17 ms·

Modern cars are spying on you. Here's what you can do about it

326 points by MilnerRoute 10mo ago

cluckindan 10mo ago
No doubt about this one. But, how much are the ubiquitous ride-for-hire e-scooters spying on you, and everyone else on the street?
- AtlasBarfed 10mo ago
  It's where we are. Everything everywhere is collecting data and spying. If it exists in a database, then the government has access to that database if it ever wants to legally or otherwise. It's been like that since 9:11 and probably before. All we need now is for the right person to walk in and turn the key. We're lucky that Donald Trump is probably too stupid to understand what he's got under his thumb.
  - josefritzishere 10mo ago
    Comment of the year.
  - add-sub-mul-div 10mo ago
    He's a useful president surrounded by smarter people who will figure out ways to use this data rather than sit around tweeting all day.
- cmdoptesc 10mo ago
  Those e-scooters are a red herring. Ring cameras on everyone's front door and automated license plate readers (ALPR) on police vehicles and Flock cameras throughout cities are bigger concerns in America. Flock is already known to assist the government surveilling protestors: - [CBP is monitoring US drivers and detaining those with suspicious travel patterns](https://news.ycombinator.com/item?id=45996860 https://news.ycombinator.com/item?id=45996860) - [How Cops Are Using Flock Safety's ALPR Network to Surveil Protesters and Activists](https://www.eff.org/deeplinks/2025/11/how-cops-are-using-flock-safetys-alpr-network-surveil-protesters-and-activists https://www.eff.org/deeplinks/2025/11/how-cops-are-using-flo...) - [Amazon has a form so police can get my (Ring) data without permission or a warrant](https://www.theverge.com/2022/7/14/23219419/amazon-ring-law-enforcement-no-warrant-no-consent https://www.theverge.com/2022/7/14/23219419/amazon-ring-law-...)
  - chneu 10mo ago
    The even worse part of Flock isn't that they cooperate with the government, it's that there is(or was) basically no security in the service. Cops from one state can/could use flock services from other states. A few cops got caught stalking via Flock. Flock takes the "do nothing until forced to" mentality.
- balamatom 10mo ago
  Enough to make sure the kids won't undercut the cartel this time around.
jmclnx 10mo ago
IIRC, Massachusetts passed a right-to-repair law a few years ago. Based upon the text of the law, all new cars purchased there have the spying disabled because they did not want to give up their proprietary info. There have been a lot of court cases about that law by the manufacturers, so I do not know the status at this point. So I wonder if that is still the case. If it is and an out of state person buys new there, will that "spying" remain disabled when they bring the car home ?
- anonymars 10mo ago
  Theoretically, that should be a catch-22, right? How would they know you're no longer in Massachusetts, without the spying enabled while within Massachusetts?
  - sejje 10mo ago
    Because "spying" in this case means "sending data to the mothership." It doesn't mean "the car's gps is disabled"
    - anonymars 10mo ago
      Perhaps. But what if a person living in Massachusetts travels to another state? I found this when looking into it more: https://arstechnica.com/cars/2023/06/feds-tell-automakers-not-to-comply-with-mass-right-to-repair-law/ https://arstechnica.com/cars/2023/06/feds-tell-automakers-no... "Now, according to Reuters, NHTSA has written to automakers to advise them not to comply with the Massachusetts law. Among its problems are the fact that someone “could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently,” and that “open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking.” Faced with this dilemma, it’s quite possible the automakers will respond by simply disabling telematics and connected services for customers in the state. Subaru already took that step when it introduced its model year 2022 vehicles, and NHTSA says other OEMs may do the same."
more_corn 10mo ago
Is there anything we can do about it short of avoiding new cars? Our legislators have proven unwilling to pass real privacy laws.
- throwaway2027 10mo ago
  No. Enjoy the ride.
  - qmr 10mo ago
    Defeatist and cowardly.
    - randallsquared 10mo ago
      Given that GP is accepting a level of additional risk which you profess not to be willing to accept, perhaps "cowardly" is not the correct adjective.
- DonHopkins 10mo ago
  Ride a bike.
  - pixelpoet 10mo ago
    I've never had a driver's licence, lived in a zillion countries; don't think I could do that in America though.
    - Retric 10mo ago
      Over half of New York City households are car-free. That jumps to 3/4 in Manhattan. Millions of American households don’t have a car, but you rarely hear about it as a viable option.
      - JoeBOFH 10mo ago
        Because as soon as you leave a major metropolitan area, not having a car is almost a nonstarter.
chasing0entropy 10mo ago
Remove the antennas. Do not give in to the mirage of convenience. Use a stand alone generic GPS. Vehicle GPS devices are anti privacy for so many reasons. Listen to stored music from an SD card if terrestrial radio (NO SATELLITE). Did you know almost ALL late model cars can play a <128gb FAT32 USB drive with non- vbr mp3s? 64gb filled with 168kb mp3 audio would take roughly 3 years at 4 hours a day to listen to. TURN YOUR PHONE OFF. Your phone does more than track you - the Bluetooth and wifi beacon scanners are always running. When you come across another person, most phones track the intersection of your beacon with theirs making a new data point that compromises both individuals privacy. Now consider sitting at a stoplight; you and and the 10 phones around you have now correlated the time and position you were sitting there. The person jogging by with no phone(but a set of Bluetooth headphones) is also tracked by their Bluetooth signature. Terrifying. Disable autonomous driving hardware by unplugging the cables from the interior cameras. If your car needs to see and feel you in order to do it's job, it's co-dependent; break up with it. Ignore your car's complaints and error messages. Did you know Orange dash error lights are non critical?
- galleywest200 10mo ago
  > Ignore your car's complaints and error messages. Did you know Orange dash error lights are non critical? "Tire pressure low" is one you should probably check out on a regular basis.
  - chneu 10mo ago
    Yeah that's terrible advice. Learning to ignore safety warnings is an amazing way to wind up stranded or with a destroyed car because you decided to ignore a warning light
    - potato3732842 10mo ago
      The first 100yr of automobiles didn't have TPMS and it was mostly fine.
      - 10mo ago
mistrial9 10mo ago
A 2013 Chevy Volt has a camera on the dashboard pointed at the driver. The entertainment dashboard has a dozen communication options, including those for safety? Zealots and the unhinged will quickly comment no doubt, but for the rational citizens I ask, when was this normalized? Was it automakers emboldened by the acceptance of cell phone central record keeping?
- balamatom 10mo ago
  > Zealots and the unhinged will quickly comment no doubt, but for the rational citizens I ask, when was this normalized? [laughs in unhinged zealot]
- potato3732842 10mo ago
  "Safety" is a magic word like "god" was a thousand years ago. If you say it just right you can manufacture an excuse to do all sorts of stuff that'll clearly lead to bad stuff if left to run. They undoubtably said things like "if it saves even one person from falling asleep at the wheel it's worth it" or something along those lines.
  - luqtas 10mo ago
    this is still a technology advancement... what if smartphone usage or asleep safely stops the car? what if this run locally? or what if it's linked to public entities that will add penalty points to your license? as a cyclist and public transport user with no driver license, i hope personal vehicles have so much sensors that they can detect if you are drunk or stressed and limit your reaches. fuck your metallic beetle
    - potato3732842 10mo ago
      >as a cyclist and public transport user with no driver license, i hope personal vehicles have so much sensors that they can detect if you are drunk or stressed and limit your reaches. fuck your metallic beetle What a great illustration of the sort of selfish opinions that people like to peddle under the guise of perceived common good. Are you willing to have your bike brakes linked up with GPS and red light signals? It's in the name of safety and progress after all.
emidln 10mo ago
My 2025 Mazda Miata has a CAN connected Telematics Control Unit that sends a bunch of data to Mazda on ignition off. Among this data is acceleration and velocity data along with coordinates sampled for where you were. It is also used as a gateway for the Mazda app to start your car, query your vehicle's tire pressure, etc. It is claimed that you can opt out of this by calling Mazda and being persistent. The CAN traffic is unencrypted. It was pretty easy to MITM this module with a cheap arm Linux board and a can transceiver to enable writing a two way filter capable of blocking the traffic that didn't raise any DTCs (that I observed) and could be turned on/off by the user. I preferred this approach to complete disconnection of the module (which is noticeable via errors at the diagnostic port) or trying to faraday cage or disable the antennae on the TCU so it can't remotely send/receive. I can also turn off my module or completely remove it before I sell it. I fear the next version of Miata will be an encrypted CAN like most other cars have moved to and even with my expertise I won't be able to access the latest safety features from new cars without surrendering what little privacy I've been able to claw back.
- CamperBob2 10mo ago
  I fear the next version of Miata will be an encrypted CAN like most other cars have moved to As I understand it, they're required to do that now if they want to sell in the EU. They emphatically do not want anyone tinkering with their cars.
  - bri3d 10mo ago
    They don’t want people modifying ADAS systems mostly, and the main requirement is SecOC, which is cryptographic authentication but the message is still plaintext. Basically they don’t want third party modifications able to randomly send the “steer left” message to the steering rack, for example.
    - CamperBob2 10mo ago
      Yes, and to do that, CAN must be encrypted. The idea isn't just to secure it from hackers. The idea is to secure it from owners.
jimnotgym 10mo ago
Here is something else you can do about it. By an older low mileage car. If we all did that the manufacturers would change tack soon enough
- closewith 10mo ago
  I did do this, but I also want a reasonable modern and safe car and in the EU, since 2018, that means a car with eCall. I have a 2017 that I will keep going as long as is economical, but after that, it will be nearly impossible to avoid these systems.
  - ryandrake 10mo ago
    The idea that a 20 year old car is unsafe is auto industry FUD. Yes, there have been great safety advances since the 1970s and 1980s. They've kind of tapered off though. I would absolutely trust my family's lives in any year 2000+ vehicle.
    - jeroenhd 10mo ago
      Airbag and crumple zone safety requirements for crashes that aren't head-on are much more recent than the 2000s. Many car makers designed their cars to pass those, but will leave you dead or worse if you get T-boned. ABS wasn't even a requirement in the EU until 2004, and American cars could be sold without ABS all the way until 2012, when traction control was also made mandatory (which the EU then also followed). Things like the slightly-angled side pole crash test was only added to the Euro NCAP in 2015 and was updated five years later to make it a bit more realistic, though cars still woefully fail in many real-life scenarios. I wouldn't really consider a car "safe" unless it passes the ~2015 requirements for car safety well. A well-designed car full of optional safety features from the ~2010s is probably also safe, but I wouldn't count on it unless you've done research into it. I believe Volvo has had a reputation of being ahead of the curve with these kinds of crash safety tests, but even they had to improve over time.
      - jimnotgym 10mo ago
Sharlin 10mo ago
Not driving seems to have worked pretty well thus far.
SilverElfin 10mo ago
The problem is a lot of the features of these cars require you to opt into giving your privacy away. And when you’re shopping it’s not clear where that line is.
thepasswordapp 10mo ago
The car data collection story is concerning, but it's part of a broader pattern: credentials and personal data are scattered across dozens of services we interact with daily. The automotive example shows how even "non-tech" products now collect and transmit data. Each service creates another attack surface, another set of credentials to manage, another potential breach vector. What's frustrating is that breach response still falls on individuals. When one of these services gets compromised, it's users who have to scramble to change passwords across potentially hundreds of connected accounts. The "change your password" advice is good but wildly impractical at scale.
jimnotgym 10mo ago
Is all of this data collection from the driving aids actually us doing R&D for their autonomous car projects?
- toofy 10mo ago
  people participating as beta testers with no way to opt out is absolutely the norm now. from video games to software to “self-driving” cars, we’re all unpaid beta testers for unfinished and often unsafe products.
exhilaration 10mo ago
Disabling the hardware can be really hard, my 2025 Toyota Sienna is always connected. You can't just pull a fuse or rip out an antenna, I have to take the entire dashboard apart to reach the Data Communication Module (DCM) module. If anyone's curious what that looks like, it's a little bit easier on the Toyota Tacoma, here are some pictures of the process: https://www.tacoma4g.com/forum/threads/disabling-dcm-telematics-in-2025-taco.10431/ https://www.tacoma4g.com/forum/threads/disabling-dcm-telemat... It's complex enough that I haven't done it yet in my Sienna, but I plan to!
- ProllyInfamous 10mo ago
  On a 2021 Camry there is an below-dash fuse labeled "DCM" which you can remove (and it does disable OnStar/telemetry, but not sat.radio[0]) — it also disables one of the speakers (used for phone calls), which there is a bypass to resolve (but it still requires removing infotainment, so at that point just unplug it there.?!). [0] It was my understanding that, like GPS-receivers, Sirius/XM was one-way streaming, only..?
  - willis936 10mo ago
    There are GPS antennas that land on that DCM and the data from that is forwarded over carplay/android auto. Phones fall back to their onboard GPS but it's a much worse experience than we're accustomed to. If you share the car with someone expect complaints. Pulling the cell antenna(s) is the most elegant solution. People shouldn't be afraid of a little work.
    - ProllyInfamous 10mo ago
      I don't use cell phones but still this'll get me in the dashboard sooner than I had intended (never, before). Hadn't really thought about the car broadcasting its bluetooth/RF . Is the SiriusXM traceable?
  - kwoff 10mo ago
    https://www.toyota.com/privacyvts/#:~:text=Declining,analysis https://www.toyota.com/privacyvts/#:~:text=Declining,analysi... so you apparently have to opt-out of consenting to them tracking you...
tguvot 10mo ago
There is spying and there is spying Back in august IDF banned Chinese cars from entering bases https://www.jns.org/report-idf-bans-chinese-cars-from-bases-to-prevent-data-leaks/ https://www.jns.org/report-idf-bans-chinese-cars-from-bases-... And now banned then from used by officers https://securityboulevard.com/2025/11/why-israel-just-banned-700-chinese-cars-from-its-military-and-what-it-means-for-security/ https://securityboulevard.com/2025/11/why-israel-just-banned... I wonder what IDF knows
- chneu 10mo ago
  [flagged]
- gogusrl 10mo ago
  Tesla cars to be banned from Chinese government buildings amid security fears. I wonder what China knows :) https://www.drive.com.au/news/tesla-vehicles-to-face-entry-bans-in-chinese-government-buildings-as-security-concerns-increase-report/ https://www.drive.com.au/news/tesla-vehicles-to-face-entry-b...
  - dzhiurgis 10mo ago
    At consumer level - Tesla has been leader here for many years.
vel0city 10mo ago
I went to Carvana to get some idea on what my car might be worth. I gave them the license plate, and it gave me a questionnaire about specific trim and options along with asking about the current mileage. I couldn't remember the exact figure so I guessed rounded to the thousand. The app complained and wouldn't take it as they knew the mileage which was some 150ish miles more. Apparently my car has reported the mileage last time I drive it, which has been about an hour before. Carvana knew exactly how many miles I had driven within an hour of me driving my car.
- humanrebar 10mo ago
  So why did they have you fill in that field then?
  - bitwize 10mo ago
    For the same reason the IRS makes you fill out how much you made last year. They know—they know to the penny. But making you fill it out is a humiliation exercise so they can "catch you out" and intimidate you. Well in the case of the IRS, that, and you know, Intuit.
bmitch3020 10mo ago
I'd like to see a website that ranks vehicles by make and model. That would influence shopping behaviors, and consumers would influence manufacturer behaviors.
calvinmorrison 10mo ago
nothing. And banning ALPR wont fix anything either. All cars have 4 unique serial numbers broadcast via radio at all times via the TPMS system. you don't even need a camera, just a radio receiver.
- 1shooner 10mo ago
  > banning ALPR wont fix anything either. Ideally the implementation would be immaterial to a ban. The ban (or more likely first, warrant requirement similar to cell data) would be on the tracking database, not the details of how the tracking was accomplished.
- ErroneousBosh 10mo ago
  > All cars have 4 unique serial numbers broadcast via radio at all times via the TPMS system. Mine doesn't.
  - calvinmorrison 10mo ago
    do you have some sort of indirect tire pressure checking like wheel speed?
    - ErroneousBosh 10mo ago
      No, I have a tyre pressure gauge. Every so often I check the tyre pressures and maybe stick a bit more in if it needs it. Some VWs used to use wheel speed, though, which was fun because they added tyre pressure checking with a software upgrade. Not terribly accurate, but enough to tell you if one was low.
- jeroenhd 10mo ago
  TPMS doesn't need to be unencrypted like that, although many car manufacturers do like to save a buck. If you get a car old enough, you won't need to worry about TPMS (but that car will not have been tested against recent crash test scenarios).
  - 10mo ago
jmward01 10mo ago
I won't mince words. This is criminal and should be dealt with that way. It is obvious I don't want my information collected and sold. I make it clear every reasonable chance I get. This goes beyond abuse of my privacy, this is digital assault and the company officers that allowed these 'features' should be thrown in jail for it.
metalman 10mo ago
so ya! My house is fairly close((125') to a rural "highway", and only internet here is mobile data that my phone shares with other devices and mornings(anytime) my older desktop with 2.5 ghz wifi gets bumped off with the passing of every car that has glaring supper white headlights,but, not the ones running yellow incandecents, whatever rf signal is comming of these things must be barely, or completly illegal, and could obviously be tracked in any number of ways, so not so much bieng spied on, as just flat out trasmitting everything you do in ridiculously fine grained detail.
daft_pink 10mo ago
The problem is that with Flock, you’re basically being tracked incessantly anyways, so who cares if the automaker also does it?
- malwrar 10mo ago
  We need to resist this stuff or else there will be Flock, stalker cars, and some other new nightmare they excuse by saying “well we’re already watching…”. Can’t let ourselves accept this is normal!
  - daft_pink 10mo ago
    How do you resist automated license plate readers? Not having license plates doesn't seem practical.
- sys_64738 10mo ago
  That's the slippery slope of shrugging your shoulders.
- wiredpancake 10mo ago
  [dead]
deleted 10mo ago
[deleted]
constantcrying 10mo ago
How do you write an article about this and not mention the GDPR or EU privacy laws? >"It’s hard to figure out exactly how much data a modern car is collecting on you" You are a globally operating news agency. You can absolutely get some GDPR requests in and look at it. What kind of reporting is this? "We don"t know, but we also have not tried the one way which forces companies to answer this question". BMW is a German company, just ask them for the information they have on you and they are forced to give it to you.
- jeroenhd 10mo ago
  Mozilla's concentrated efforts took a while, they're right that it's hard to figure out exactly what car manufacturers are doing. Unless you're willing to sue a bunch of them, plain GDPR requests won't be enough to get this information. Companies will happily lie or declare information collected as "non-personal" or "trade secrets" and if they're smart enough about the way they process their data they can probably convince a judge that the end result isn't personal enough that exposing their trade secrets weighs up against the GDPR. There's no way even a large news corporation is going to buy every model car from every brand that comes out in a year to get the legal rights to demand data, let alone pursue these data requests in court. Renting cars may be easier, but then your contract is with the rental company and they're responsible for getting you the information you require, and after the first three PII requests you're not going to be renting from them any time soon. I'm not saying they couldn't do a deeper dive with more detailed research, but it's not an easy task to evaluate an industry like this. All they'll be able to produce is general statements about a limited set of car models that'll quickly be outdated once the next software update comes out.
hbarka 10mo ago
I have an electric car and if I want to remotely turn on charging, it won’t allow me unless the full data sharing option is enabled. Full data as in your driving data like a black box logger. I then have to go in the car, enable it, then I can remotely turn on charging. I have to remember to opt-out again later. Ironic I know because I can turn on charging from within the cabin without having to enable any of the data collection. What an inconvenient experience.
- mixmastamyk 10mo ago
  What does "remotely turn on charging" mean? Doesn't charge when you plug in?
  - hbarka 10mo ago
    There are a few options. You can plug it in your garage and charging can automatically begin due to a set schedule, like after midnight, or you can initiate it on demand using the cabin controls or using your iPhone as a remote.
- thrtythreeforty 10mo ago
  Which car is this?
  - hbarka 10mo ago
    Ford
- mk_stjames 10mo ago
  So you're telling me that simply walking out to the car and hitting a button inside the car is just too much of an "inconvenient experience"? You know we used to have to drive the car... sometimes many miles... to a station, get out, and fill it up with a liquid fuel that costs many times more, and then drive home... Seriously now- The perceived 'inconvenience' you have is the reason that so many of these connected features are being pushed and then the because the ability is there the business types can't resist the data gathering that became possible because of all the antennas, etc.
jwr 10mo ago
Amazingly but perhaps not surprisingly, cars in the EU do similar amounts of spying on you, but the EU is silent. Car manufacturers pretty much run the EU.
- TacticalCoder 10mo ago
  [dead]
- Am4TIfIsER0ppos 10mo ago
  Because the government wants the tracking. They want your car broadcasting its position.
- deleted 10mo ago
  [deleted]
J_Shelby_J 10mo ago
I wonder what the extremely rich do to get a car that isn’t a security risk? I’ve heard you can throw money at high end car dealerships to disable spying, but I wonder what the internal process is.
- everdrive 10mo ago
  I haven't heard this. Do you have any examples?
- mixmastamyk 10mo ago
  This will probably be a thing, but it's not clear that folks are cognizant of the risks yet.
- drnick1 10mo ago
  It's easier than that, you can remove the cellular modem. Dealers won't generally accept to make this mod, but any independent shop should be able to. There are also plenty of videos on YT to DIY.
  - MrDrMcCoy 10mo ago
    I some months back called every independent EV mechanic I could find a listing for in my state to see if they would help me disable the cellular modem of any of the models I was interested in buying, and they mostly told me either that they couldn't or wouldn't. One of the more polite shops I got in touch with explained that many models don't have a separate board that can be disabled anymore, or otherwise have more things on the board that need to be talking on the CAN bus for other, actually important parts of the car to function. As such, I still have my old car. Since then, I've learned about the 50ohm dummy antennas you can buy. I might try that if my car dies before an AWD/4WD Slate truck becomes an option, and also if my living situation can accommodate charging.
    - drnick1 10mo ago
      As far as I know, all modern Toyotas have discrete DCMs (data communication modules) that can be physically unplugged with limited side effects. The side effects are loss a speaker and hands-free microphone, but they be restored by means of a bypass harness. Simply unplugging the antennas does not seem to be enough in areas with good cellular coverage. I have seen the dummy load approach discussed on car forums but have no experience with it.
nimbius 10mo ago
as a professional diesel mechanic for a small chain of midwest shops, this "telematics" feature is on long-haul trucks as well as tractors (john deer is notorious for using it to send mail marketing about services.) generally its not hard to disable. - identify the telematics module in your car - pull the fuse (not always an option, sometimes this disables bluetooth) - alternatively: identify the 1-2 SMC connectors on the telematics device. this is the LTE and low/alt channel for the cellular communications. disconnect these 1-2 connectors and connect the ports instead to a 50 ohm terminator. the vehicle will simply continue to collect data but never be able to send it anywhere. the system will assume it just cant find a tower.
- m463 10mo ago
  I tried this with a wifi setup on a car charger. I connected a 50-ohm dummy load in place of the antenna using the mmcx connector. It didn't work - there was an on-module antenna that it switched to. Might not have worked as well, but it did work and the wifi access point still showed up. On the other hand, some cars have a self-contained telematics module like you said and you can just unpower the whole thing. I remember looking at a ford owners manual for a 2019. The fusebox section had a fuse with description "Telematics control unit - modem." I assume you can just pull that fuse.
- vitaflo 10mo ago
  Connecting to a dummy load is a pretty good idea I hadn't thought of (usually I just disconnect the cellular module).
- quasse 10mo ago
  The Toyota community has been far down that road with the DCM module in the new gen cars and found that the car still managed to get updates out to Toyota even with 50 ohm terminating resistors in the antenna connectors: https://www.tacomaworld.com/threads/simpler-solution-for-disabling-the-dcm-telematics-silencing-antennas.821649/ https://www.tacomaworld.com/threads/simpler-solution-for-dis... (see the posts by user "Disgruntled Scientist"). Unfortunately simply cutting power to the telematics module also disables the in-car microphone for handfree calling. Fully disabling telematics involves making a bypass harness that re-routes the microphone and speaker signals past the disabled DCM module.
pfp 10mo ago
I thought about getting a traditional navigator to avoid even relying on phone navigation. Well, of course all the Garmins and Tomtoms available now have "built-in wifi for updates" and often BT for phone notifications too. Sure, I could just not configure either but what if I want a navigator _without any radios_ and with controlled updates via SD card. Maybe a dedicated Android phone in the car with offline OpenStreetMaps installed and airplane mode on is more realistic. Or some old 2nd hand navi that's still updateable.
- drnick1 10mo ago
  You could use a GrapheneOS phone without SIM and OSMand for that.
- CommenterPerson 10mo ago
  I use an older Garmin, purchased from ebay. Works fine, updated maps via a laptop recently. Needed an extra SD cards for space.
rconti 10mo ago
I think it's wild that people spend their own money to surveil themselves every second they're near their car. Maybe I've seen too much lawyering on TV and in movies, but if I'm in a collision with you, I'm definitely asking the cops to pull the SD card from your dashcam. Whenever I point out I think this self-surveillance is crazy, the response ends up sounding something like "oh, no big, if I think I did something wrong I'll just hide the evidence and lie to the police and say it doesn't work", which sure doesn't sit right with me.
- caconym_ 10mo ago
  Why do you think potentially self-incriminating self-surveillance is "crazy" when you also think lying to the cops and other involved parties about what happened is bad? If you believe it's important to tell the truth in these situations, you should have no problem providing your own recordings of a collision, regardless of who is at fault. Or is your point just about the cost of the dashcam being "crazy"? In that case, hypothetically, what if your insurance company cut you a check to buy a dashcam of your own choice and install it on your car?
  - stavros 10mo ago
    I think they're saying "I don't want to self-incriminate so I don't want to put myself in a situation where I have to lie". I'm not sure it's entirely consistent, but I also don't think it's entirely inconsistent.
    - caconym_ 10mo ago
      If you believe you are at fault in a collision where police, insurance, etc. are involved, they are going to ask for your statement, and at that point you will be forced to choose between lying or admitting fault. If you're glad that no dashcam footage exists, presumably you are going to lie about what happened! I don't see why this is any different than popping the SD card out of your dashcam and lying about that too—you're still lying, and for the same reason: to evade responsibility for a collision you caused.
smeej 10mo ago
I found the vehicleprivacyreport.com site awfully misleading. The "Vehicle Privacy Label" only lists what the manufacturer's current policies are, not what applies to my vehicle. It makes it seem like Toyota is somehow remotely collecting and sharings tons of information about my...2007 Prius. But this car came out in 2006, well before people assumed easy internet connectivity everywhere. Shy of having physical access to my vehicle, they can't read anything, but it's not easy to find that explanation on the site.
kdazzle 10mo ago
I worked on the data platform at a smaller car co, and there were tight controls around getting access to precise geo data, and there were strong privacy advocates at higher levels. Wasn’t a perfect system, but “spying” would be far from what I saw
meisel 10mo ago
It wouldn’t be surprising if cars also record audio of conversations to use for ad targeting. It has already been conclusively shown that TV companies have done this.
- MrDrMcCoy 10mo ago
  IIRC, Nissan even has a clause in their privacy policy for selling information about passengers having sex. Pretty hard to collect that without audio data.
- tavavex 10mo ago
  > It has already been conclusively shown that TV companies have done this. Can you elaborate? I don't think I've ever heard of this. When did it happen?
elzbardico 10mo ago
Cars, your TV, your phone, everything is fucking spying on you. At this moment I am more interested in how I generate a tsunami of more data about me to the powers that be to drown them in a deluge of irrelevant bits.
- drnick1 10mo ago
  Yes, and that's very sad. However the solutions are pretty obvious: Car -> unplug the cellular modem (more or less easy) TV -> used as dumb monitor with a Linux HTPC Phone -> GrapheneOS PC -> Linux Social media -> /dev/null Email/DNS/cloud -> my own The real issue is that most people are not aware of these issues and may even (unintentionally) compromise your own privacy by posting information or pictures of you to Facebook or other similar places.
  - rglynn 10mo ago
    > Social media -> /dev/null That made me chuckle, absolutely right though!
    - stavros 10mo ago
      I love how these comments are made on a social media website.
      - drnick1 10mo ago
        HN is not a social media platform in the traditional sense. For one, it is completely anonymous, unless your "handle" is somehow linked to a real identity (by choice or otherwise). It's very, very different from posting every aspect of your life on a platform like Facebook.
        gnabgib 10mo ago
        Anonymousness does not make a platform unsocial (Twitter, 4chan, 8chan, reddit, HN, IRC, PlentyOfFish, X, Instagram, TikTok, Snapchat, Tinder, StumbleUpon, FourSquare, BeReal, WhatsApp, democratic voting, any forum, YouTube, Wikipedia, any BBS)
ericmay 10mo ago
Nothing you can realistically do about it. In America car ownership for most people is mandatory. It’s unfortunate we don’t have alternatives if you disagree with car manufacturers extra “features”.
- drnick1 10mo ago
  The alternative is to be aware of this abuse and unplug the cellular modem. It requires more or less effort depending on the car, but it can and should be done.
  - ericmay 10mo ago
    It’s not a good alternative though because it puts you into a losing competition with the manufacturers. Take out the cellular modem? Next one requires connectivity to drive the car and so forth. You could “ban” it, but the amount of effort required to raise public awareness for that and actually have our dickhead representatives due things like that is basically the same amount of effort, perhaps more, as building better cities and transportation modes. We build and subsidize highways, we could do the same with other methods of transportation and have competition instead of big gubmint cars.
    - drnick1 10mo ago
      In many parts of the US, individual vehicles are the only viable mode of transportation. In fact, even in the NYC metro area, a car is pretty much indispensable, unless maybe you live in Manhattan and only rely on home delivery for groceries and the like. If you ever want to do anything outside of the city, you need a car.
      - ericmay 10mo ago
        Right which leaves us without alternatives and beholden to car manufacturers and their collective decisions.
    - vitaflo 10mo ago
m463 10mo ago
> The first thing drivers should do is be aware of what data their car is collecting > You can opt out lol this makes it seem so simple. I think - you will never be aware of what data is collected - they want to collect more data and never disclose it - you will never be able to opt-out. Even if you disconnect from cellular, at service time they will just download what is there. - car manufacturers will use any and all data to their benefit You know, here's an interesting story I remember reading: I will give you a story - buddy owns a shop - buys new M5 - he went out joyriding - warped a rotor - he said it was not from him so he tried a warranty service - BMW printed a page that his car recorded. It had snapped a pic of his face and sent all the data on speed, location, etc every bit of data you can think of to the dealer and his insurance company. He sold the car. That was years ago. Ask any custom tuner today if they can touch a 22 BMW. Nope. It will disable the car if you try and get into the CPU to tune it. This is where the industry is heading from: https://www.fordtremor.com/threads/disabling-the-modem-pulling-the-fuse.7101/ https://www.fordtremor.com/threads/disabling-the-modem-pulli...
- The_President 10mo ago
  Similar story with a user's earlier Model S - they used to drive it like they were being chased by the cops, and so when it was time to swap the degraded battery under warranty, (as they said) "a nerd" came out of the back of the service center "with a bunch of paperwork from the database" and Tesla denied the claim.
- Tylast 10mo ago
  I don't disagree with you on BMW's data collection capabilities. However, I've read about 2023s being tuned. It's also widely reported that BMW encrypted many of the computers starting in 2024. This past September, BMW disabled 3rd party access (think Home Assistant) to vehicle data. There are only 2 paid 3rd party companies allowed. 2+ years of me using HA (with some awesome automations) was terminated. I was willing to let them use my data as long as I could too, but now I don't even have access to my own data!
blackjack_ 10mo ago
I ripped the wifi / onstar and gps antennas out of my 2020 Chevy Bolt the day after I bought it. Took me a couple of hours since the access was awful, but that's one time pain. No issues since, and I have a phone I use to drive the head unit so there was no need for those antennas to even exist.
- m463 10mo ago
  I tried this once. I got a tesla home charger and it had a unnecessary wifi AP that kept showing up in my house. So I figured, I would stop this. Opened it up, and disconnected the wifi antenna mmcx connector. Nope, seemed when unplugged, it would switch to an onboard antenna for the wifi module. so I reconnected a dummy load antenna to the wifi module. and it still used the onboard antenna. at that point, I gave up. I think there might have been a possibility of downgrading the firmware to an older version that could disable wifi, but I didn't try to find it. I believe this kind of thing happens with onboard cellular, wifi and bt. They are more resilient to degraded or disconnected antennas than you think.
mistercheph 10mo ago
don't buy a modern car
ris 10mo ago
The only company that appear to be taking a different tack on this are https://www.slate.auto https://www.slate.auto Anyone know of any others?
- MrDrMcCoy 10mo ago
  Nope, which is why I plan to get them as soon as AWD/4WD becomes an option.
tlubinski 10mo ago
The CCC had a nice talk last year about the data VW collects and what can be learned from it (all the data was unencrypted accessible): https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo... (unfortunately it's in German - but there is an english live translation available)
AlexCoventry 10mo ago
Interestingly I can't get ChatGPT to help me find a video showing me how to disable the cellular modem on my Subaru 2024 Crosstrek. Time to do some old-fashioned research, I guess... https://chatgpt.com/share/692cde57-0930-800e-b45f-7a41ca5c8eb7 https://chatgpt.com/share/692cde57-0930-800e-b45f-7a41ca5c8e...
- jacquesm 10mo ago
  Who cares about what ChatGPT can't do? It can't make me a sandwich either.
  - AlexCoventry 10mo ago
    I've found it extremely useful for this kind of research in general.
123sereusername 10mo ago
[dead]
effnorwood 10mo ago
Remove the modem
- MrDrMcCoy 10mo ago
  Not always possible, depending on model, skill level, and/or availability of a mechanic that's willing to try. My own search for a mechanic to mod any of the cars I was looking at buying was fruitless and left me with the decision to hold onto my gas guzzler for a while longer.
jacquesm 10mo ago
You can simply not drive a modern car.
gylt 10mo ago
[dead]
Lapsa 10mo ago
modern tech enables an actual mind reading - while you bicker around about vehicle telematics and bluetooth beacon signals
1vuio0pswjnm7 10mo ago
It's rather surprising/disappointing that "advice" like this makes no mention of how the automobile gains internet access Does it (a) have it's own SIM card, (b) piggyback on driver/passenger/other vehicle SIM cards, (c) opportunistically connect to free wifi APs, etc. Perhaps the surveillance data is only transmitted to the mothership when the automobile is being "serviced" The automobile OS may be like the other corporate OS, e.g., iOS, iPadOS, Android, etc., in that there is no possible configuration or combination of user settings that does not allow data collection and surveillance for unlimited commercial purposes

326 points by MilnerRoute 10mo ago

No doubt about this one. But, how much are the ubiquitous ride-for-hire e-scooters spying on you, and everyone else on the street?

AtlasBarfed 10mo ago
It's where we are. Everything everywhere is collecting data and spying. If it exists in a database, then the government has access to that database if it ever wants to legally or otherwise. It's been like that since 9:11 and probably before. All we need now is for the right person to walk in and turn the key. We're lucky that Donald Trump is probably too stupid to understand what he's got under his thumb.
- josefritzishere 10mo ago
  Comment of the year.
- add-sub-mul-div 10mo ago
  He's a useful president surrounded by smarter people who will figure out ways to use this data rather than sit around tweeting all day.
cmdoptesc 10mo ago
Those e-scooters are a red herring. Ring cameras on everyone's front door and automated license plate readers (ALPR) on police vehicles and Flock cameras throughout cities are bigger concerns in America. Flock is already known to assist the government surveilling protestors: - [CBP is monitoring US drivers and detaining those with suspicious travel patterns](https://news.ycombinator.com/item?id=45996860 https://news.ycombinator.com/item?id=45996860) - [How Cops Are Using Flock Safety's ALPR Network to Surveil Protesters and Activists](https://www.eff.org/deeplinks/2025/11/how-cops-are-using-flock-safetys-alpr-network-surveil-protesters-and-activists https://www.eff.org/deeplinks/2025/11/how-cops-are-using-flo...) - [Amazon has a form so police can get my (Ring) data without permission or a warrant](https://www.theverge.com/2022/7/14/23219419/amazon-ring-law-enforcement-no-warrant-no-consent https://www.theverge.com/2022/7/14/23219419/amazon-ring-law-...)
- chneu 10mo ago
  The even worse part of Flock isn't that they cooperate with the government, it's that there is(or was) basically no security in the service. Cops from one state can/could use flock services from other states. A few cops got caught stalking via Flock. Flock takes the "do nothing until forced to" mentality.
balamatom 10mo ago
Enough to make sure the kids won't undercut the cartel this time around.

jmclnx 10mo ago

IIRC, Massachusetts passed a right-to-repair law a few years ago. Based upon the text of the law, all new cars purchased there have the spying disabled because they did not want to give up their proprietary info. There have been a lot of court cases about that law by the manufacturers, so I do not know the status at this point. So I wonder if that is still the case. If it is and an out of state person buys new there, will that "spying" remain disabled when they bring the car home ?

anonymars 10mo ago
Theoretically, that should be a catch-22, right? How would they know you're no longer in Massachusetts, without the spying enabled while within Massachusetts?
- sejje 10mo ago
  Because "spying" in this case means "sending data to the mothership." It doesn't mean "the car's gps is disabled"
  - anonymars 10mo ago
    Perhaps. But what if a person living in Massachusetts travels to another state? I found this when looking into it more: https://arstechnica.com/cars/2023/06/feds-tell-automakers-not-to-comply-with-mass-right-to-repair-law/ https://arstechnica.com/cars/2023/06/feds-tell-automakers-no... "Now, according to Reuters, NHTSA has written to automakers to advise them not to comply with the Massachusetts law. Among its problems are the fact that someone “could utilize such open access to remotely command vehicles to operate dangerously, including attacking multiple vehicles concurrently,” and that “open access to vehicle manufacturers’ telematics offerings with the ability to remotely send commands allows for manipulation of systems on a vehicle, including safety-critical functions such as steering, acceleration, or braking.” Faced with this dilemma, it’s quite possible the automakers will respond by simply disabling telematics and connected services for customers in the state. Subaru already took that step when it introduced its model year 2022 vehicles, and NHTSA says other OEMs may do the same."

more_corn 10mo ago

Is there anything we can do about it short of avoiding new cars? Our legislators have proven unwilling to pass real privacy laws.

throwaway2027 10mo ago
No. Enjoy the ride.
- qmr 10mo ago
  Defeatist and cowardly.
  - randallsquared 10mo ago
    Given that GP is accepting a level of additional risk which you profess not to be willing to accept, perhaps "cowardly" is not the correct adjective.
DonHopkins 10mo ago
Ride a bike.
- pixelpoet 10mo ago
  I've never had a driver's licence, lived in a zillion countries; don't think I could do that in America though.
  - Retric 10mo ago
    Over half of New York City households are car-free. That jumps to 3/4 in Manhattan. Millions of American households don’t have a car, but you rarely hear about it as a viable option.
    - JoeBOFH 10mo ago
      Because as soon as you leave a major metropolitan area, not having a car is almost a nonstarter.

chasing0entropy 10mo ago

Remove the antennas. Do not give in to the mirage of convenience. Use a stand alone generic GPS. Vehicle GPS devices are anti privacy for so many reasons. Listen to stored music from an SD card if terrestrial radio (NO SATELLITE). Did you know almost ALL late model cars can play a <128gb FAT32 USB drive with non- vbr mp3s? 64gb filled with 168kb mp3 audio would take roughly 3 years at 4 hours a day to listen to. TURN YOUR PHONE OFF. Your phone does more than track you - the Bluetooth and wifi beacon scanners are always running. When you come across another person, most phones track the intersection of your beacon with theirs making a new data point that compromises both individuals privacy. Now consider sitting at a stoplight; you and and the 10 phones around you have now correlated the time and position you were sitting there. The person jogging by with no phone(but a set of Bluetooth headphones) is also tracked by their Bluetooth signature. Terrifying. Disable autonomous driving hardware by unplugging the cables from the interior cameras. If your car needs to see and feel you in order to do it's job, it's co-dependent; break up with it. Ignore your car's complaints and error messages. Did you know Orange dash error lights are non critical?

galleywest200 10mo ago
> Ignore your car's complaints and error messages. Did you know Orange dash error lights are non critical? "Tire pressure low" is one you should probably check out on a regular basis.
- chneu 10mo ago
  Yeah that's terrible advice. Learning to ignore safety warnings is an amazing way to wind up stranded or with a destroyed car because you decided to ignore a warning light
  - potato3732842 10mo ago
    The first 100yr of automobiles didn't have TPMS and it was mostly fine.
    - 10mo ago

mistrial9 10mo ago

A 2013 Chevy Volt has a camera on the dashboard pointed at the driver. The entertainment dashboard has a dozen communication options, including those for safety? Zealots and the unhinged will quickly comment no doubt, but for the rational citizens I ask, when was this normalized? Was it automakers emboldened by the acceptance of cell phone central record keeping?

balamatom 10mo ago
> Zealots and the unhinged will quickly comment no doubt, but for the rational citizens I ask, when was this normalized? [laughs in unhinged zealot]
potato3732842 10mo ago
"Safety" is a magic word like "god" was a thousand years ago. If you say it just right you can manufacture an excuse to do all sorts of stuff that'll clearly lead to bad stuff if left to run. They undoubtably said things like "if it saves even one person from falling asleep at the wheel it's worth it" or something along those lines.
- luqtas 10mo ago
  this is still a technology advancement... what if smartphone usage or asleep safely stops the car? what if this run locally? or what if it's linked to public entities that will add penalty points to your license? as a cyclist and public transport user with no driver license, i hope personal vehicles have so much sensors that they can detect if you are drunk or stressed and limit your reaches. fuck your metallic beetle
  - potato3732842 10mo ago
    >as a cyclist and public transport user with no driver license, i hope personal vehicles have so much sensors that they can detect if you are drunk or stressed and limit your reaches. fuck your metallic beetle What a great illustration of the sort of selfish opinions that people like to peddle under the guise of perceived common good. Are you willing to have your bike brakes linked up with GPS and red light signals? It's in the name of safety and progress after all.

emidln 10mo ago

My 2025 Mazda Miata has a CAN connected Telematics Control Unit that sends a bunch of data to Mazda on ignition off. Among this data is acceleration and velocity data along with coordinates sampled for where you were. It is also used as a gateway for the Mazda app to start your car, query your vehicle's tire pressure, etc. It is claimed that you can opt out of this by calling Mazda and being persistent. The CAN traffic is unencrypted. It was pretty easy to MITM this module with a cheap arm Linux board and a can transceiver to enable writing a two way filter capable of blocking the traffic that didn't raise any DTCs (that I observed) and could be turned on/off by the user. I preferred this approach to complete disconnection of the module (which is noticeable via errors at the diagnostic port) or trying to faraday cage or disable the antennae on the TCU so it can't remotely send/receive. I can also turn off my module or completely remove it before I sell it. I fear the next version of Miata will be an encrypted CAN like most other cars have moved to and even with my expertise I won't be able to access the latest safety features from new cars without surrendering what little privacy I've been able to claw back.

CamperBob2 10mo ago
I fear the next version of Miata will be an encrypted CAN like most other cars have moved to As I understand it, they're required to do that now if they want to sell in the EU. They emphatically do not want anyone tinkering with their cars.
- bri3d 10mo ago
  They don’t want people modifying ADAS systems mostly, and the main requirement is SecOC, which is cryptographic authentication but the message is still plaintext. Basically they don’t want third party modifications able to randomly send the “steer left” message to the steering rack, for example.
  - CamperBob2 10mo ago
    Yes, and to do that, CAN must be encrypted. The idea isn't just to secure it from hackers. The idea is to secure it from owners.

jimnotgym 10mo ago

Here is something else you can do about it. By an older low mileage car. If we all did that the manufacturers would change tack soon enough

closewith 10mo ago
I did do this, but I also want a reasonable modern and safe car and in the EU, since 2018, that means a car with eCall. I have a 2017 that I will keep going as long as is economical, but after that, it will be nearly impossible to avoid these systems.
- ryandrake 10mo ago
  The idea that a 20 year old car is unsafe is auto industry FUD. Yes, there have been great safety advances since the 1970s and 1980s. They've kind of tapered off though. I would absolutely trust my family's lives in any year 2000+ vehicle.
  - jeroenhd 10mo ago
    Airbag and crumple zone safety requirements for crashes that aren't head-on are much more recent than the 2000s. Many car makers designed their cars to pass those, but will leave you dead or worse if you get T-boned. ABS wasn't even a requirement in the EU until 2004, and American cars could be sold without ABS all the way until 2012, when traction control was also made mandatory (which the EU then also followed). Things like the slightly-angled side pole crash test was only added to the Euro NCAP in 2015 and was updated five years later to make it a bit more realistic, though cars still woefully fail in many real-life scenarios. I wouldn't really consider a car "safe" unless it passes the ~2015 requirements for car safety well. A well-designed car full of optional safety features from the ~2010s is probably also safe, but I wouldn't count on it unless you've done research into it. I believe Volvo has had a reputation of being ahead of the curve with these kinds of crash safety tests, but even they had to improve over time.
    - jimnotgym 10mo ago

Sharlin 10mo ago

Not driving seems to have worked pretty well thus far.

SilverElfin 10mo ago

The problem is a lot of the features of these cars require you to opt into giving your privacy away. And when you’re shopping it’s not clear where that line is.

thepasswordapp 10mo ago

The car data collection story is concerning, but it's part of a broader pattern: credentials and personal data are scattered across dozens of services we interact with daily. The automotive example shows how even "non-tech" products now collect and transmit data. Each service creates another attack surface, another set of credentials to manage, another potential breach vector. What's frustrating is that breach response still falls on individuals. When one of these services gets compromised, it's users who have to scramble to change passwords across potentially hundreds of connected accounts. The "change your password" advice is good but wildly impractical at scale.

jimnotgym 10mo ago

Is all of this data collection from the driving aids actually us doing R&D for their autonomous car projects?

toofy 10mo ago
people participating as beta testers with no way to opt out is absolutely the norm now. from video games to software to “self-driving” cars, we’re all unpaid beta testers for unfinished and often unsafe products.

exhilaration 10mo ago

Disabling the hardware can be really hard, my 2025 Toyota Sienna is always connected. You can't just pull a fuse or rip out an antenna, I have to take the entire dashboard apart to reach the Data Communication Module (DCM) module. If anyone's curious what that looks like, it's a little bit easier on the Toyota Tacoma, here are some pictures of the process: https://www.tacoma4g.com/forum/threads/disabling-dcm-telematics-in-2025-taco.10431/ https://www.tacoma4g.com/forum/threads/disabling-dcm-telemat... It's complex enough that I haven't done it yet in my Sienna, but I plan to!

ProllyInfamous 10mo ago
On a 2021 Camry there is an below-dash fuse labeled "DCM" which you can remove (and it does disable OnStar/telemetry, but not sat.radio[0]) — it also disables one of the speakers (used for phone calls), which there is a bypass to resolve (but it still requires removing infotainment, so at that point just unplug it there.?!). [0] It was my understanding that, like GPS-receivers, Sirius/XM was one-way streaming, only..?
- willis936 10mo ago
  There are GPS antennas that land on that DCM and the data from that is forwarded over carplay/android auto. Phones fall back to their onboard GPS but it's a much worse experience than we're accustomed to. If you share the car with someone expect complaints. Pulling the cell antenna(s) is the most elegant solution. People shouldn't be afraid of a little work.
  - ProllyInfamous 10mo ago
    I don't use cell phones but still this'll get me in the dashboard sooner than I had intended (never, before). Hadn't really thought about the car broadcasting its bluetooth/RF . Is the SiriusXM traceable?
- kwoff 10mo ago
  https://www.toyota.com/privacyvts/#:~:text=Declining,analysis https://www.toyota.com/privacyvts/#:~:text=Declining,analysi... so you apparently have to opt-out of consenting to them tracking you...

tguvot 10mo ago

There is spying and there is spying Back in august IDF banned Chinese cars from entering bases https://www.jns.org/report-idf-bans-chinese-cars-from-bases-to-prevent-data-leaks/ https://www.jns.org/report-idf-bans-chinese-cars-from-bases-... And now banned then from used by officers https://securityboulevard.com/2025/11/why-israel-just-banned-700-chinese-cars-from-its-military-and-what-it-means-for-security/ https://securityboulevard.com/2025/11/why-israel-just-banned... I wonder what IDF knows

chneu 10mo ago
[flagged]
gogusrl 10mo ago
Tesla cars to be banned from Chinese government buildings amid security fears. I wonder what China knows :) https://www.drive.com.au/news/tesla-vehicles-to-face-entry-bans-in-chinese-government-buildings-as-security-concerns-increase-report/ https://www.drive.com.au/news/tesla-vehicles-to-face-entry-b...
- dzhiurgis 10mo ago
  At consumer level - Tesla has been leader here for many years.

vel0city 10mo ago

I went to Carvana to get some idea on what my car might be worth. I gave them the license plate, and it gave me a questionnaire about specific trim and options along with asking about the current mileage. I couldn't remember the exact figure so I guessed rounded to the thousand. The app complained and wouldn't take it as they knew the mileage which was some 150ish miles more. Apparently my car has reported the mileage last time I drive it, which has been about an hour before. Carvana knew exactly how many miles I had driven within an hour of me driving my car.

humanrebar 10mo ago
So why did they have you fill in that field then?
- bitwize 10mo ago
  For the same reason the IRS makes you fill out how much you made last year. They know—they know to the penny. But making you fill it out is a humiliation exercise so they can "catch you out" and intimidate you. Well in the case of the IRS, that, and you know, Intuit.

bmitch3020 10mo ago

I'd like to see a website that ranks vehicles by make and model. That would influence shopping behaviors, and consumers would influence manufacturer behaviors.

calvinmorrison 10mo ago

nothing. And banning ALPR wont fix anything either. All cars have 4 unique serial numbers broadcast via radio at all times via the TPMS system. you don't even need a camera, just a radio receiver.

1shooner 10mo ago
> banning ALPR wont fix anything either. Ideally the implementation would be immaterial to a ban. The ban (or more likely first, warrant requirement similar to cell data) would be on the tracking database, not the details of how the tracking was accomplished.
ErroneousBosh 10mo ago
> All cars have 4 unique serial numbers broadcast via radio at all times via the TPMS system. Mine doesn't.
- calvinmorrison 10mo ago
  do you have some sort of indirect tire pressure checking like wheel speed?
  - ErroneousBosh 10mo ago
    No, I have a tyre pressure gauge. Every so often I check the tyre pressures and maybe stick a bit more in if it needs it. Some VWs used to use wheel speed, though, which was fun because they added tyre pressure checking with a software upgrade. Not terribly accurate, but enough to tell you if one was low.
jeroenhd 10mo ago
TPMS doesn't need to be unencrypted like that, although many car manufacturers do like to save a buck. If you get a car old enough, you won't need to worry about TPMS (but that car will not have been tested against recent crash test scenarios).
- 10mo ago

jmward01 10mo ago

I won't mince words. This is criminal and should be dealt with that way. It is obvious I don't want my information collected and sold. I make it clear every reasonable chance I get. This goes beyond abuse of my privacy, this is digital assault and the company officers that allowed these 'features' should be thrown in jail for it.

metalman 10mo ago

so ya! My house is fairly close((125') to a rural "highway", and only internet here is mobile data that my phone shares with other devices and mornings(anytime) my older desktop with 2.5 ghz wifi gets bumped off with the passing of every car that has glaring supper white headlights,but, not the ones running yellow incandecents, whatever rf signal is comming of these things must be barely, or completly illegal, and could obviously be tracked in any number of ways, so not so much bieng spied on, as just flat out trasmitting everything you do in ridiculously fine grained detail.

daft_pink 10mo ago

The problem is that with Flock, you’re basically being tracked incessantly anyways, so who cares if the automaker also does it?

malwrar 10mo ago
We need to resist this stuff or else there will be Flock, stalker cars, and some other new nightmare they excuse by saying “well we’re already watching…”. Can’t let ourselves accept this is normal!
- daft_pink 10mo ago
  How do you resist automated license plate readers? Not having license plates doesn't seem practical.
sys_64738 10mo ago
That's the slippery slope of shrugging your shoulders.
wiredpancake 10mo ago
[dead]

deleted 10mo ago

[deleted]

constantcrying 10mo ago

How do you write an article about this and not mention the GDPR or EU privacy laws? >"It’s hard to figure out exactly how much data a modern car is collecting on you" You are a globally operating news agency. You can absolutely get some GDPR requests in and look at it. What kind of reporting is this? "We don"t know, but we also have not tried the one way which forces companies to answer this question". BMW is a German company, just ask them for the information they have on you and they are forced to give it to you.

jeroenhd 10mo ago
Mozilla's concentrated efforts took a while, they're right that it's hard to figure out exactly what car manufacturers are doing. Unless you're willing to sue a bunch of them, plain GDPR requests won't be enough to get this information. Companies will happily lie or declare information collected as "non-personal" or "trade secrets" and if they're smart enough about the way they process their data they can probably convince a judge that the end result isn't personal enough that exposing their trade secrets weighs up against the GDPR. There's no way even a large news corporation is going to buy every model car from every brand that comes out in a year to get the legal rights to demand data, let alone pursue these data requests in court. Renting cars may be easier, but then your contract is with the rental company and they're responsible for getting you the information you require, and after the first three PII requests you're not going to be renting from them any time soon. I'm not saying they couldn't do a deeper dive with more detailed research, but it's not an easy task to evaluate an industry like this. All they'll be able to produce is general statements about a limited set of car models that'll quickly be outdated once the next software update comes out.

hbarka 10mo ago

I have an electric car and if I want to remotely turn on charging, it won’t allow me unless the full data sharing option is enabled. Full data as in your driving data like a black box logger. I then have to go in the car, enable it, then I can remotely turn on charging. I have to remember to opt-out again later. Ironic I know because I can turn on charging from within the cabin without having to enable any of the data collection. What an inconvenient experience.

mixmastamyk 10mo ago
What does "remotely turn on charging" mean? Doesn't charge when you plug in?
- hbarka 10mo ago
  There are a few options. You can plug it in your garage and charging can automatically begin due to a set schedule, like after midnight, or you can initiate it on demand using the cabin controls or using your iPhone as a remote.
thrtythreeforty 10mo ago
Which car is this?
- hbarka 10mo ago
  Ford
mk_stjames 10mo ago
So you're telling me that simply walking out to the car and hitting a button inside the car is just too much of an "inconvenient experience"? You know we used to have to drive the car... sometimes many miles... to a station, get out, and fill it up with a liquid fuel that costs many times more, and then drive home... Seriously now- The perceived 'inconvenience' you have is the reason that so many of these connected features are being pushed and then the because the ability is there the business types can't resist the data gathering that became possible because of all the antennas, etc.

jwr 10mo ago

Amazingly but perhaps not surprisingly, cars in the EU do similar amounts of spying on you, but the EU is silent. Car manufacturers pretty much run the EU.

TacticalCoder 10mo ago
[dead]
Am4TIfIsER0ppos 10mo ago
Because the government wants the tracking. They want your car broadcasting its position.
deleted 10mo ago
[deleted]

J_Shelby_J 10mo ago

I wonder what the extremely rich do to get a car that isn’t a security risk? I’ve heard you can throw money at high end car dealerships to disable spying, but I wonder what the internal process is.

everdrive 10mo ago
I haven't heard this. Do you have any examples?
mixmastamyk 10mo ago
This will probably be a thing, but it's not clear that folks are cognizant of the risks yet.
drnick1 10mo ago
It's easier than that, you can remove the cellular modem. Dealers won't generally accept to make this mod, but any independent shop should be able to. There are also plenty of videos on YT to DIY.
- MrDrMcCoy 10mo ago
  I some months back called every independent EV mechanic I could find a listing for in my state to see if they would help me disable the cellular modem of any of the models I was interested in buying, and they mostly told me either that they couldn't or wouldn't. One of the more polite shops I got in touch with explained that many models don't have a separate board that can be disabled anymore, or otherwise have more things on the board that need to be talking on the CAN bus for other, actually important parts of the car to function. As such, I still have my old car. Since then, I've learned about the 50ohm dummy antennas you can buy. I might try that if my car dies before an AWD/4WD Slate truck becomes an option, and also if my living situation can accommodate charging.
  - drnick1 10mo ago
    As far as I know, all modern Toyotas have discrete DCMs (data communication modules) that can be physically unplugged with limited side effects. The side effects are loss a speaker and hands-free microphone, but they be restored by means of a bypass harness. Simply unplugging the antennas does not seem to be enough in areas with good cellular coverage. I have seen the dummy load approach discussed on car forums but have no experience with it.

nimbius 10mo ago

as a professional diesel mechanic for a small chain of midwest shops, this "telematics" feature is on long-haul trucks as well as tractors (john deer is notorious for using it to send mail marketing about services.) generally its not hard to disable. - identify the telematics module in your car - pull the fuse (not always an option, sometimes this disables bluetooth) - alternatively: identify the 1-2 SMC connectors on the telematics device. this is the LTE and low/alt channel for the cellular communications. disconnect these 1-2 connectors and connect the ports instead to a 50 ohm terminator. the vehicle will simply continue to collect data but never be able to send it anywhere. the system will assume it just cant find a tower.

m463 10mo ago
I tried this with a wifi setup on a car charger. I connected a 50-ohm dummy load in place of the antenna using the mmcx connector. It didn't work - there was an on-module antenna that it switched to. Might not have worked as well, but it did work and the wifi access point still showed up. On the other hand, some cars have a self-contained telematics module like you said and you can just unpower the whole thing. I remember looking at a ford owners manual for a 2019. The fusebox section had a fuse with description "Telematics control unit - modem." I assume you can just pull that fuse.
vitaflo 10mo ago
Connecting to a dummy load is a pretty good idea I hadn't thought of (usually I just disconnect the cellular module).
quasse 10mo ago
The Toyota community has been far down that road with the DCM module in the new gen cars and found that the car still managed to get updates out to Toyota even with 50 ohm terminating resistors in the antenna connectors: https://www.tacomaworld.com/threads/simpler-solution-for-disabling-the-dcm-telematics-silencing-antennas.821649/ https://www.tacomaworld.com/threads/simpler-solution-for-dis... (see the posts by user "Disgruntled Scientist"). Unfortunately simply cutting power to the telematics module also disables the in-car microphone for handfree calling. Fully disabling telematics involves making a bypass harness that re-routes the microphone and speaker signals past the disabled DCM module.

pfp 10mo ago

I thought about getting a traditional navigator to avoid even relying on phone navigation. Well, of course all the Garmins and Tomtoms available now have "built-in wifi for updates" and often BT for phone notifications too. Sure, I could just not configure either but what if I want a navigator _without any radios_ and with controlled updates via SD card. Maybe a dedicated Android phone in the car with offline OpenStreetMaps installed and airplane mode on is more realistic. Or some old 2nd hand navi that's still updateable.

drnick1 10mo ago
You could use a GrapheneOS phone without SIM and OSMand for that.
CommenterPerson 10mo ago
I use an older Garmin, purchased from ebay. Works fine, updated maps via a laptop recently. Needed an extra SD cards for space.

rconti 10mo ago

I think it's wild that people spend their own money to surveil themselves every second they're near their car. Maybe I've seen too much lawyering on TV and in movies, but if I'm in a collision with you, I'm definitely asking the cops to pull the SD card from your dashcam. Whenever I point out I think this self-surveillance is crazy, the response ends up sounding something like "oh, no big, if I think I did something wrong I'll just hide the evidence and lie to the police and say it doesn't work", which sure doesn't sit right with me.

caconym_ 10mo ago
Why do you think potentially self-incriminating self-surveillance is "crazy" when you also think lying to the cops and other involved parties about what happened is bad? If you believe it's important to tell the truth in these situations, you should have no problem providing your own recordings of a collision, regardless of who is at fault. Or is your point just about the cost of the dashcam being "crazy"? In that case, hypothetically, what if your insurance company cut you a check to buy a dashcam of your own choice and install it on your car?
- stavros 10mo ago
  I think they're saying "I don't want to self-incriminate so I don't want to put myself in a situation where I have to lie". I'm not sure it's entirely consistent, but I also don't think it's entirely inconsistent.
  - caconym_ 10mo ago
    If you believe you are at fault in a collision where police, insurance, etc. are involved, they are going to ask for your statement, and at that point you will be forced to choose between lying or admitting fault. If you're glad that no dashcam footage exists, presumably you are going to lie about what happened! I don't see why this is any different than popping the SD card out of your dashcam and lying about that too—you're still lying, and for the same reason: to evade responsibility for a collision you caused.

smeej 10mo ago

I found the vehicleprivacyreport.com site awfully misleading. The "Vehicle Privacy Label" only lists what the manufacturer's current policies are, not what applies to my vehicle. It makes it seem like Toyota is somehow remotely collecting and sharings tons of information about my...2007 Prius. But this car came out in 2006, well before people assumed easy internet connectivity everywhere. Shy of having physical access to my vehicle, they can't read anything, but it's not easy to find that explanation on the site.

kdazzle 10mo ago

I worked on the data platform at a smaller car co, and there were tight controls around getting access to precise geo data, and there were strong privacy advocates at higher levels. Wasn’t a perfect system, but “spying” would be far from what I saw

meisel 10mo ago

It wouldn’t be surprising if cars also record audio of conversations to use for ad targeting. It has already been conclusively shown that TV companies have done this.

MrDrMcCoy 10mo ago
IIRC, Nissan even has a clause in their privacy policy for selling information about passengers having sex. Pretty hard to collect that without audio data.
tavavex 10mo ago
> It has already been conclusively shown that TV companies have done this. Can you elaborate? I don't think I've ever heard of this. When did it happen?

elzbardico 10mo ago

Cars, your TV, your phone, everything is fucking spying on you. At this moment I am more interested in how I generate a tsunami of more data about me to the powers that be to drown them in a deluge of irrelevant bits.

drnick1 10mo ago
Yes, and that's very sad. However the solutions are pretty obvious: Car -> unplug the cellular modem (more or less easy) TV -> used as dumb monitor with a Linux HTPC Phone -> GrapheneOS PC -> Linux Social media -> /dev/null Email/DNS/cloud -> my own The real issue is that most people are not aware of these issues and may even (unintentionally) compromise your own privacy by posting information or pictures of you to Facebook or other similar places.
- rglynn 10mo ago
  > Social media -> /dev/null That made me chuckle, absolutely right though!
  - stavros 10mo ago
    I love how these comments are made on a social media website.
    - drnick1 10mo ago
      HN is not a social media platform in the traditional sense. For one, it is completely anonymous, unless your "handle" is somehow linked to a real identity (by choice or otherwise). It's very, very different from posting every aspect of your life on a platform like Facebook.
      - gnabgib 10mo ago
        Anonymousness does not make a platform unsocial (Twitter, 4chan, 8chan, reddit, HN, IRC, PlentyOfFish, X, Instagram, TikTok, Snapchat, Tinder, StumbleUpon, FourSquare, BeReal, WhatsApp, democratic voting, any forum, YouTube, Wikipedia, any BBS)

ericmay 10mo ago

Nothing you can realistically do about it. In America car ownership for most people is mandatory. It’s unfortunate we don’t have alternatives if you disagree with car manufacturers extra “features”.

drnick1 10mo ago
The alternative is to be aware of this abuse and unplug the cellular modem. It requires more or less effort depending on the car, but it can and should be done.
- ericmay 10mo ago
  It’s not a good alternative though because it puts you into a losing competition with the manufacturers. Take out the cellular modem? Next one requires connectivity to drive the car and so forth. You could “ban” it, but the amount of effort required to raise public awareness for that and actually have our dickhead representatives due things like that is basically the same amount of effort, perhaps more, as building better cities and transportation modes. We build and subsidize highways, we could do the same with other methods of transportation and have competition instead of big gubmint cars.
  - drnick1 10mo ago
    In many parts of the US, individual vehicles are the only viable mode of transportation. In fact, even in the NYC metro area, a car is pretty much indispensable, unless maybe you live in Manhattan and only rely on home delivery for groceries and the like. If you ever want to do anything outside of the city, you need a car.
    - ericmay 10mo ago
      Right which leaves us without alternatives and beholden to car manufacturers and their collective decisions.
  - vitaflo 10mo ago

m463 10mo ago

> The first thing drivers should do is be aware of what data their car is collecting > You can opt out lol this makes it seem so simple. I think - you will never be aware of what data is collected - they want to collect more data and never disclose it - you will never be able to opt-out. Even if you disconnect from cellular, at service time they will just download what is there. - car manufacturers will use any and all data to their benefit You know, here's an interesting story I remember reading: I will give you a story - buddy owns a shop - buys new M5 - he went out joyriding - warped a rotor - he said it was not from him so he tried a warranty service - BMW printed a page that his car recorded. It had snapped a pic of his face and sent all the data on speed, location, etc every bit of data you can think of to the dealer and his insurance company. He sold the car. That was years ago. Ask any custom tuner today if they can touch a 22 BMW. Nope. It will disable the car if you try and get into the CPU to tune it. This is where the industry is heading from: https://www.fordtremor.com/threads/disabling-the-modem-pulling-the-fuse.7101/ https://www.fordtremor.com/threads/disabling-the-modem-pulli...

The_President 10mo ago
Similar story with a user's earlier Model S - they used to drive it like they were being chased by the cops, and so when it was time to swap the degraded battery under warranty, (as they said) "a nerd" came out of the back of the service center "with a bunch of paperwork from the database" and Tesla denied the claim.
Tylast 10mo ago
I don't disagree with you on BMW's data collection capabilities. However, I've read about 2023s being tuned. It's also widely reported that BMW encrypted many of the computers starting in 2024. This past September, BMW disabled 3rd party access (think Home Assistant) to vehicle data. There are only 2 paid 3rd party companies allowed. 2+ years of me using HA (with some awesome automations) was terminated. I was willing to let them use my data as long as I could too, but now I don't even have access to my own data!

blackjack_ 10mo ago

I ripped the wifi / onstar and gps antennas out of my 2020 Chevy Bolt the day after I bought it. Took me a couple of hours since the access was awful, but that's one time pain. No issues since, and I have a phone I use to drive the head unit so there was no need for those antennas to even exist.

m463 10mo ago
I tried this once. I got a tesla home charger and it had a unnecessary wifi AP that kept showing up in my house. So I figured, I would stop this. Opened it up, and disconnected the wifi antenna mmcx connector. Nope, seemed when unplugged, it would switch to an onboard antenna for the wifi module. so I reconnected a dummy load antenna to the wifi module. and it still used the onboard antenna. at that point, I gave up. I think there might have been a possibility of downgrading the firmware to an older version that could disable wifi, but I didn't try to find it. I believe this kind of thing happens with onboard cellular, wifi and bt. They are more resilient to degraded or disconnected antennas than you think.

mistercheph 10mo ago

don't buy a modern car

ris 10mo ago

The only company that appear to be taking a different tack on this are https://www.slate.auto https://www.slate.auto Anyone know of any others?

MrDrMcCoy 10mo ago
Nope, which is why I plan to get them as soon as AWD/4WD becomes an option.

tlubinski 10mo ago

The CCC had a nice talk last year about the data VW collects and what can be learned from it (all the data was unencrypted accessible): https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-volksdaten-von-volkswagen https://media.ccc.de/v/38c3-wir-wissen-wo-dein-auto-steht-vo... (unfortunately it's in German - but there is an english live translation available)

AlexCoventry 10mo ago

Interestingly I can't get ChatGPT to help me find a video showing me how to disable the cellular modem on my Subaru 2024 Crosstrek. Time to do some old-fashioned research, I guess... https://chatgpt.com/share/692cde57-0930-800e-b45f-7a41ca5c8eb7 https://chatgpt.com/share/692cde57-0930-800e-b45f-7a41ca5c8e...

jacquesm 10mo ago
Who cares about what ChatGPT can't do? It can't make me a sandwich either.
- AlexCoventry 10mo ago
  I've found it extremely useful for this kind of research in general.

123sereusername 10mo ago

[dead]

effnorwood 10mo ago

Remove the modem

MrDrMcCoy 10mo ago
Not always possible, depending on model, skill level, and/or availability of a mechanic that's willing to try. My own search for a mechanic to mod any of the cars I was looking at buying was fruitless and left me with the decision to hold onto my gas guzzler for a while longer.

jacquesm 10mo ago

You can simply not drive a modern car.

gylt 10mo ago

[dead]

Lapsa 10mo ago

modern tech enables an actual mind reading - while you bicker around about vehicle telematics and bluetooth beacon signals

1vuio0pswjnm7 10mo ago

It's rather surprising/disappointing that "advice" like this makes no mention of how the automobile gains internet access Does it (a) have it's own SIM card, (b) piggyback on driver/passenger/other vehicle SIM cards, (c) opportunistically connect to free wifi APs, etc. Perhaps the surveillance data is only transmitted to the mothership when the automobile is being "serviced" The automobile OS may be like the other corporate OS, e.g., iOS, iPadOS, Android, etc., in that there is no possible configuration or combination of user settings that does not allow data collection and surveillance for unlimited commercial purposes