AUTOMOTIVE
Data on Wheels
Today’s vehicles are rolling information collectors, but when it comes to personal privacy, are owners in the driver’s seat?
By Matt Bubbers | Illustrations by Mike Ellis
THERE'S A CLICHÉ that says vehicles have become like rolling smartphones or computers on wheels, and — for better and worse — the cliché is true.
Modern vehicles are nearly all connected to the Internet and often to your phone. Just like any other high-tech digital device, like smart fridges and doorbells, new vehicles are constantly collecting personal information on their owners.
"When you think about it, your vehicle knows almost everything about you. They know where you live, where you work, where your kids go to school, even which drive-through you visit for your morning coffee," says Jeff Kasbrick, vice-president of advocacy and operations at AMA.
This opens a Pandora’s box of security and privacy issues. While some of the data is used to make vehicles safer and more reliable, the average driver might not want to share personal information with the likes of advertisers, automakers or any third party.
Even though there are some steps you can take to protect yourself from this data mining, AMA and other advocates feel that drivers are currently not adequately protected. As part of its advocacy work, the association is talking with policy-makers to establish the following three key pillars of automotive data privacy.
1
TRANSPARENCY
Vehicle owners should be able to easily understand what data is being collected and for what purposes, so they can provide consent or not.
2
CHOICE
Vehicle data should belong to its owner — not to a manufacturer. Owners should be able to provide their consent and have a choice on the amount of personal data collected and with whom it is shared.
3
CONTROL
Vehicle owners should have a means to easily erase personal data when a vehicle is sold, rented or shared.
"We underscore to government that this isn't a future technology issue," says Kasbrick. "It's an issue today and it needs to be addressed."
Indeed, some automakers in the U.S. have recently come under fire for sharing their customers’ driving habits with insurance companies without customers’ knowledge. It could happen here in Canada too, so you’ll want to check your vehicle's privacy policies to be sure you understand what you’re sharing.
THE INFORMATION HIGHWAY
So, how do vehicles rake in all this data about you and your life? Onboard GPS and cellular connections track location. Microphones pick up conversations and voice instructions (such as, “Hey Alexa, turn up the volume.”). Some vehicles use voice recognition to identify who is speaking. Touchscreens are the conduit between the data on your phone and the Internet. Vehicles can record when and how you interact with their touchscreens, while an event data recorder (a.k.a. a black box) tracks information, including vehicle speed, position, acceleration, braking and steering. A typical connected vehicle can generate nearly 25 gigabytes of data per hour, according to automotive data provider S&P Global Mobility. Management consulting firm McKinsey predicts that, by 2030, more than 90 percent of vehicles sold will be connected.
WHAT’S YOUR DATA DOING?
For automakers, controlling all this data could be a big money-maker. McKinsey estimates the global market for car data monetization could be worth $750 billion by 2030. In a comprehensive study conducted in 2023 by U.S. non-profit Mozilla Foundation, experts spent 600 hours wading through privacy policies of 25 vehicle brands, including Tesla, Toyota, Honda and GMC. Their conclusion: “Modern cars are a privacy nightmare.” All 25 brands were bestowed with Mozilla’s “privacy not included” warning label. In Canada, although automaker privacy policies can differ slightly, AMA and other advocates are still pushing to ensure vehicle data belongs to owners and that personal privacy is protected. When you’re shopping for a new vehicle, privacy is, understandably, not front of mind, says Vincent Gogolek, a retired lawyer and a former executive director of the non-profit BC Freedom of Information and Privacy Association (FIPA), which is based in Victoria, B.C. “The basis of privacy law, generally, is that whomever’s personal information is being collected, they agree to it. This is why you have ‘agree to our terms and conditions’ check boxes,” explains Gogolek, who was part of FIPA’s two Canadian studies — in 2015 and 2019 — that made recommendations pertaining to vehicle privacy policy. The fundamental problem, however, is that users have little choice but to agree to the privacy policy of whatever vehicle they’re driving. Even if you’re fine with most of it, notes Gogolek, there’s often no way to partially opt out or to decline permission for, say, facial recognition or video recording. “It’s a problem. By putting your check mark in the box, you don’t know what you signed away.”
PRIVACY REGULATIONS
Experts say the relevant federal privacy law — the Personal Information Protection and Electronic Documents Act (PIPEDA) — is outdated. The proposed update — Bill C-27, the Digital Charter Implementation Act, 2022 — would have given consumers more control and transparency on how their personal information is handled. Unfortunately, the bill recently died in the House of Commons.
Drivers must be given the ability to provide meaningful consent when it comes to vehicle data, including the ability to use their vehicles without unnecessarily abandoning the right to privacy, says Kasbrick. "Automakers should not treat your personal information like it belongs to them. We believe you should own your data and only you should decide how it's used."
Until firmer checks are in place, vehicle owners should get familiar with their vehicle's privacy settings, usually found deep in a submenu on the infotainment screen. Consider the privacy implications of putting an automaker’s app onto your phone or sharing your phone’s data with the vehicle. Take advantage of optional “privacy mode” or “guest mode” features available on some newer vehicles, which should limit data collection. Finally, before you sell or trade your vehicle, remember to delete your data from the system.
Just as with your smartphone, it’s up to you to make sure you understand what you are sharing each time you operate your vehicle — and to do what you can do keep your information private. Especially because, for now, automakers aren't making this very easy. AMA
“Just as with your smartphone, it’s up to you to make sure you understand what you are sharing each time you operate your vehicle.”
Public Opinion
In 2023, AMA conducted a survey to gauge public opinions on vehicle data privacy. Three-quarters of Albertans were not aware that, as part of their vehicle purchase/lease agreement, they granted the ownership of their vehicle data to the automaker. About the same number of respondents believe that whoever owns or leases the vehicle should control the data generated by it, not the automakers.
Usage-based Insurance
What about usage-based insurance plans, like AMA MyPace™ and AMA MyRide? These do collect data about your driving behaviours with the goal of reducing insurance rates, but you need to opt in to these programs. The terms and conditions of these programs outline that your data is never sold or shared with third parties.
1
TRANSPARENCY
Vehicle owners should be able to easily understand what data is being collected and for what purposes, so they can provide consent or not.
2
CHOICE
Vehicle data should belong to its owner — not to a manufacturer. Owners should be able to provide their consent and have a choice on the amount of personal data collected and with whom it is shared.
3
CONTROL
Vehicle owners should have a means to easily erase personal data when a vehicle is sold, rented or shared.