Preventing Your Internet-Connected Car from Sharing and Selling Your Driving Data

• By 2030, it is predicted that over 95% of passenger cars sold will have internet connectivity, and McKinsey estimates that car-data monetization could generate between $250 billion to $400 billion in annual revenue for industry players.
• Insurance companies' recent purchase of driver data has caused internet privacy advocates concern, as a recent analysis labeled cars as the "worst product category" in terms of privacy.
• It is common for consumers to struggle to locate the option to opt out of data sharing within the settings and menus of many consumer technologies.

Connected cars, which are vehicles equipped with internet access, are increasingly becoming the norm. However, this development is causing concern among consumer data privacy advocates due to the potential risks associated with the proliferation of such technology.

According to Counterpoint Technology Market Research, by 2030, over 95% of the passenger cars sold are expected to have embedded connectivity. This enables car manufacturers to provide features related to safety, security, predictive maintenance, and prognostics. However, it also provides an opportunity for companies to gather, share, or sell data about driving habits and other personal information that people may not want to disclose.

Car manufacturers offer the option to opt out of data sharing, but these settings are often concealed in menus, according to Parv Sharma, a senior analyst at Counterpoint. A McKinsey report from 2021 predicts that car-data monetization could generate $250 billion to $400 billion in annual revenue for industry players by 2030.

There are valid reasons for collecting driver and car data, including safety and functionality purposes, and some essential services may be difficult or impossible to opt out of. Predictive maintenance is one such reason, as manufacturers can use data sharing to determine that a part used in their fleet is failing sooner than expected, allowing them to issue a recall, said James Hodgson, smart mobility and automotive research director at global technology intelligence firm ABI Research.

As car companies increasingly share driver data with insurers and enter the insurance industry themselves, there are growing privacy concerns about the potential for driving habits and car-usage details to be reported to data collectors and used for rate decisions. However, usage-based insurance models, such as those offered by Progressive and Root, allow drivers to potentially earn lower rates if they allow insurers to install devices in their cars that track their behavior.

The possibility exists that sensitive personal information may be unintentionally exposed to malicious actors or sold to advertising companies.

"Car companies collect, share, and sometimes sell an excessive amount of personal and car information, beyond what is necessary for safe transportation. This practice is becoming increasingly concerning, as a recent report from Mozilla Foundation revealed that 25 major car brands received failing grades for consumer privacy. The headline of the report read: "Cars Are the Worst Product Category We Have Ever Reviewed for Privacy.""

A survey of over 2,000 car owners and lessors in the U.S. by Salesforce revealed that many drivers are unaware of how their data is being used in connected cars. While some drivers may be willing to share personal data for benefits like personalized driving experiences and lower insurance rates, not understanding how data is being used could put consumers at risk.

Another option, which is becoming increasingly impractical, is to buy an older car that cannot collect your data.

Before purchasing a car, it is recommended to research the carmaker's privacy protections. This information can typically be found on the carmaker's website or through online searches using keywords such as the company name, privacy, and connected car. While some companies claim they do not sell customer data, this does not necessarily mean they are not sharing it with third parties. The definition of selling can be complex and may vary depending on factors such as state privacy laws, as explained by Caltrider.

What Ford, Hyundai, Nissan and BMW say

Before using Ford's carmaker app or signing up for its connected services, consider your options for opting out. Ford provides customers with a choice regarding any sharing of connected vehicle data. Hyundai allows owners and lessees to choose whether to enroll in its connected services by accepting the terms and conditions at any point during their use of the vehicle. Nissan also allows consumers to opt out of data collection. BMW allows vehicle drivers to make granular choices regarding the collection and processing of their personal information, and further, customers can delete their data whether on their apps, vehicles, or online.

If you have already downloaded the app or signed up for connected services, contact your car manufacturer to inquire about opting out. In certain states, such as California, Colorado, and Connecticut, consumers have the right to request information about the personal data collected and how it is being shared, according to Cobun Zweifel-Keegan, managing director for D.C. at the International Association of Privacy Professionals. Several states allow consumers to opt out of having their personal information sold, and more are considering this option.

Choosing not to share data has its drawbacks, as it may limit access to helpful features such as navigation, remote unlock, and service updates, according to Mo Al-Bodour, a consulting manager at SBD Automotive.

Consumers should be sure to review their privacy settings periodically, Caltrider said.

The government is looking at car privacy regulations

The California Privacy Protection Agency's enforcement division is currently reviewing the data-sharing practices of the connected vehicle industry, which is facing regulatory efforts to protect privacy.

The Federal Trade Commission may enforce against carmakers if their data-sharing practices are not adequately disclosed, according to Zweifel-Keegan.

In December, Senator Edward J. Markey (D-Mass.) wrote to 14 car manufacturers to request stronger privacy protections in their vehicles.

"Cars are essentially smartphones on wheels," Markey wrote in an email. "We cannot let automakers' profit motives outweigh the need to safeguard consumer privacy. That's why I demanded information from 14 companies about their data practices and privacy protections in their vehicles. Self-regulation has proven ineffective. The federal government must take a leading role in protecting consumers' right to privacy," he said.

An email from Eric Goldman, associate dean for research and a professor at Santa Clara University School of Law, stated that a comprehensive federal consumer privacy bill is urgently needed to address the current situation and replace the patchwork of state laws.

Apple differentiates itself from competitors by using stricter data privacy practices as a marketing tool. However, this is not the case for car companies today. At some point, manufacturers may compete on the idea that consumers can easily turn off certain data.