repair shop?
- Ccecil 3y ago
  Or is it...this is in case they are asked to allow DNA collection from your car while being serviced without a warrant based on request from law enforcement. I am assuming it doesn't go that far and is referring more towards eye/hair/skin color...maybe just a CYA in case they "accidentally" collect info that could be identifying on a level not allowed (discrimination/privacy laws?).
api 3y ago
My guess is that they told a lawyer to write an agreement that allows them to collect absolutely anything with no limits whatsoever.
deleted 3y ago
[deleted]
foresto 3y ago
It's possible they're paving the way for abuse of future technology. For example: https://www.smithsonianmag.com/science-nature/scientists-pull-animal-dna-out-of-thin-air-180979324/ https://www.smithsonianmag.com/science-nature/scientists-pul...

bondarchuk 3y ago

Excuse my French, but audio recordings, holy shit. I thought we were still living in a society where recording audio of unsuspecting people in semi private spaces was at least a line that would not be crossed that casually. Apparently not.

0xEF 3y ago
I agree with you, but we also collectively bought devices with active mics, cameras and a constant internet connection while legal aspects of data privacy were (and still are) a bit of a Wild West, so I'm not sure what anyone expected. We as consumers and citizens need to stop assuming our governments and corporations will just do the right thing and not tread those ethically grey lines. When "consent" is defined by those doing the exploiting, only total abstinence from the decision is the safe option, but we all continued to buy smart phones. Note, this is not a justification, but an attempt to understand how we got to now in hopes that by seeing where we've been, we can collectively make better decisions about where we are headed.
- dahart 3y ago
  > legal aspects of data privacy were (and still are) a bit of a Wild West, so I’m not sure what anyone expected. […] we all continued to buy smart phones. Widespread breach of privacy is not a valid excuse for companies to continue violating privacy and even collecting potentially illegal surveillance, right? Phone taps and home searches without a warrant have been illegal for decades, and the fourth amendment to the constitution prohibits government search without probable cause in general. So what I expect is that the existing and established laws and goals carry forward in obvious and reasonable and unsurprising ways from the consumer’s point of view, without vested interests trying to pretend like digital devices’ ability to communicate are somehow radically different from any other type of communication. The only thing that’s changed is that recording and sharing and searching got much, much faster and easier. People who stand to benefit from that are arguing that because it got easier, it should be allowed, but from the privacy perspective it’s the opposite: because it got easier it means we need to actually enforce privacy, and put a stop to the contorted arguments that try to justify data collection without explicit consent.

nerdponx 3y ago

There's no statute prohibiting it, so it's legal until they lose in court.

tremon 3y ago
What about states with all-party consent for recording conversations?
- nerdponx 3y ago
  Sure, but that's dependent on jurisdiction. Maybe you have standing in federal court if you drive from a one-party-consent state to a two-party-consent state, making it a matter of interstate commerce. Or a federal court would just rule that it's governed by the law of the state in which you registered the vehicle. In the US there's no federal protection for this that I'm aware of.
ben_w 3y ago
GDPR, to the extent that this data collection also occurs with European vehicles Are you sure there aren't local data privacy rules elsewhere that this also violates? GDPR itself basically just unified the existing privacy laws across ~EU member states.
- nerdponx 3y ago
  I was thinking about the USA in my post, but if the GDPR protects against this then that's great. I've also seen mention that in e.g. Germany the standard EULA is basically illegal (or at least unenforceable) because you can't reasonably agree to it.

trackofalljades 3y ago

I read the whole thing, wondered how any of this could be possible, and then realized "oh, this is about that stupid expensive monthly service thing I don't use." Neither of my Subaru's is transmitting anything to anywhere. They're just GPS (and FM radio) receivers. I mean, yes, the terms are insane, but I'd also never agree to a silly monthly subscription Internet/entertainment/whatever thing from a car company. I'd never even pay for Sirius.

TedDoesntTalk 3y ago
> Neither of my Subaru's is transmitting anything to anywhere How do you know that? There's a 5G modem.
- TimTheTinker 3y ago
  I also assume that as long as the car is in range of a 5G tower, the NSA is able to remotely activate the mic and modem to capture recordings, regardless of a person's location in the world and regardless of whether they're paying for service. Ditto (eventually) for several other spy agencies around the world. Given Apple's and Google's emphasis on security, I'm doubtful the same is happening for phones... but with targeted use of zero-days (assuming the right ones exist) it's at least possible in theory.
  - bennettnate5 3y ago
    > the NSA is able to Or, you know, your telco provider, who then bundles and sells such data in aggregation to third party services. They've been caught doing it with location services over and over; it wouldn't take much for them to include audio recordings, as long as they have their terms & conditions sorted out
    - throwaway50605 3y ago
      Telco provider uses data from their towers. They don't transmit information from your phone.

TedDoesntTalk 3y ago

> inferences they can draw about things like your "characteristics, predispositions, behavior, or attitudes." Presumably this includes GPS data, so they know if you frequent Starbucks or McDonald's. And sell your data appropriately.

TedDoesntTalk 3y ago

"So, what's the worst that could happen with your happy little Subaru Outback? Well, it would really stink to go visit your Mom, go for a ride in her new Subaru with all it's fancy, connected features, have a private conversation with Mom about how you helped your friend drive from state that outlawed abortion to one that does, and then end up have that audio recorded, then shared with law enforcement because Subaru says in their privacy policy they can share or sell that personal information, including to "detect and prevent criminal activity." That is perhaps a far fetched scenario and we really hope Subaru would never do that...but still, it seems like it is something that could happen, based on their privacy policy.

croes 3y ago
What if they are forced by governmental order to hand over their data?
- vulcan01 3y ago
  The question is, why are they collecting it in the first place?
  - kingcobraninja 3y ago
    Two and a half words: post-purchase monetization
    - jprete 3y ago
      I think the GP's question is more rhetorical, or, to put it as a non-rhetorical question: "Why is it acceptable on any level for my car to become a spyware device on par with Facebook, when I paid an enormous sum to be its owner and controller for my own benefit, and not to become a residual profit stream for ${CAR_COMPANY}?".
    - imglorp 3y ago
      Recurring revenue. What's a dossier like that with on the market when it includes location, Bluetooth IDs of all occupants and private conversations? $5/mo? $10$?

bparsons 3y ago

The US has some of the weakest privacy laws on earth. Your real time location data (and everything else) from phone apps is sold on a semi-open marketplace to bill collectors, marketers, spies and PI's.

hunter2_ 3y ago
Phone apps developed by well-known companies such as Google, Microsoft, Uber, banks, etc.? Or just the shadier apps whose developers most people haven't heard of outside of the app store like IoT junk?
- DANmode 3y ago
  Mixture of those, and also ISPs.

javajosh 3y ago

>Surely this isn't legal It's worse than that. The way the law works is that you'll only have standing to sue if you're harmed in some way. But since your data is slurped into a big black box, and then passed around and used by 3rd parties, the connection back to the original ingress point is tenuous at best. Some of those 3rd parties, arguably the most harmful, will themselves be law enforcement, and in the US they have qualified immunity, section 720, and a vast array of a) excuses to snoop and b) immunity from consequence. So, it's worse than illegal because you'll never have standing to sue them and find out. Of course, the solution is to not buy their products or, if you do, substantially modify them to remove all owner-hostile features after-market. Indeed, I predict a healthy secondary car (and phone!) market where trusted 3rd parties "sanitize" the product to protect the owner.

rcyeh 3y ago

Thanks for posting this. At the dealer last year, I thought it strange when, after I refused the Starlink Security Plus subscription with fee, they offered it “for free”. Starlink Safety Plus is already included for the first three years. Looking at the MySubaru app, it looks like I can cancel any subscription. There is also this opt-out setting to “Send Vehicle Location at Ignition-Off”: Vehicle Location If you choose to opt out of this service, MySubaru will not collect your vehicle location when you turn your ignition off. You will still be able to locate your vehicle by sending a remote command through the MySubaru app.