Everything You Didn’t Know Your Car Knows About You

When we think about online privacy, we often think about things like our phones tracking our location or the digital footprint we leave behind when we browse the web. We’re thinking about the things that happen on our phones, computers, and tablets. We’re not thinking about cars. But all cars are collecting some data about you. The newer the car, the more capacity it has to collect a surprising amount of personal data. Car data collection can capture not just where you drive, but how you drive, who you text, and even how much you weigh. And you often have no idea who’s getting that data.

See Your Car is Spying On You: What It’s Collecting and Who It’s Telling Andrea Amico for a complete transcript of the Easy Prey podcast episode.

Andrea Amico is the founder of Privacy4Cars, one of the world’s foremost authorities on car privacy and data security. He started it with a simple idea – cars collect a lot of data, and there were very few protections for a privacy or security standpoint. The goal is to turn cars into a private space. Privacy4Cars educates people on the privacy, security, safety, and financial implications of car data collection and the astonishing amount of personal info they collect, store, share, and sell to unwanted third parties. The goal is to give you more choice and more understanding of how to take control.

The History of Car Data Collection

Many people don’t realize car data collection goes back more than twenty-five years. It started very simple. OnStar started in 1996 and gave cars SIM cards just like phones to alert emergency services in case of an accident. Bluetooth in cars emerged around the same time, and navigation systems are older than that. Bluetooth started becoming a common feature in new cars around 2006, and navigation around 2010.

As with all things, tech accelerates. What started small has ballooned into cars collecting a ton of data about you. The average car you buy new today collects around 25 gigabytes of data per day. These cars have a massive collection of interconnected computers and sensors. They’re still cars, but they’re very different from what we were driving even just a few years ago.

The average car that you can buy new today from a dealer lot collects somewhere around 25 gigabytes of data per day.

Andrea Amico

What Data Cars Collect

Most people intuitively understand that when you drive your car around, GPS is going to collect your location. Another thing that’s intuitive is that when you connect your phone to your car, data will go from your phone into your car. But it’s far more extensive from that. Nowadays, before you’ve even opened the car, it’s sensed your key, know how far away you are, and may automatically unlock. When you sit down, it takes your weight. It connects automatically to your phone and syncs all your text messages in plain text; plus it sees which apps are running and your recent photos.

When you start driving, it’s not just tracking your location second by second. Sensors are tracking your behavior. Your steering wheel, accelerator, and brake have sensors. Beyond just your GPS, a variety of sensors can locate you, fingerprint you based on how you drive, and build a profile of you. This profile can impact your insurance rates, your car payment, or your ability to get a new car lease.

Cars collect a lot of data. Much of it is transmitted elsewhere in real or near-real time. Some if it stays on the car and gets downloaded when you take it in for service. Or, more concerningly, it can be left behind when you return a rental car or lease. When you return that car, you’ve essentially handed your phone, unlocked, to a complete stranger.

Car Data Collection from Phones

When you connect your phone to a car, some of your phone’s data will stay in that car long after you take that phone away. Andrea often hears from consumers who think that because they only charged their phones or used Apple CarPlay or Android Auto that it’s not a risk. But that’s not true. When you plug a phone into a car, just like when you plug it into a computer, data can move between the two. Data from your phone will move into the car and stay there, unencrypted. It’s very common that every text message on your phone, in plain text, will end up in that car and stay there forever.

Your entire database of text messages in clear text is going to be moving into the car. It’s going to stay there forever until somebody deletes it.

Andrea Amico

Why does that matter? Think about all the stuff in your text messages. Information from your bank; doctor’s appointment reminders; sensitive stuff sent to your spouse. Someone could easily find out your bank. Many people save their debit card PIN in their contacts. There’s a lot of sensitive information there.

Andrea is currently doing a project with a professor at the University of Memphis. The professor buys car infotainment systems on eBay and extracts the data from them. Then he uses AI to examine that data and craft custom phishing messages. Andrea reached out to him to collaborate on thinking bigger. There’s big money in companies – if data from cars can create targeted phishing for individuals, what about targeting people’s leasing company, dealership, or insurance company? The collaboration is demonstrating how easy it is to do something nefarious with the data in your car.

Car Connections and Data Transfer

If you have a car with the ability to connect to a cell network or with a SIM card, that connection is always on, even if you’re not paying for that service. And most cars you buy today are almost guaranteed to have a SIM – 98% of cars sold since 2017 do. That connection is typically turned on at the factory, before the car even gets to the dealership. When you pay for that service, you’re subsidizing a connection that’s already there.

Some manufacturers give you free connection for a certain number of years. What often ends up happening is that manufacturers and other parties end up collecting data from the car with the understanding that the original owner consented to it, even though that may have been several owners ago. You have no idea that this is happening. The company has no idea they’re collecting data from a different person, but they’re happy to have the data either way.

Very often you end up with the manufacturer and other companies collecting data from a car under the understanding that the original owner, which may be one or two owners ago, consented when they bought the car.

Andrea Amico

If you read the talking points about these connections, they all say it’s necessary for safety. And Andrea doesn’t deny that some safety features require that connection. You need a live connection to call emergency services if you’re in an accident. But why are companies keeping this data for years? It’s just for monetization. Ford recently announced they expect to make $2,000 per car per year just in car data collection. GM’s numbers are close to that. Although GM recently had to settle with the FTC for selling that data to insurance companies without telling people it might affect their rates.

Your Car is Watching You

It’s increasingly common for cars to have a camera that looks at you. It’s often not even visible – it’s a pinhole camera behind the dash with the instruments. Some are even mounted in the rearview mirror to watch the backseat, too. These are called driver monitoring systems, and, like most car data collection efforts, are born from safety intentions. Lots of innovation in cars started with safety, and then people started to look for ways to monetize it.

It’s increasingly common for cars to have a camera that looks at you.

Andrea Amico

Many cars have an attention detection system. If it notices you’re looking away from the road, it takes some action, like making an alert noise or turning on the car’s hazard lights. This also becomes part of your driver profile. In the next few years, we may see these systems designed to notice intoxication, too. We all want a safer world, but there could be implications. Data could be sold to insurance companies, and the company could say that you clearly weren’t driving like normal right before the accident so you must have been intoxicated.

Andrea rarely has wonderful things to say about car manufacturers, but one has made some efforts to be thoughtful about privacy. They’re trying to put some standards in place to give consumer smore confidence. There are also standards developed by an organization called The Future of Privacy Forum. Those include minimizing data collection, keeping data locally on the vehicle, and not sending it to insurance companies. Unfortunately, some of this data can have harms not just in privacy, but also financially and in terms of safety.

Take Control of Your Car Privacy

The state of car data collection is pretty bad right now. But most of us need cars to get around. Not everyone can switch to biking everywhere, become a hermit, or buy a car from before these sensors existed. But there are still steps you can take to protect your car-based privacy.

Become an Informed Consumer

Andrea believes informed consumers are always better off. Unfortunately, manufacturers decided the best way to learn about their car data collection is through privacy policies and terms. These documents are so complex that only about a third of car buyers can understand them. A few years ago, Andrea started reading about privacy labeling systems. If you go to the App Store or Google Play Store, apps have labels that tell you what data the app collects, who it shares it with, and more. He started to wonder, why couldn’t we do this for cars?

The result of this question, and two years of work, was vehicleprivacyreport.com, which has been described as the Carfax of privacy. Type in your car’s VIN on the site and it will tell you what they know about the privacy in simple terms. They translate all the legal stuff into a set of ten simple icons to tell you what data it collects and where it’s going. It also helps you understand if your car is a “dumb car” or if it has a SIM card, because that changes your security posture.

Over time, the site has evolved to include things like links to more information about services your car has and what your finance and insurance companies are doing to protect your data. It also shows you what the manufacturer lets you opt out of in your state. Finally, it makes it easy for you to contact government offices in charge of these things and make it clear you want more privacy. This report is a great place to start to manage car data collection and increase privacy.

Wipe Your Car(’s Data)

When it comes to car data collection and privacy, the biggest risks are when you return a rental car, sell your car, or return a lease. Your car is like a giant unencrypted hard drive of your data. The newer the car, the more data it has. And even if you haven’t had the car for very long, it can be a surprising amount. If you give that car to someone else without wiping the data, you’ve just handed that hard drive to a stranger. And we’re seeing more and more cases where that data is being abused.

The newer the car, the more data you can expect is going to be collected about you.

Andrea Amico

You wouldn’t get rid of a computer or phone without clearing your data. You should treat your car like that, too. It’s not technically a hard drive, but you can still clear your data. Every car has a process, and some are simpler than others. The record Andrea has seen for a vehicle he won’t name was 56 separate steps to get rid of all the data. But you should still do it. Privacy4Cars has a tool free to consumers that can help. You can visit privacy4cars.com to find instructions and tools to help you wipe your car’s data.

You should also wipe a car’s data as soon as you get a new one. Inheriting someone else’s data is risky. If the previous owner used the manufacturer’s app and you don’t wipe the data, their phone is essentially a spare key to your car. Old data can also help criminals steal your car. It’s just safer to wipe it right away.

Please delete the data on your car.

Andrea Amico

Cars are an Underrated Risk Factor

People really underestimate cars’ privacy and security risks. Car data collection is a huge risk to both. If you’re reading this, you probably care about privacy and security and don’t want to be scammed. Start treating your car like your phone or laptop. The same things you do to keep the data secure on those devices, do that for your car.

You should really start to think about your car just like your cellphones and your laptops.

Andrea Amico

If you don’t know what that looks like for a car, start with your Vehicle Privacy Report. See what actions you can take and do them. There are also a lot of free tools and advice at privacy4cars.com. There are still a lot of states were you don’t have many privacy rights, but there are still things you can do. The more people who make clear that they’re concerned about car data collection and privacy, the more likely that something will actually be done.

And if you’re still not sure what steps to take, want advice, or want to share a specific story, don’t hesitate to reach out. Andrea and his team are happy to help, and consumer stories help them figure out what they can do moving forward to help more.

You can connect with Andrea Amico on LinkedIn, where he is active. To learn more about car privacy and get resources, visit privacy4cars.com. There, you can contact Andrea and his team and find resources for both consumers and businesses.