8 ms·

Data collected by cars and sold to third parties

• deleted 1mo ago
  [deleted]
• wallkroft 1mo ago
  [flagged]
• cc62cf4a4f20 1mo ago
  That‘ll happen when you don‘t have meaningful data protection laws.
  • amelius 1mo ago
    My question is why, with their protection laws, Smart TVs and Smart Cars are still sold in the EU?
    • thfuran 1mo ago
      Do they do the same spying on the models/units produced for sale in EU? It’s not actually a necessary part of the operation of the device, so it makes sense they’d be able to sell them without it.
      • ranger_danger 1mo ago
        For cars they most certainly do.
    • Yizahi 1mo ago
      HN on average is a little behind on the general EU "privacy" stance (though I saw some recent topic about that here). EU was about privacy, a few decades ago. Nowadays it did a complete U-turn and legislates mandatory anti-privacy union-wide laws every year. - Chat Control law, now all messaging must be intercepted and monitored. - eIDAS law, mandating that web-browser vendors must now accept state issued root certificates, so that states can selectively and without any legal procedure deploy MITM attacks at will. - ADDW law, mandating that all new cars must a permanent mandatory camera and microphone surveillance module inside a car, which can't be disabled by law (bye-bye insurance if you will). There also other fun things in it like mandatory autobraking, mandatory auto lane-assist etc. - ProtectEU laws, demanding backdoors to emails and such (maybe it's the same as Chat Control, not sure). - AI Act legalizes AI surveillance over CCTV recordings without any judicial approval. - European Media Freedom (duh) Act legalizes deployment of shit like Pegasus against journalists. I'm pretty sure I'm missing a lot here too. You get the picture. EU is getting fast track into Stazi 2.0, everyone is fine with it, "because children" /s
      • majorchord 1mo ago
        Breathtaking levels of misinformation here. There is no EU law that mandates "all messaging must be intercepted and monitored." There is no EU law mandating permanent, non-disableable cameras and microphones in cars. ProtectEU is not a law, not related to email and does not demand any "backdoors." The AI Act bans real-time facial/biometric recognition in public places... which is a good thing. It does not "legalize AI surveillance"... quite the opposite. EMFA does not authorize the deployment of spyware and they have publicly condemned the use of Pegasus specifically.
        • lnsru 1mo ago
          There is always a citizen who honestly thinks that emperor is good and loves the citizens. The reality is that emperor loves the citizens that love the emperor and will do everything to find and destroy the citizens that don’t love the emperor. History books are full of such examples. Right now I am repairing old car that does not track me, does not film me and doesn’t try to drive me. It’s a such a great joy to drive it without stupid beeping and automatic wheel movements. Especially without suicidal steering in construction sites when the modern system fails.
        • Yizahi 1mo ago
          Two can play this game. Chat Control - a) it is a law, mandatory in whole EU (because it is a "EU Regulation", and that is a law); b) I was indeed to broad and made a mistake, for now only not E2EE messages must be intercepted and monitored. E2EE is on a the chopping block in Chat Control 2.0 which is being drafted, in progress. Advanced Driver Distraction Warning (ADDW) - a) it is EU Regulation and so it is a law; b) ADDW mandates a non-disableable surveillance camera (not sure about microphone) inside a car. ProtectEU is indeed Chat Control plus extra, so here I was incorrect. Encrypted emails are temporarily safe, until Chat Control 2.0 is passed. And given how they bruteforced CC 1.0 in multiple blatant retries, it will eventually pass. Regarding EU AI Act you are replying to something I didn't write. Sure it doesn't allow real-time surveillance. I wrote that it does allow surveillance over the recorded materials. This technicality allows passing all video through storage, then monitor suspects via AI programs all without judicial approvals. And finally EMFA does authorize deployment of the spyware against journalists in cases of investigating a crime carrying 3= years penalty. Do I need to spell out how laughable that is? Practically any national security crime carry similar or heavier penalties and govt. can start a very broad and arbitrary investigation for any reason. This means that the matter of starting surveillance is a small technicality really with zero oversight.
    • pvaldes 1mo ago
      My guess is lobbies buying the political leaders.
  • derwiki 1mo ago
    Can I invoke CCPA to get a report of and/or delete my data?
    • jboggan 1mo ago
      You can invoke CCPA (if applicable) and directly ask a covered business or registered data broker for an exact output of your existing information on their systems. This is honestly rare and most companies will find ways to deny you - asking for various documents to prove your identity and hoping you quit responding. If you are a CA resident you can also get on the state's DROP platform to request that all registered data brokers delete your data, but it's only for deletion and not the other 4 types of data requests allowed under the CCPA (right to know, right to collect, right to opt out, and right to limit use).
  • BlackRabbit1 1mo ago
    All European car manufacturers pull a crazy amount of telemetry data from your car. Either via permanent 4G/5G link or during service intervals in the shop. Source: I analyzed these data as an intern for one.
    • klm127 1mo ago
      Can you describe it? I'm assuming speed, acceleration, GPS, infotainment use. Surely its not sending backup camera footage, chair recline position, turn signal usage.
• everyone 1mo ago
  Another reason to use a car from 90's or 2000's.. Also they wont burn oil like a modern car + more durable and repairable metal parts. https://youtu.be/Ft12aZffCEg?si=qP1J5k6RXAxmZChf https://youtu.be/Ft12aZffCEg?si=qP1J5k6RXAxmZChf https://youtu.be/SeMZGICNSMg?si=-YLnt5Q477xpFbra https://youtu.be/SeMZGICNSMg?si=-YLnt5Q477xpFbra https://youtu.be/8Kp108x4tQA?si=j7JV-_Dpl5afP99F https://youtu.be/8Kp108x4tQA?si=j7JV-_Dpl5afP99F
  • herbst 1mo ago
    I really wanted a modern car because of the fancy automation stuff, I thought. But it never is economical or more environmental friendly. Whatever I saved on my old car compared to a newer one will never be less than the theoretical fuel savings on a newer car. Repair costs will never be as much (assuming you buy a popular repair friendly car). And nothing new needs to be built for me either.
  • thrownawaysz 1mo ago
    >Another reason to use a car from 90's or 2000's Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter. Also by my experience cars (except from SUVs) somehow never kept up with the road quality. Pot holes are a problem everywhere but you can see that certain brands for example japanese and korean ones never designed for deteriorating road quality (and I don't mean offroad) because... you know they just don't exist in the home market. So the tires, wheels, suspension are not as robust as they should be. Sure _everything can be fixed_ but then your car becomes a hobby and might not everyone has an attitude and time for that.
    • IslandRebel 1mo ago
      > Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter. You can still find good examples in the UK where we have salted roads. I've paid for mine to be dinitroled. Pot holes etc are a problem here and they will affect newer vehicles too and used to go through a tyre a winter.
• tomrod 1mo ago
  How can this be stopped, from a technical perspective? Can I wrap the comms in a Faraday cage? Obviously it would be better to have this action be illegal. But with legal privacy protections eroding in the US and other countries, it seems prudent to have a better understanding of the systems involved in the immoral surveillance.
  • base698 1mo ago
    You learn animal husbandry and join the Amish.
    • pvaldes 1mo ago
      You drive an used car from 2016, that is much easier.
  • schmeichel 1mo ago
    It is possible to remove the hardware itself that is responsible for this, but depending on the car it can very involved: https://arkadiyt.com/2026/05/13/removing-the-modem-and-gps-from-my-rav4/ https://arkadiyt.com/2026/05/13/removing-the-modem-and-gps-f...
  • forgetfreeman 1mo ago
    Simple: don't own a vehicle with this capability.
    • tomrod 1mo ago
      Much like owning a home without an HOA attached, it is becoming harder and harder to meet this requirement. It also seems to conflict with `right-to-repair` laws if the capability is legally required.
      • cucumber3732842 1mo ago
        >Much like owning a home without an HOA attached, it is becoming harder and harder to meet this requirement. The near universal proliferation of owner's associations and management groups and whatnot for developments larger than ~1ac (the EPA threshold, some states/towns have lower) is something you can lay at the feet of the Clean Water Act and it's implementation and precedents over the following decades. The exact area of the buildings, the driveways, the community park and gazebo, etc, etc, are necessary features of the site plan that makes the math that is required to meet stormwater/environmental requirements. And and some legal entity has to be responsible for that in perpetuity. Enter the HOA. This is also why HOAs often won't allow you to expand your driveway or add a non-permeable patio, it could (prob not, but still) ruin the environmental calculations they're responsible for enforcing as a condition. I'm not nearly as familiar with car regulatory stuff but I would bet a lot of money that they're using OTA telematics to check some sort of compliance box...
• jeffbee 1mo ago
  [flagged]
  • VCFundedGenYer 1mo ago
    1. Android Automotive is run by Google, so that entire argument goes out the window immediately, because Google 2. Car companies bypass CarPlay/Android Auto with their own head units with software that executes before the projection software does.
    • jeffbee 1mo ago
      Android Auto and Android Automotive are not the same thing.
  • thepryz 1mo ago
    Sorry, but a lot of cars, even if they run Android Automotive, maintain a separate TCU/DCM with its own cellular connection that can collect vehicle information independently of Android Automotive.
• deleted 1mo ago
  [deleted]
• Cider9986 1mo ago
  Apparently Rivians can be prevented from doing this: Can I disable all data collection from my vehicle? https://news.ycombinator.com/item?id=47967786 https://news.ycombinator.com/item?id=47967786
• amelius 1mo ago
  How is this not stealing? I'm going to pirate shit until this is fixed.
  • kulahan 1mo ago
    You’re going to steal in response to stealing…? Unless you’re of the opinion that since it’s data, it’s not stealing?
    • ZYbCRq22HbJ2y7 1mo ago
      Maybe the poster is saying, "There are no consequences for anyone acting in this way here, and we seem to be slipping ever more into societal moral decay, so why shouldn't I cheat to win?" Or: "All companies are essentially gigantic conglomerates eating each others' food by selling my own and others' data to each other, so I basically have rights to their claimed assets anyway." Or: "No company or government respects my privacy or property rights, so why should I respect theirs?" Some of that is a form of "I am going to steal, because others are stealing", and well, if stealing becomes the norm, yeah, I would say the comment has some validity in a few words for the common citizen.
    • amelius 1mo ago
      No, this is mostly out of activism. I'm angry that the law is there for one group while the rights of another group are completely neglected. That it gives me free content is just a nice side-effect, nothing more.
• bitparadox 1mo ago
  I posted a flavor of this comment on an article a few months ago, but it's relevant here: I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc. Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate. The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.
  • trouve_search 1mo ago
    Couldn't you put some sort of faraday cage around the antenna?
    • anjel 1mo ago
      What happened to just pulling (the mfr's) sim card?
      • greesil 1mo ago
        Not trivial, not impossible
      • antonkochubey 1mo ago
        It’s often an eSIM
  • Simulacra 1mo ago
    What did you do, or what are you going to do? That would piss me off until i found the antenna and broke it
  • bookofjoe 1mo ago
• polyterative 1mo ago
  My car is from 2017, so thankfully it's not.
  • gdulli 1mo ago
    My car is much older and I used to hope it would last forever. But now I hope it dies soon enough that when I go to replace it, the options for non smart cars haven't gone away.
    • klm127 1mo ago
      They aren't going to go away. You can still buy cars that are 50 years old.
      • HDBaseT 1mo ago
        Not really. A 50 year old is a collectable, in high demand.
• kaladin-jasnah 1mo ago
  In my GM car I have the wonderful opportunity to pull the OnStar fuse and disable all cellular connectivity. However, I am concerned the telematics information are stored in long term storage and if I have to reconnect the fuse, all my driving will be batch uploaded. I hope not!! And the GPS still works. Maybe I can find some dummy loads as well or the antennae. It's still better than other modern cars though? I think.
  • 3eb7988a1663 1mo ago
    If you are willing to lose GPS, maybe you could set the car's internal clock to the year 2000. This might fool a cursory data dump that is looking for "last three months of driving habits". Would obviously not stand up to any real scrutiny, but mostly painless.
    • LoganDark 1mo ago
      GPS provides the time, so this probably won't work. If it ever reconnects it will just reset its clock. That's often one of the first things that any computer does after a long period of no power/connection.
      • 3eb7988a1663 1mo ago
        I did say lose the GPS.
        • LoganDark 1mo ago
          GP was talking about reconnecting the system. Is GPS separate?
          • 3eb7988a1663 1mo ago
            The systems must be separate if they were able to disable some of the network connectivity but maintain GPS. I thought GP was talking about if they had to reconnect the systems for some reason, would archived telemetry suddenly be uploaded. Which is a real possibility, so I was suggesting poisoning the data. Even if you correct the clock today, the previously recorded timestamps cannot be automatically fixed. Even better would be to reset the clock on every startup event. Which is all still a band-aid solution - a targeted analysis could mostly correct the time-keeping. This just prevents getting scooped up in a simple drag net kind of search.
• hughes 1mo ago
  Terms of use to even read the article: > third-party partners process information about you and how you use our services, including clicks and screen recordings, using first and third-party cookies, pixels, and similar technologies
  • Frieren 1mo ago
    Any type of data gathering should be forbidden. The "with consent" is bullshit, as the only way to not give consent is to leave society and live in a cave. (No driving a car, no taking a flight, no reading a website, no subscribing to any service, not playing games, etc.) When there is no real choice there is no consent either. Corporations have profiles on citizens that makes the Gestapo or the KGB seem uninformed in comparison. There is no freedom when the people in power know everything about you.
• heaney-555 1mo ago
  I notice that not one comment here, nor the article, notes that this doesn't happen with a Tesla.
  • otterley 1mo ago
    Why doesn’t it happen with them?
    • heaney-555 1mo ago
      Tesla charges a $10/month subscription for its connected features, with relatively high uptake because its software is actually great (unlike the dogshit UX of most cars), so it doesn't need to sell data. Plus it just isn't how Tesla operates.
      • LoganDark 1mo ago
        They may not sell the data, they just keep it for themselves. And Elon.
        • Yizahi 1mo ago
          I never thought I would say that, but I would rather have my data hoarded by a crazy rightwinger Elon, than by Stellantis or VW or BMW or Hyundai or any Chinese vendors and being sold to each other plus to a dozens of incompetent or malicious middleman contractors like the one pwned recently in USA. I mean, both alternatives are crap, but 1 piece of crap is slightly better that 100 pieces of crap for the same cost. PS: never owned anything by Elon.
      • otterley 1mo ago
        I wonder how long that will last. That may be their privacy policy today, but AFAIK that's merely a policy, not a binding agreement. I don't know whether anything stops them from changing their mind later, i.e., the classic rug-pull. I appreciate Tesla's position on the matter, but I'd still rather have the collection and dissemination of the data more tightly regulated by law.
• Simulacra 1mo ago
  I drive a restored 2002 Citroen C5.
• ksudb 1mo ago
  [dead]
• throwaway246979 1mo ago
  [dead]
• samsullivan 1mo ago
  Two different things are getting called "car data" here. Facts about the car: VIN, spec, recall status, odometer. Attested by someone other than the owner. Outlives every owner and the owner is the last to have it, if at all. Facts about the driver: speed, location, timestamp. Thats what GM sold, the fix is to not collect it but OEMs seem to take 'anonymization' approach. The DRIVER act treats both as the same which is why it fails to fix anything. The second needs a ban. The first needs the opposite - especially as we take the driver out of the vehicle - an authoritative record of the vehicle. How do we expect AVs to have adoption when the only safety certification is the company's press release?
• rozal 1mo ago
  [dead]
• hn_submit 1mo ago
  Like I've said here before: we need to push for legislation that bans the sale of consumer data collected by websites and manufacturers to third-parties. We need a solution, not a Band-Aid like the "Freedom Car Act." I believe that legislators are deliberately coming up with legislation that mildly hinders, but in no way resolves the issue in order to keep their sugar-daddies freewheeling.
• mannanj 1mo ago
  And the DMV (Department of Motor vehicle Services) has also sold registration data. In California, and Texas, they have been fined for this - I'm unsure they aren't completely barred from using a loophole to still do that. This is why I'm a vocal advocate for having an LLC own any vehicles you might drive. It protects you from the license-plate reading lookup as well from Flock et all. Though I don't know it guarantees you can't be looked up by insurance it's resistance by one more bit of friction. The vehicle I drive now is an old 2012 Lexus owned by Montana LLC and it also has no smart technology and very little insurance costs.
  • octoberfranklin 1mo ago
    It won't protect you from the insurance agencies; they demand a DL ID# and a VIN. And you are required by law to purchase from them. And they're stautorily exempted from a whole boatload of privacy laws, like HIPAA.
    • sagarm 1mo ago
      In California you can post a surety bond in lieu of insurance. I'm sure the same applies in other states with governance that is not captured by corporate interests.
      • CableNinja 1mo ago
        Can you elaborate on this some? Afaik insurance is the only thing they would accept. I think insurance is generally a nasty scam so anything to get away from it would be pretty neat
        • tredre3 1mo ago
          You have to deposit $75,000 to the DMV and if you get in an accident where you're at fault you will also be on the hook for damages beyond that. You can also get a surety bond for that amount, instead of doing a cash deposit. It used to be 35k but it was increased in late 2024 (which is good because it hadn't increased since the 70s). https://www.dmv.ca.gov/portal/vehicle-registration/insurance-requirements/ https://www.dmv.ca.gov/portal/vehicle-registration/insurance... But to do that you really have to hate insurers or be uninsurable. Because realistically putting that 75k in a basic HISA will yield enough interests to pay for regular car insurance and you get to keep your 75k.
• tamimio 1mo ago
  Just don’t get a car with connected internet, or smart X in any way, which is most modern cars unfortunately, and if you do, disable the telemetry. I have a clean, cool, low mileage ~15yo car, has no screen or apps, no internet, no back camera or even digital dashboard. I put a screen that has offline CoMaps app, if I ever needed it, and its OBD connected to a local app that does usual diagnostics. Sure, there’s logging I see and it happens, but it’s all local and never shared let alone connect things gas or odometer or driving habits.
• jboggan 1mo ago
  I'd like to point out that the CA assembly has passed AB-1542 and it is likely going to be signed by the governor this week. This would make the sale and sharing of "sensitive" personal information illegal, and one of the sensitive personal categories is geolocation data that can map an individual to within a 1850-ft radius. In my understanding, this pretty much makes this type of driver data illegal to sell or share. CalPrivacy's enforcement division has their eye on connected car manufacturers already, so we'll see what they do with that. https://leginfo.legislature.ca.gov/faces/billHistoryClient.xhtml?bill_id=202520260AB1542 https://leginfo.legislature.ca.gov/faces/billHistoryClient.x...
  • porkshoe 1mo ago
    Another note for Californians -- the California DROP (delete request and opt-out platform) takes VINs as one of the inputs. https://privacy.ca.gov/drop/ https://privacy.ca.gov/drop/
  • IshKebab 1mo ago
    Well they'll still sell the data but "anonymised" like with phone location data. Better, but not fixed.
    • jboggan 1mo ago
      Not true. If they do that they are violating the law and that will show up in the audits. They have to delete the data, all records associated with that identifier, now including any 3rd party data that they bought from other brokers and did not collect or buy originally. There have been many loopholes for years but they are all being closed.
  • MarleTangible 29d ago
    Honda found a work around where they show you a warning on your dash if you disable data collection, similar to maintenance being due or low fuel.
• aunty_helen 1mo ago
  If you'd like to buy this data, go talk to the guys over at Inrx. They will happily give you a product demo showing point to point trips recorded by connected onstar or whatever corresponding manf connected car service.
• sciencesama 1mo ago
  How to stop this on Subaru ?
• bitwize 1mo ago
  The "genie out of the bottle" argument has been used in the ongoing AI-or-no-AI, we're-so-cooked/we're-so-back debate among software engineers, something like: you can't undo technological advances nor would you want to, so best cope with this new reality. And there are technological "advances" I would very much like to undo. One of them being social media, another being modern cars. Automobiles peaked when they were purely mechanical. An average American high schooler could understand all its systems, and many did. When they started becoming LANs on wheels beginning in the 90s, they became necessary millstones around their owners' necks, and these days they're as inscrutable as a smartphone, just as user-hostile, and just as tethered to vendor services. I think my father was speaking from a place of wisdom when he groused about computers in automobiles. And no, EVs are actually simpler than ICE engines, their drivetrain being basically a battery, a set of electric motors, and maybe some variable resistors to control speed. An EV that is purely electromechanical and operable via analog controls would be a godsend, but it's not going to happen under current regulatory environments.
• tom86150 1mo ago
  [dead]
• TheSpacerr 1mo ago
  This is sad.
• KurSix 1mo ago
  [dead]
• teekert 1mo ago
  It's a complete shadow economy, users don't want it and mostly don't know it. But sometimes it surfaces, ie we had a public gathering in my village about the plans to restructure one of our main streets, since people don't feel safe walking an biking there naturally we want it 1 way or 30 km/u. In response rhe person from the municipality whipped up some graphs with speed profiles along the street as it is now. Naturally I ask how they get that data and he says "you can just order it online, I think from Google and Apple originally? Oh, yeah sometimes you can identify things, like a cop once speeded along this road and he could see his datapoint (a far outlier)!" Nobody saw any problem with this. And it's such a small step away from direct actions based on this data (although people would probably take action themselves the moment they understand there are direct downsides for them.)
  • prism56 29d ago
    I did a GDPR request to KIA and I was amazed what they collected. Here's some examples: How long I let the car warm up before driving, G force around every GPS corner, acceleration rates, max speeds, every GPS datapoint etc.
• Weryj 1mo ago
  I work in grid management, and the Telemetry from EVs is a valuable data stream for steerable demand on the grid, a genuine societal benefit. The only data we need is if you’re at home and the charging metrics /w commands. But the amount of unnecessary data that is available, is a real privacy concern.
• dwedge 1mo ago
  > Privacy NoticeWe and our 179 partners store and access personal data. Fair to say the verge don't really care about data being collected and sold they just want the clicks
• pseingatl 1mo ago
  Several years ago, a German company whose name rhymes with "rowdy" sought permission from a Middle Eastern government to collect location and other information (e.g., speed) from its sold automobiles. The government asked them what they wanted to do with the information. They dithered and dawdled and failed to come up with an answer beyond "improved consumer experience." They failed to mention thay planned to sell the collected information to third-parties.
• apples_oranges 1mo ago
  Politics should put it on the agenda. It would influence my vote
• LightBug1 1mo ago
  I have a 2005 Toyota and 69 Beetle ... Fuck you, data leeches ... you'll get nothing from me.
• Lynxxy 1mo ago
  Benefit of being relatively poor. I've never been in a financial position to buy a car with all those fancy features.