Connected car data privacy under investigation by California regulator

If the CA regulators are able to pry their way in to expose business practices it's possible that it looks ugly enough to spur other states to follow suit.
SCOTUS worries me, though, as it seems entirely possible that the court could rule the EULA attached to new car sales is a binding contract and that this takes precedence over any state legislation.
 
Upvote
64 (73 / -9)
I did a CCPA data request for my connected car once. First it took pulling teeth, including a complaint to the DA (which the car company promptly replied to the DA that i'm satisfied with their handling of this case), then the report I got back was barely a summary of the data they have on me. Quite disappointing.
 
Upvote
79 (79 / 0)

killick

Smack-Fu Master, in training
58
Subscriptor
Not only are cars spying on us, they are increasingly no longer owned by us. I couldn't avoid getting a satellite radio installed and provided with a trial subscription when I bought my car. Now I'm getting spammed with increasingly urgent notices that it's going to expire if I don't shell out about $20/month.

From what I've read, there are now several car features that Tesla won't pass on to the 'owner' of a Tesla unless the 'owner' pays rent on that feature. When it was just satellite radio, we didn't seem to mind it too much, but what's next? You want to unlock all the doors at once? That's a fee. You want to put down all the windows at once? Pay a fee. You want a working mirror defroster, well that's a fee, too.

We need much stronger consumer protection laws. We're reverting to feudalism, where the rich just rent stuff to us and we own nothing.
 
Upvote
133 (137 / -4)

rcduke

Ars Scholae Palatinae
1,258
Subscriptor++
We need these kinds of privacy protections at a federal level. It has been said that where California goes the rest of the country eventually follows. I hope that is the case here.
True, but if Congress is anything to go by, there is far too much bribe lobbyist money to legislators to keep our privacy safe. I feel that a change of this magnitude is not going to happen anytime soon to be effective.
 
Upvote
38 (38 / 0)

onemorekayaker

Seniorius Lurkius
35
Subscriptor
I don't think people have any understanding that modern cars are collecting potentially very sensitive data on them. Like, extremely sensitive. With no regulatory oversight.

This is why I still drive a (very reliable, safe, ultra-low emissions) 2006... If there was a single unconnected electric out there I'd be a happy camper, but so far no dice.
 
Upvote
53 (54 / -1)

davey_w

Smack-Fu Master, in training
19
Not only are cars spying on us, they are increasingly no longer owned by us. I couldn't avoid getting a satellite radio installed and provided with a trial subscription when I bought my car. Now I'm getting spammed with increasingly urgent notices that it's going to expire if I don't shell out about $20/month.

From what I've read, there are now several car features that Tesla won't pass on to the 'owner' of a Tesla unless the 'owner' pays rent on that feature. When it was just satellite radio, we didn't seem to mind it too much, but what's next? You want to unlock all the doors at once? That's a fee. You want to put down all the windows at once? Pay a fee. You want a working mirror defroster, well that's a fee, too.

We need much stronger consumer protection laws. We're reverting to feudalism, where the rich just rent stuff to us and we own nothing.
When my sister bought her used Honda CRV several years ago it had a remaining satellite radio subscription. She let it expire and they kept trying to get her to renew it. She waited until the price was halved then renewed for 6-months. She's been doing that ever since. She now lives in southern Oregon and often travels back an forth to the SF Bay Area, so it's a good deal for her.
 
Upvote
3 (5 / -2)
Not only are cars spying on us, they are increasingly no longer owned by us. I couldn't avoid getting a satellite radio installed and provided with a trial subscription when I bought my car. Now I'm getting spammed with increasingly urgent notices that it's going to expire if I don't shell out about $20/month.

From what I've read, there are now several car features that Tesla won't pass on to the 'owner' of a Tesla unless the 'owner' pays rent on that feature. When it was just satellite radio, we didn't seem to mind it too much, but what's next? You want to unlock all the doors at once? That's a fee. You want to put down all the windows at once? Pay a fee. You want a working mirror defroster, well that's a fee, too.

We need much stronger consumer protection laws. We're reverting to feudalism, where the rich just rent stuff to us and we own nothing.
You probably can't uninstall the satellite radio app either. Because... Why should you be allowed to do that on your own car?

P.S. Don't renew and watch that $20/mo drop and drop and drop. $5/mo was the last offer I got.
 
Upvote
54 (54 / 0)
We need much stronger consumer protection laws. We're reverting to feudalism, where the rich just rent stuff to us and we own nothing.
This is kind of the whole point of the modern age. We are already there, but no one wants to think about it too deeply. It's why I try to go physical where ever I can, but I acknowledge that is increasingly limited and meaningless. Owning digital means you don't own it, but even if it's physical it's probably played through a device that you don't control. I really don't see this getting better and the only solution to it is unacceptable because society is now built around these devices. Probably apocryphal, but a decade or so age didn't someone at a G7 meeting say "In the future you will own nothing and like it"? Here we are.
 
Upvote
27 (29 / -2)

GCamomescro

Smack-Fu Master, in training
74
If the CA regulators are able to pry their way in to expose business practices it's possible that it looks ugly enough to spur other states to follow suit.
SCOTUS worries me, though, as it seems entirely possible that the court could rule the EULA attached to new car sales is a binding contract and that this takes precedence over any state legislation.
If I am not mistaken, contracts are void if their terms violate any laws in the locations they are enforced. The only way I could see an EULA as potentially circumventing law is if the courts consider it "permission" from the vehicle owner, and then you have the whole topic of how the EULA is written and if reasonable customers would read it prior to purchase.

That said, @%$& vehicle tracking. Fortunately, motorcycles are less affected by this nonsense so far.
 
Upvote
47 (48 / -1)

JohnDeL

Ars Praefectus
5,194
Subscriptor
What typically happens if you rip the communication equipment out of these cars?

I seriously don't know whether that's ever viable or not, but would like to.
I don't think you can remove the physical equipment, but I hope that there is a set of people dedicated to jailbreaking the cars so that the owner can remove intrusive apps and limit data-sharing, the way that the farmers did for John Deere tractors.
 
Upvote
34 (34 / 0)
If the CA regulators are able to pry their way in to expose business practices it's possible that it looks ugly enough to spur other states to follow suit.
SCOTUS worries me, though, as it seems entirely possible that the court could rule the EULA attached to new car sales is a binding contract and that this takes precedence over any state legislation.
AFAIK, EULAs and contracts can't trump laws. I doubt anyone wants to change that. Else laws will effectively become meaningless.
 
Upvote
40 (40 / 0)

trucmat

Wise, Aged Ars Veteran
140
Subscriptor
If a corp wants my data or my writings or my art they must (should) by law be required to get permission. If I tell them no then they can offer money to obtain or license my data or works. But stealing it behind my back should mean jail for someone whether it's an AI or a CEO doing the stealing.
 
Upvote
32 (33 / -1)

ergonomicBagel

Smack-Fu Master, in training
74
What typically happens if you rip the communication equipment out of these cars?

I seriously don't know whether that's ever viable or not, but would like to.
It’ll vary widely I’m sure - the offending component in Toyota’s is the DCM (Data Connection Module?) and I’ve seen threads regarding the RAV4, 4Runner, Corolla and seems like people have been experimenting with unplugging the antennae (not too effective), pulling the fuse entirely (works, takes the microphone with it and naturally app, SOS functionality), calling Toyota to disable (can it be turned back on remotely though?) but there isn’t a definitive solution. One could also get a vehicle that has 3G telematics since those networks are on the way out if not already.
 
Upvote
28 (28 / 0)

hizonner

Ars Praetorian
541
Subscriptor
I don't think you can remove the physical equipment, but I hope that there is a set of people dedicated to jailbreaking the cars so that the owner can remove intrusive apps and limit data-sharing, the way that the farmers did for John Deere tractors.
I definitely can remove the physical equipment. I'm just not sure how the car will react.

They do have to be driveable outside of whatever coverage area. I'm just not sure what they'll do if they're cut off for a really long time. I imagine they'll at least disable "premium subscription services", but I don't know what that means in practice. Or what else they'll disable.
 
Upvote
13 (13 / 0)
What typically happens if you rip the communication equipment out of these cars?

I seriously don't know whether that's ever viable or not, but would like to.
If you stick to old enough used cars, you'll find that the manufacturers cheeped out and shipped with 3G modems well into the LTE era. Now that 3G service is no longer a thing, these cars are effectively disconnected.
 
Upvote
32 (32 / 0)

Devoidless

Smack-Fu Master, in training
30
I wonder if this can also be applied to the Statefarm Drive Safe discount. It used to be a separate device you'd plug into your car that would gather information on your trips, but now I believe it's a smartphone app. The new version sounds even less appealing that the old one! At least that one you could just unplug.

I used to give a couple of old friends shit about using it and letting it collect all that information. Their response was always "Hey, it's worth it! It was free and we save $20 a month on our insurance!" I explained, to no avail, the whole 'If it's free, you're the product' concept. I haven't spoken to them in several years so I can only assume that they're still using it.

EDIT: After a quick Internet search I discovered that Starfarm Drive Safe discount is not available in California. Perhaps they knew not to even bother considering California being the way it is? Either way, I'm still curious to if it would\could have been included.
 
Last edited:
Upvote
24 (26 / -2)

hizonner

Ars Praetorian
541
Subscriptor
It’ll vary widely I’m sure - the offending component in Toyota’s is the DCM (Data Connection Module?) and I’ve seen threads regarding the RAV4, 4Runner, Corolla and seems like people have been experimenting with unplugging the antennae (not too effective), pulling the fuse entirely (works, takes the microphone with it and naturally app, SOS functionality), calling Toyota to disable (can it be turned back on remotely though?) but there isn’t a definitive solution. One could also get a vehicle that has 3G telematics since those networks are on the way out if not already.
Do I want to know what the microphone is for?
 
Upvote
6 (9 / -3)

Mad Klingon

Ars Scholae Palatinae
741
Subscriptor++
We need these kinds of privacy protections at a federal level. It has been said that where California goes the rest of the country eventually follows. I hope that is the case here.
Yes we do BUT very unlikely to happen. See earlier Ars article about NSA preferring to spy on Americans via purchasing data from data brokers vs doing it themselves. Plus others have already mentioned the lobby money from the new Feudal Lords that don't want us peasants to own anything. How can the Lords determine your rent if they don't know everything you have done and used in the last month?

My fleet of older non-connected vehicles is looking better and better. Kind of nice being pretty much a ghost on the roads. Plus no personalized tracking device for me. The old school flip phone stays off unless I want to make a call.
 
Upvote
19 (19 / 0)

hizonner

Ars Praetorian
541
Subscriptor
I wonder if this can also be applied to the Statefarm Dive Safe discount. It used to be a separate device you'd plug into your car that would gather information on your trips, but now I believe it's a smartphone app. The new version sounds even less appealing that the old one! At least that one you could just unplug.
Ah, there's an obvious manufacturer counter to self help. Convince insurance companies that "disconnected" cars should be uninsurable. They'll probably be receptive. 5 years? 10?
 
Upvote
18 (18 / 0)

JohnDeL

Ars Praefectus
5,194
Subscriptor
I definitely can remove the physical equipment. I'm just not sure how the car will react.
I spoke imprecisely. You can certainly remove the physical equipment, but it might turn your car into a very expensive brick at a random moment. Given the potential for loss and remote but remote but real possibility of danger associated with such a move, it would be foolish to remove the physical equipment.
 
Upvote
0 (5 / -5)
If you stick to old enough used cars, you'll find that the manufacturers cheeped out and shipped with 3G modems well into the LTE era. Now that 3G service is no longer a thing, these cars are effectively disconnected.
3G? Lucky!
Some cars here in Europe are still fitted with 2G modems. That's being turned off altogether in 2029.
 
Upvote
15 (15 / 0)

DaiMacculate

Smack-Fu Master, in training
2
Looking past the important privacy issues for a moment, why aren't we planning a future where we actually use this connectivity for positive things like traffic control and collision avoidance? If the majority of our cars are connected, then they can talk to each other and share traffic, weather and location data. This could theoretically even be supplemented with some other type of short range real time signaling when connected cars are within close range of each other so the cars always know what other cars intending to do.

Obviously manufacturers are never going to spontaneously agree to both implement this technology for that purpose and use a single standard, so that would be something we would need a new regulatory framework for I'm guessing?

It just seems like a terrible missed opportunity in a world where manufacturers are trying to master sensor-based auto-pilots on an individual vehicle basis to not have our vehicles connected to each other at least while they're going to be phoning home constantly to steal our data :p
 
Upvote
3 (8 / -5)

SuaveCriminal

Smack-Fu Master, in training
73
Subscriptor++
Do I want to know what the microphone is for?
Voice activated controls and Bluetooth hands-free calling. All benign features, if you trust the firmware.

I, purposely, bought a car without a modem last time I bought a new car. At the time, it was a separate line item on the sticker and it was an extra cost, so I opted out of having one installed, and saved $400.

Now, I'm guessing they're "standard equipment" and you won't be able to opt out, but maybe it's worth asking.

Of course, even sans modem, the vehicle could still collect the data and be uploaded during dealership maintenance, although at lower resolution than they'd be able to do with a modem.
 
Upvote
14 (14 / 0)

Dr Gitlin

Ars Legatus Legionis
22,569
Moderator
Looking past the important privacy issues for a moment, why aren't we planning a future where we actually use this connectivity for positive things like traffic control and collision avoidance? If the majority of our cars are connected, then they can talk to each other and share traffic, weather and location data. This could theoretically even be supplemented with some other type of short range real time signaling when connected cars are within close range of each other so the cars always know what other cars intending to do.

Obviously manufacturers are never going to spontaneously agree to both implement this technology for that purpose and use a single standard, so that would be something we would need a new regulatory framework for I'm guessing?

It just seems like a terrible missed opportunity in a world where manufacturers are trying to master sensor-based auto-pilots on an individual vehicle basis to not have our vehicles connected to each other at least while they're going to be phoning home constantly to steal our data :p

You mean like V2X? The car companies have been trying to get that going for more than a decade now. The "to infrastructure" part is hard because no municipality wants to pay for it to be installed.


 
Upvote
27 (27 / 0)
The monetization of vehicle connectivity has already moved further than many car owners realize. For example, GM debuted its Future Roads service a couple years ago, which sells connected data insights to road infrastructure providers in partnership with INRIX.

Whether selling congestion and safety data is transformational is debatable; DOTs have had effective traditional collection methods for years. It's undeniably profitable though, which is why it wasn't surprising to see Future Roads as a sponsor of the Transportation Research Board Annual Meeting.

edit: grammar, can't help myself.
 
Last edited:
Upvote
11 (11 / 0)

poke 532810

Smack-Fu Master, in training
85
Looking past the important privacy issues for a moment, why aren't we planning a future where we actually use this connectivity for positive things like traffic control and collision avoidance? If the majority of our cars are connected, then they can talk to each other and share traffic, weather and location data. This could theoretically even be supplemented with some other type of short range real time signaling when connected cars are within close range of each other so the cars always know what other cars intending to do.

Obviously manufacturers are never going to spontaneously agree to both implement this technology for that purpose and use a single standard, so that would be something we would need a new regulatory framework for I'm guessing?

It just seems like a terrible missed opportunity in a world where manufacturers are trying to master sensor-based auto-pilots on an individual vehicle basis to not have our vehicles connected to each other at least while they're going to be phoning home constantly to steal our data :p
That’s the idea behind vehicle-to-vehicle (V2V) communications. There’s also vehicle-to-infrastructure (V2I) or vehicle-to-everything (V2X), where vehicles can communicate with “smart” infrastructure to do the things you mentioned. Vehicle-to-whatever has some promise for improving safety, reducing congestion, etc., but the cynic in me thinks it’ll just end up as another avenue for hackers to pwn the system and another stream of personal data to monetize. Supporting this is the fact that a paper I read in a leading journal on a secure, privacy-preserving V2X protocol described a protocol that was neither secure nor privacy-preserving.
 
Upvote
24 (24 / 0)
Looking past the important privacy issues for a moment, why aren't we planning a future where we actually use this connectivity for positive things like traffic control and collision avoidance? If the majority of our cars are connected, then they can talk to each other and share traffic, weather and location data. This could theoretically even be supplemented with some other type of short range real time signaling when connected cars are within close range of each other so the cars always know what other cars intending to do.

Obviously manufacturers are never going to spontaneously agree to both implement this technology for that purpose and use a single standard, so that would be something we would need a new regulatory framework for I'm guessing?

It just seems like a terrible missed opportunity in a world where manufacturers are trying to master sensor-based auto-pilots on an individual vehicle basis to not have our vehicles connected to each other at least while they're going to be phoning home constantly to steal our data :p
Any such system would be predicated on ALL vehicles being connected.
 
Upvote
-2 (3 / -5)
Does anyone know if there's a good internet space where people are trying to figure out how these things are wired in different cars? Basically "hack-your-car" kind of matrix room. I've recently got a new car and after driving for a bit realized it has built-in internet connection (I'm guessing e-sim), knows and sends data on where we drive and probably records anything said inside.

My first reaction was to remove the internet connectivity and GPS modules, but of course trying to find out if that's even an option is next to impossible. I haven't been able to find good forums for these kind of things, only older reddit posts and such.
 
Upvote
19 (19 / 0)

hizonner

Ars Praetorian
541
Subscriptor
Looking past the important privacy issues for a moment, why aren't we planning a future where we actually use this connectivity for positive things like traffic control and collision avoidance? If the majority of our cars are connected, then they can talk to each other and share traffic, weather and location data. This could theoretically even be supplemented with some other type of short range real time signaling when connected cars are within close range of each other so the cars always know what other cars intending to do.

Obviously manufacturers are never going to spontaneously agree to both implement this technology for that purpose and use a single standard, so that would be something we would need a new regulatory framework for I'm guessing?

It just seems like a terrible missed opportunity in a world where manufacturers are trying to master sensor-based auto-pilots on an individual vehicle basis to not have our vehicles connected to each other at least while they're going to be phoning home constantly to steal our data :p
Governments as well as car makers are pushing telematics, because they want to do exactly what you're talking about. It just takes a long time to work out how, and an even longer time to get it into the installed base (which I believe they call the "fleet" in this case). It's not worth it, but it's not like there aren't lots of people not only thinking about it, but actually trying to get it done.
 
Upvote
11 (11 / 0)

Sabrewings

Ars Scholae Palatinae
794
Subscriptor++
I spoke imprecisely. You can certainly remove the physical equipment, but it might turn your car into a very expensive brick at a random moment. Given the potential for loss and remote but remote but real possibility of danger associated with such a move, it would be foolish to remove the physical equipment.
Do you think a car manufacturer is willing to accept the liability of shutting down your car in a remote part of the desert because the antenna malfunctioned?

At worst is should be a "Service Vehicle Soon" warning.
 
Upvote
17 (18 / -1)